Cookie Inventory

This Cookie Inventory forms part of the Brain-Shot Academy privacy hub and should be read together with the Cookie Policy.

Privacy hub documents: Main Privacy Notice, Cookie Policy, Cookie Inventory, Processor Appendix, International Transfers Appendix, Retention Appendix, Legal Bases Matrix, and Required and Optional Data Matrix.

Not every item below appears on every service or every visit. Some items are service-specific, some are consent-dependent, and some are provider-controlled. The durations below reflect the current Brain-Shot Academy inventory or the provider's documented default where the item is conditional.

1. Current named cookies and similar technologies

Item	Scope	Set by	Main purpose	Typical duration	Category
`bsa_gid`	Shop gift and access-related flows	Brain-Shot Academy	Maintain gift identity and continuity for gift-access and related anti-abuse checks	365 days	Strictly necessary / service continuity
`bsa_auth_challenge`	Shop authentication and gift-related sign-in flows	Brain-Shot Academy	Maintain signed pending authentication-challenge state during short-lived verification flows	20 minutes	Strictly necessary / security
`bsa-shop-basket`	Shop	Brain-Shot Academy	Maintain basket contents and related shop continuity state	365 days	Strictly necessary / service continuity
`bsa_st_sid`	Brain-Shot Academy platform services	Brain-Shot Academy	Maintain first-party security telemetry within a browser session	Session	Strictly necessary / security
`bsa_dk_seed`	Brain-Shot Academy platform services	Brain-Shot Academy	Maintain a first-party browser seed for security telemetry and device continuity	1 year	Strictly necessary / security
`bsa_dk`	Brain-Shot Academy platform services	Brain-Shot Academy	Maintain a first-party device key for security telemetry and abuse prevention	1 year	Strictly necessary / security
`_bsa_consent`	Public website or services using BSA consent tooling	Brain-Shot Academy	Store the consent-category snapshot	395 days	Strictly necessary
`_bsa_consent_meta`	Public website or services using BSA consent tooling	Brain-Shot Academy	Store consent metadata such as timestamps, region, and banner version	395 days	Strictly necessary
`_bsa_crid`	Public website or services using BSA consent tooling	Brain-Shot Academy	Store the consent receipt identifier	395 days	Strictly necessary
`sb-jrclairmdhudqhbwtiay-auth-token`	Proprietary Brain-Shot Academy websites and web apps using Supabase authentication	Brain-Shot Academy / Supabase	Maintain authenticated session continuity across relevant services using the shared Brain-Shot Academy account layer	Depends on the relevant service configuration and can be long-lived in the current deployment	Strictly necessary
`sb-jrclairmdhudqhbwtiay-auth-token.0`, `.1`, and further chunks where needed	Proprietary Brain-Shot Academy websites and web apps using Supabase authentication	Brain-Shot Academy / Supabase	Maintain authenticated session continuity when the Supabase auth cookie is stored in chunks	Depends on the relevant service configuration and can be long-lived in the current deployment	Strictly necessary
`iub_storage_available`	Public website consent controls	iubenda	Check browser storage availability for consent tooling	Indefinite	Strictly necessary
`_iub_cs_cons-31691898`	Public website consent controls	iubenda	Store cookie and tracker preferences	Indefinite	Strictly necessary
`_iub_previous_preference_id`	Public website consent controls	iubenda	Remember a previous preference path or selection state	6 months	Preference
`bunny_shield`	Public website or protected services where Bunny Shield is active	bunny.net	Confirm successful browser challenge and allow legitimate traffic through protection layers	1 year	Strictly necessary / security
`bunny_shield_chk`	Public website or protected services where Bunny Shield is active	bunny.net	Validate the integrity of the Bunny Shield challenge state	1 year	Strictly necessary / security
`B_ID`	Public website or protected services where Bunny Shield is active	bunny.net	Persistent browser identifier used for anti-abuse and bot-detection functions	1 year	Strictly necessary / security
`B_BD`	Public website or protected services where Bunny Shield is active	bunny.net	Browser-defense or browser-fingerprint signal used for anti-abuse functions	1 year	Strictly necessary / security

2. Google technologies used only on the public website and selected advertising landing pages

Google analytics or advertising technologies are not part of the default cookie stack across the whole Brain-Shot Academy platform.

Where used, they appear only:

on the public website and selected advertising landing pages
while the relevant tags are active
after consent where required by applicable law

Google Tag Manager or the Google tag can be used as the deployment layer for these technologies, but whether cookies or local storage are actually set depends on the active tags and configuration.

Item	Scope	Set by	Main purpose	Typical duration	Category
`_ga`	Public website and selected advertising landing pages	Google LLC	Distinguish users for Google Analytics 4	2 years	Optional analytics
`_ga_<container-id>`	Public website and selected advertising landing pages	Google LLC	Persist session state for Google Analytics 4	2 years	Optional analytics
`_gcl_*`, including where configured `_gcl_aw`, `_gcl_gs`, `_gcl_dc`, or `_gcl_au`	Public website and selected advertising landing pages	Google LLC	Store ad-click information and measure conversions or campaign performance	90 days	Optional marketing / measurement
`_gcl_ls`	Public website and selected advertising landing pages	Google LLC	Store ad-click information in browser local storage for conversion measurement	Until cleared or overwritten	Optional marketing / measurement
`_gac_*`	Public website and selected advertising landing pages	Google LLC	Measure user activity and ad-campaign performance	90 days	Optional marketing / measurement
`_gads`	Public website and selected advertising landing pages	Google LLC	Support Google ads on third-party sites	13 months	Optional marketing
`IDE` / `id`	Public website and selected advertising landing pages where Google ad services on non-Google sites are active	Google LLC	Serve or remember Google advertising preferences on non-Google sites	13 months in the EEA, Switzerland, and the UK	Optional marketing

3. Notes about this inventory

Most current Brain-Shot Academy websites and web apps use Supabase authentication cookies for sign-in continuity across relevant services. The legacy campus at campus.brain-shot.ch uses a separate authentication environment managed by EvolMind.
Some Google advertising cookies may be first-party on the visited site, while others may be set from Google or DoubleClick domains, depending on the product and configuration.
Provider-controlled durations can vary based on browser limits, provider settings, and campaign configuration.
If the public-site tag stack changes, this inventory may be updated accordingly.