Cookie Policy
Version 1.0. Effective date: 28 October 2026.
This policy lists every cookie and similar technology that UniPortal uses. This includes browser storage and content that your browser loads from other companies. It is part of our Privacy Policy.
1. Your choices
Under Irish law (the ePrivacy Regulations 2011), we need your consent to store or read information on your device, unless it is strictly necessary for a service that you asked for. We group storage into four categories:
| Category | What it does | Your choice |
|---|---|---|
| Strictly necessary | Keeps UniPortal secure, signs you in, remembers your cookie choice and applies the limit for visitors without an account. | Always on. |
| Functional | Remembers your recent searches. | Off until you turn it on. |
| Analytics | Measures how features are used (via PostHog) and collects browser diagnostics (via Sentry). | Off until you turn it on. |
| External media | Shows Google Maps. | Off until you turn it on. |
When you first visit, a banner lets you choose Manage preferences or Accept all. In Manage preferences, you can choose Necessary only, or select the categories that you want and save. Optional storage stays off until you choose.
You can change your choice at any time in Settings → Cookies & Privacy, with the cookie settings button, or with the button on a map placeholder. If you withdraw consent, we stop at once, in all your open tabs, and we remove the storage that we control for that category from your browser. We ask you again after 180 days, or sooner if this policy changes significantly.
2. Strictly necessary
These items are needed for UniPortal to work securely, so they do not need your consent.
| Name | Type | Set by | Purpose | How long it lasts |
|---|---|---|---|---|
__Host-authjs.csrf-token | Cookie | UniPortal | Protects the sign-in forms against forged requests. | Until you close your browser. |
__Secure-authjs.callback-url | Cookie | UniPortal | Remembers which page to return you to after you sign in. | Until you close your browser. |
__Secure-authjs.session-token | Cookie | UniPortal | Keeps you signed in. Its contents are encrypted. | Ends after 1 day without use, or after 60 days without use if you chose "Remember me". |
up_consent_v1 | Cookie | UniPortal | Records your cookie choices and the date that you made them. | 180 days. |
up_inst_daily | Cookie | UniPortal | For visitors without an account: records up to two institution profiles opened, to apply the limit of two free profiles per day. | 24 hours from your first profile view. |
uniportal:alumni-banner:<account ID> | localStorage | UniPortal | Remembers that you closed the Review invitation banner, so it does not show again. It stays on your device and is not sent to us. | Until you clear your browser storage. |
uniportal:consent-sync | localStorage | UniPortal | Passes a new cookie choice to your other open UniPortal tabs. | Removed immediately. |
uniportal:analytics-viewer-sync | localStorage | UniPortal | Tells your other open tabs that you signed in or out. It holds no identifier. | Removed immediately. |
| Cloudflare Turnstile | Cookie or browser storage | Cloudflare | Checks that a person, not a bot, sends the feedback form. Loads only when you open that form. | 5 minutes. |
About up_inst_daily. Visitors can open two institution profiles per day without an account. This cookie applies that limit. It holds only the names of the profiles that you opened and the time when the limit resets. It contains no identifier, and we do not use it for anything else or share it. It is set even if you reject optional storage, because the free access that you ask for depends on it.
3. Functional (only with your consent)
| Name | Type | Set by | Purpose | How long it lasts |
|---|---|---|---|---|
uniportal:search-history | localStorage | UniPortal | Remembers up to 8 of your recent searches on this device. It is not sent to us. | Until you clear it, or withdraw Functional consent. |
4. Analytics (only with your consent)
With your consent, we use PostHog (EU Cloud) to measure how features are used, and Sentry (Germany) to collect browser diagnostics. We do not record your screen, and we do not collect search text, names or email addresses in analytics. If you are signed in, PostHog links events to your account ID, but not to your name or email.
| Name | Type | Set by | Purpose | How long it lasts |
|---|---|---|---|---|
ph_uniportal_analytics | localStorage and sessionStorage | PostHog, stored on uniportal.io | Holds a random analytics ID, a device ID and session details, and your account ID once you sign in. | localStorage: until you withdraw consent or clear it. sessionStorage: until you close the tab. |
uniportal_analytics_consent | localStorage | PostHog | Records that you allowed analytics. | Until you withdraw consent. |
ph_uniportal_analytics_primary_window_exists, ph_uniportal_analytics_session_registered_properties | sessionStorage | PostHog | Internal PostHog settings for the current tab. | Until you close the tab. |
up_analytics_signals | Cookie | UniPortal | Passes the "account created" and "onboarding completed" events from our server to analytics. | 10 minutes. |
ph_uniportal_analytics_processed_signals | localStorage | UniPortal | Stops the same event from being sent twice. Holds up to 50 random IDs. | Until you withdraw consent or clear it. |
ph_uniportal_analytics_app_opened:<account ID or "anonymous"> | sessionStorage | UniPortal | Sends the "app opened" event once per tab. | Until you close the tab. |
ph_uniportal_analytics_search_pending, ph_uniportal_analytics_search_active, ph_uniportal_analytics_profile_attribution | sessionStorage | UniPortal | Links a search to the profile that you opened from it, with a random ID (not the search text). | 30 minutes, or until you close the tab. |
ph_uniportal_analytics_recommendations:<viewer>:<page area> | sessionStorage | UniPortal | Counts a recommendation list as viewed only once. | Until you close the tab. |
| Page history markers | Browser history state | UniPortal | Stops a page view from being counted twice. | Until you close the tab. |
| Sentry browser diagnostics | No storage; sends data to Sentry | Sentry | Reports errors and sampled page-speed data (section 2 of our Privacy Policy). | Not stored in your browser. |
5. External media and content from other companies
Google Maps (only with your consent). Maps appear in map search, on the Location tab of institution profiles, and when you place a pin while suggesting an institution. Until you allow external media, we show a placeholder and nothing loads from Google. Once you allow it, maps load wherever they appear. Google then receives your IP address and browser data, loads its scripts and fonts, and may set or read its own cookies on Google domains. Google controls these cookies; see the Google Privacy Policy and how Google uses cookies.
Globe image on the home page. Our home page shows a globe. Its image loads from Wikimedia (upload.wikimedia.org) and unpkg (unpkg.com), with jsDelivr (cdn.jsdelivr.net) as a back-up. This happens on every home-page visit, before you make a cookie choice. We do not store anything on your device for this, but these organisations receive your IP address and browser data when your browser requests the image. They are based in or operate from the United States. We rely on our legitimate interest in displaying the page (see our Privacy Policy).
Links. Links to Instagram, YouTube and LinkedIn are plain links. Nothing loads from these companies unless you click a link.
6. Browser controls, changes and contact
You can also block or delete cookies and site data in your browser settings. If you block strictly necessary cookies, you cannot sign in, and some pages will not work.
We update this policy when we add, change or remove any item in it. Each version shows its effective date at the top.
Questions: email team@uniportal.io.