Cookie Policy

What is stored in your browser

Cookies are values a browser stores and can send with requests to a website. Local storage also saves values in the browser, but does not automatically attach them to requests. This policy covers both.

• Sign-in: the necessary __Host-btl-session cookie keeps you signed in for seven days by default. Beyond the Login's administrators can set that from 15 minutes to 30 days, and accounts with staff permissions are signed out sooner. Signing out revokes that session and clears the cookie.
• Registration: the necessary __Host-btl-registration cookie connects verification to the browser where you started, for up to three hours and ten minutes. After verification it lets other open tabs identify the result. Password sign-in or sign-out clears it.
• Email link: the necessary __Host-btl-pending cookie remembers the verification link selected in this browser so refreshing can recover the page. It lasts for at most 70 minutes, including a brief period to check the result after verification. It does not extend link validity or sign you in by itself. Password sign-in or sign-out clears it.
• Password reset: the necessary __Host-btl-reset cookie remembers the selected reset link for up to 70 minutes, including ten minutes to check the result after the one-hour reset window. It does not sign you in or extend the reset deadline.
• Email sign-in: the necessary __Host-btl-signin cookie connects an emailed sign-in link or code to the browser that asked for it, for as long as that link or code works, from 5 to 60 minutes.
• Passkey sign-in: the necessary __Host-btl-passkey cookie connects a passkey prompt to this browser for five minutes.
• Trusted browser: the necessary __Host-btl-trusted cookie is set only when you choose to trust this browser at the second step. It lets this browser skip the second step for the number of days Beyond the Login's sign-in settings allow, at most 30. Forgetting trusted browsers on your Security page ends it.
• Signing in to applications: when an application uses Beyond the Login's own organization to sign you in, the necessary __Host-btl-oauth-tx cookie holds that request in progress for up to ten minutes, and __Host-btl-oauth-session keeps you signed in to the organization for the session lifetime it sets. These two are the only cookies our website passes to its sign-in service for applications.
• Remembered email: while Beyond the Login's sign-in settings allow it, the __Host-btl-last-email cookie keeps the email address that last signed in on this browser for up to a year, so the sign-in page can fill it in. It never signs you in or skips a step. Clear it with the X at the end of the sign-in page's email field, or delete your account, to remove it.
• Theme: btl-theme remembers the light or dark theme you select.
• Lab task display: btl-lab-task-display-v1 remembers whether you read focused labs with all tasks shown or one task at a time. It holds only "all" or "one" and applies across those labs in this browser.
• Motion: btl-landing-motion-v1 remembers whether you paused the site's moving parts, so they stay still next time. One choice covers the home page, the moving background behind sign-in and error pages, the padlock on lesson pages and the examples on the design system reference page. It holds only "paused" or "playing".
• Your computer: btl-lab-environment-v1 remembers which computer you chose, such as Ubuntu or macOS, so lessons and labs show the matching instructions.
• Navigation: btl-nav-v1 remembers which menu links your account showed last time, such as whether you are signed in, so the next page can draw them immediately. It holds no name, email or account details, never grants access, and is corrected by our servers on every page and cleared when you sign out.
• Quiz progress while signed out: btl-quiz-v1:<lesson> remembers the questions you answered correctly in each lesson. It is not sent to our servers unless you sign in and choose to add it to your profile, which then removes it from the browser. While you are signed in, quiz progress is saved with your account instead, and nothing is written here.
• Lab quiz choices: btl-lab-quizzes-v1 remembers the lessons, question types and round length you last chose on the Lab's Quizzes page, so your next round starts from them. It holds only lesson names and those settings, not your answers.
• Lab quiz round in progress: btl-lab-quizzes-round-v1 keeps the Lab quiz round you are answering in this tab, so following a question's lesson link and coming back resumes it. It holds which questions the round asks and whether each answer so far was right, and it is removed when the round ends or you close the tab.
• Old training path: btl-learning-path-v1 held the training path you last opened a lesson from in an earlier version of the site. The site no longer writes it, and removes it when you open a page.
• Progress offer put off: btl-progress-offer-dismissed-v1 remembers which lessons' signed-out quiz progress you chose not to add to your profile yet, so lesson pages stop offering it until there is progress for another lesson. It holds only lesson names, not your answers, and the offer stays on your profile's Learning tab.
• Privacy choice: btl-privacy-v1 records whether you allow optional analytics and when you made that choice. We ask again after 180 days.
• Old tenant names: btl-tenant-names-v1 held the names of the tenants you could manage in an earlier version of the site. The site no longer writes it, and removes it whenever this browser is no longer signed in.
• Chosen tenant: btl.tenant.v2 remembers the tenant you last chose in your account menu. It holds only that tenant's ID and never grants access. Without it, the menu opens the default tenant your profile names. An earlier version used btl.tenant, which the site now removes.
• Sign-out signal: btl-session-ended is written when you sign out, so other open tabs of this site notice and sign out too. It holds a random value and no account details.
• Older lab progress: earlier versions of the site kept a copy of signed-in lab progress in btl-lab-progress-v1 or btl-lab-progress-v2. Lab progress now stays with your account only, and the site removes these values when it finds them.
• Owned Lab application views: btl-owned-saml-cached-view and btl-owned-rp-cached-view remember the last displayed session status on each example application's own address. Labs use them to compare a cached display with the current server session. They never grant access and remain until you clear the cached view, clear that application's browser storage or reopen its page, which replaces the saved status.

Some pages also use session storage, which the browser removes when you close the tab:

• Return after confirming it is you: btl-return-after-sign-in remembers the BTL Admin page to reopen after you sign in again to confirm a change.
• Support page origin: btl-support-origin remembers the page you opened Support from, so a new ticket can mention it.
• Token Decoder sign-in: btl-token-decoder-request holds the one-time values for a Token Decoder sign-in in progress, for up to ten minutes.
• Your account in this tab: while you are signed in, btl-account-tab-v1 remembers your account ID and name, btl-lesson-progress-tab-v1 remembers which lessons you have started or completed and how many of their quiz questions you answered, btl-lab-progress-tab-v1 remembers which labs you have started or completed and when you started them, and btl-lab-card-tab-v1 remembers the checks of the lab shown at the top of the Lab page, so the next page you open in the tab shows your account menu, lesson progress and lab progress immediately. They hold no email address or answers, never grant access, are replaced by our servers' answer on every page, and are cleared when you sign out.

The account cookies are first-party cookies that browser scripts cannot read. They support registration and sign-in even when you select Only Necessary. The other values above use first-party local or session storage. Local storage values remain until you, your browser or the site removes them. A saved privacy choice remains in storage until removed or replaced, but stops authorizing analytics after 180 days. You can clear all of them through your browser's site-data settings.

Cloudflare also delivers and protects this site. Its security features may use cookies when needed to check traffic or remember a security challenge. Those are separate from optional Web Analytics and cannot be switched off by our analytics setting. Blocking them in your browser may affect access to the site. Cloudflare describes these cookies and their durations in its cookie documentation.

Cookies on tenant addresses

Each tenant has its own address, and the cookies it sets belong to that address only, never to this website or another tenant. They are necessary for signing in to the tenant, so they are set whatever you choose about analytics:

• Tenant sign-in: __Host-btl-oauth-session keeps a tenant user signed in for the session lifetime the tenant sets, or 15 minutes while a sign-in waits for its second step. Signing out clears it.
• Sign-in in progress: __Host-btl-oauth-tx holds an application's sign-in request for up to ten minutes, and __Host-btl-signin connects sign-in steps, such as an emailed link, to the browser for up to an hour.
• Trusted browser: __Host-btl-trusted is set only when a tenant user chooses to trust the browser, and skips the second step for the number of days the tenant allows, at most 30.
• Other sign-in steps: __Host-btl-federation holds a sign-in through another identity provider for up to 15 minutes, __Host-btl-saml holds a SAML application's request for up to ten minutes, __Host-btl-saml-logout keeps track of signing out of the SAML applications a tenant user opened for up to ten minutes, __Host-btl-device connects a device sign-in code for up to ten minutes, and __Host-btl-recovery connects an account recovery request to the browser until that request expires.
• Remembered email: unless the tenant turns it off, __Host-btl-last-email keeps the email address that last signed in on the browser for up to a year, so the tenant's sign-in page can fill it in. It never signs anyone in or skips a step, and the X at the end of the sign-in page's email field removes it.
• Session check: __Host-btl-opbs holds a value derived from the tenant session, never the session itself, so applications the tenant user signed in to can check whether that session has changed. Page scripts on the tenant address can read it, and it lasts up to a day.

The Token Decoder on a tenant address keeps a sign-in in progress in the session storage value listed above. The tenant's administrators decide its session lifetime and trusted-browser period. Our Privacy Policy explains what tenants store about their users.

Optional Cloudflare Web Analytics

When configured, Cloudflare Web Analytics helps us understand visits and page performance. Its browser script does not use cookies or local storage to track visitors. It reports information such as page paths, referring sites, browser and device categories, and page-load measurements. We do not add quiz answers or saved quiz progress to those reports.

We show the same prompt regardless of your country. Allow all enables optional analytics. Only necessary leaves it off. Your selected theme, navigation and signed-out quiz progress support the features you use and are not used for tracking. We load the analytics script only after you choose Allow all. Choosing Only necessary does not prevent you from using lessons or quizzes. If your browser sends Global Privacy Control, we keep optional analytics off. Development and preview sites do not load the analytics script.

Changing your choice

Use Cookie settings in the footer to change your choice about analytics. Withdrawing a previous allowance reloads the page to remove the loaded script and prevent further collection on subsequent page loads. It does not erase measurements already sent. Choices apply to this browser on this site, so make the same choice on other browsers or devices you use.

Without JavaScript or a saved allowance, our optional analytics script does not load. If your browser cannot save a preference, analytics stays off. This control does not prevent Cloudflare from processing the network requests needed to deliver and protect the website.

Advertising and future changes

We do not currently show advertising or use advertising trackers. If we introduce sponsorships or third-party advertising, we will identify paid placements and update our policies before introducing new data uses. Consent to analytics will not count as consent to advertising tracking.

Our Privacy Policy explains other information handling. For questions, contact [email protected].