Full transparency

Cookies

Which cookies Mahara uses, why we use them, and how you control them from your browser.

Last updated: 17 May 2026

Language notice: this English text is provided so that international members can read our terms in full. The Arabic version remains the legally binding reference. Where the two differ, the Arabic text prevails.

The rule: no tracking cookies without your consent. Only the essential ones needed to run the platform are active by default.

What are cookies?

Cookies are small text files your browser stores when you visit a site. They are used to remember your preferences, keep you signed in, or analyse how a site is used. Some preferences rely on your browser's local storage rather than on cookies, and we say so in each category below.

The categories we use

Essential

Always on

Without these the platform does not work. They are set automatically.

  • __Secure-authjs.session-token: keeps you signed in
  • mh_2fa: proof of a trusted device for members who enabled two-factor authentication
  • mh_push_installation: links a notification subscription you explicitly enabled to this device

Preferences

Optional

Stored locally in your browser and never sent to our servers.

  • mahara-theme: your light/dark mode preference (local storage)
  • mahara_consent_v1: your consent decision (local storage)

Analytics

Optional

We use Google Analytics to understand how the platform is used and to improve it: anonymous statistics, no personal tracking.

  • _ga and similar: distinguishes a browser without identifying a person
  • Before you consent the tool runs in denied mode by default, so no analytics cookies and no identifiers are created at all

Marketing

Optional

We do not use this category at present. We would ask for your explicit consent before enabling it in the future.

  • No advertising cookies are active

How to control them

You have three ways to take control:

  • Through the consent bar on the platform: it appears on your first visit, and again once your decision expires or after you clear your browsing data.
  • Through your browser: every browser lets you block cookies entirely or delete the ones already stored.
  • Private browsing: no cookies are kept in incognito or private mode.

Note: if you block essential cookies, you will not be able to sign in.

Third-party services

The only third party that may place cookies on your device is Google Analytics, only after you consent, and only for anonymous statistical purposes. Everything else (sessions, preferences) is handled directly by Mahara's own servers with no intermediary.

We do not use the Facebook Pixel, or any other external advertising or tracking tool.

How long they last

  • Session cookie: deleted when you sign out or when the session expires.
  • Trusted-device cookie (mh_2fa): 30 days.
  • Notification-device cookie (mh_push_installation): up to 400 days, or removed sooner when you disable notifications or sign out.
  • Local preferences: kept until you clear them from your browser.
  • Consent decision: 6 months, then we ask again.
  • Analytics cookies: you can delete them from your browser at any time.

Contact

Questions or a correction request: info@mahara.sy