Cookies Policy

This Cookies Policy explains how Intelligent Mastery Coaching ("IMC," "we," "us," or "our") uses cookies, local storage, session storage, and similar browser-based storage technologies on the Rx Challenger product website (https://imc-hub.github.io/digital-solutions/rx-challenger) and the Rx Challenger Progressive Web App (https://rx-challenger.vercel.app) (collectively, the "Rx Challenger Web Properties").

This policy applies only to the Rx Challenger Web Properties. It does not cover the native Android, Windows, or Linux applications, which use platform-specific storage mechanisms (Android SharedPreferences/DataStore, Windows/Linux local files) governed by their respective platform privacy standards and the Rx Challenger Privacy Policy.

By using the Rx Challenger Web Properties, you agree to the storage and access practices described in this policy. If you do not agree, you may disable cookies and storage in your browser settings (see Section 8), though this may impair functionality.

This policy should be read alongside our Privacy Policy (https://imc-hub.github.io/digital-solutions/rx-challenger/privacy) and Terms of Service (https://imc-hub.github.io/digital-solutions/rx-challenger/terms).

Cookies are small text files stored by your web browser on your device when you visit a website. They contain information that allows the website to recognize your browser across requests and sessions.

Modern web applications also use browser storage APIs that serve similar purposes but offer larger capacity and different persistence models:

• Local Storage (localStorage): Persistent key-value storage (typically 5–10 MB per origin) that survives browser restarts and has no automatic expiry. Data is never sent to the server automatically — it is accessed only by client-side JavaScript.

• Session Storage (sessionStorage): Tab-scoped key-value storage that persists only for the duration of the browser tab session. Data is cleared when the tab is closed.

• IndexedDB: A low-level, transactional database API for larger structured data (hundreds of MB), used by Service Workers and Firebase SDKs for offline-first caching.

• Service Worker Cache (Cache API): Controlled by the Service Worker (Workbox 7), caches network responses (HTML, CSS, JS, images, API responses) for offline access and performance.

This policy collectively refers to cookies, localStorage, sessionStorage, IndexedDB, and Cache API usage as 'Browser Storage.'

3.1 Essential Cookies & Storage (Strictly Necessary)

These are required for the Rx Challenger Web Properties to function correctly. They enable core features such as page navigation, session management, security, and basic PWA operation. They do not require consent under GDPR Art. 6(1)(b) / ePrivacy Art. 5(3).

Specific uses:

• Next.js static export navigation state (no server-side session cookies are set by our origin)

• Service Worker registration and lifecycle (Workbox 7) — required for PWA installability, offline caching, and update flow

• Cache API (Service Worker) — caches static assets (HTML, CSS, JS, images, fonts) for offline-first operation using CacheFirst strategy; caches API responses (Firestore REST) using NetworkFirst with 5-minute timeout

• Firebase Authentication persistence (localStorage/IndexedDB) — stores the authenticated user's ID token and refresh token so you remain signed in across browser sessions. This is managed entirely by the Firebase Web SDK. You can choose 'Remember me' (persistent) or session-only persistence at sign-in.

3.2 Functional Storage

These enhance your experience by remembering preferences and enabling features. They are set based on your interaction with the app (implied consent) or explicit choices.

Specific uses:

• User preference storage (localStorage) — theme preference (dark/light/system), language selection, difficulty preference, notification settings, reduced-motion preference. These persist until you change them.

• PWA install prompt dismissal (localStorage) — records that you dismissed the install prompt so we don't show it again immediately. Resets after 30 days.

• Update toast dismissal (sessionStorage) — tracks if you dismissed the 'App update available' toast in the current session.

• Scroll position restoration (sessionStorage) — remembers your scroll position on long pages (FAQ, About) within a tab session.

3.3 Analytics Storage (Opt-In Only)

Rx Challenger Web Properties do NOT load Google Analytics, Google Tag Manager, PostHog, or any third-party analytics scripts by default. Firebase Analytics (via the Firebase Web SDK) is initialized ONLY if you explicitly opt in via the in-app settings (Settings → Analytics: On). When enabled:

• Firebase Analytics sets first-party cookies (_ga, _ga_* prefixed) and uses localStorage/IndexedDB for event batching and user pseudonymous identification.

• Data collected: page views, scroll depth, button clicks, feature usage (anonymized), session duration. No PII is sent.

• You can disable at any time in Settings. Disabling stops future collection; previously collected data remains aggregated per Firebase retention (14 months).

• If you never enable analytics, no analytics cookies or storage are created.

3.4 Third-Party Storage

The Rx Challenger Web Properties do not embed third-party scripts that set cookies or storage (no social media widgets, no advertising pixels, no chat widgets, no CDN analytics). The only third-party origin contacted is Firebase (Google LLC) for authentication and Firestore REST API calls, which operate over TLS 1.3 and do not set cookies on our origin.

3.5 Native Application Storage (For Reference)

While not browser storage, the native applications use platform storage that serves analogous purposes:

• Android: Jetpack DataStore (Preferences) for user preferences, encrypted SharedPreferences for auth tokens, Room database for local case cache and progress. No advertising ID (AAID) accessed.

• Windows/Linux: Local JSON files in app data directory for preferences, auth tokens, and case cache. No registry usage beyond standard uninstaller entries.

These are governed by the Rx Challenger Privacy Policy Section 3 (Information We Collect) and Section 9 (Data Security).

The table below lists every cookie and browser storage key known to be used by the Rx Challenger Web Properties as of the Last Updated date. This inventory is based on code review of the Next.js static export, Workbox 7 Service Worker, and Firebase Web SDK integration.

For users in jurisdictions requiring a legal basis (EEA, UK, Brazil, South Africa, California), we rely on:

• Contract Performance (GDPR Art. 6(1)(b) / LGPD Art. 7(V) / POPIA S. 11(1)(b)): Essential storage (Service Worker cache, Firebase Auth persistence) is necessary to provide the PWA functionality you requested — offline access, installability, and persistent sign-in.

• Legitimate Interests (GDPR Art. 6(1)(f) / LGPD Art. 7(IX) / POPIA S. 11(1)(f)): Functional storage (preferences, dismissed prompts) improves usability without tracking. Our interest in a functional, user-friendly PWA is balanced against your privacy; you can clear these at any time.

• Consent (GDPR Art. 6(1)(a) / LGPD Art. 7(I) / POPIA S. 11(1)(a) / CCPA 'Sale/Share' Opt-Out): Firebase Analytics storage is ONLY initialized after explicit opt-in in Settings. Consent is freely given, specific, informed, and revocable.

• ePrivacy Directive Art. 5(3): Essential storage (Service Worker, Firebase Auth) falls under the 'strictly necessary' exception. Functional storage is set in response to your explicit actions (changing a preference, dismissing a prompt). Analytics storage requires prior consent.

Under CCPA/CPRA: We do not sell or share personal information. Browser storage used for analytics (if enabled) is first-party and pseudonymous. You may opt out by disabling Analytics in Settings.

• All network communication uses TLS 1.3 with modern cipher suites. The Rx Challenger Web Properties implement strict security headers: Content-Security-Policy (restrictive, no 'unsafe-inline' for scripts), Strict-Transport-Security (HSTS, 1 year, includeSubDomains, preload), X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (restricts camera, microphone, geolocation, payment).

• Firebase Authentication tokens (ID token, refresh token) stored in localStorage/IndexedDB are encrypted at rest by the browser's storage encryption (OS-level). They are transmitted only to Firebase Auth endpoints over TLS 1.3 with certificate pinning enforced by the Firebase SDK.

• Service Worker cache contains only public assets (HTML, CSS, JS, images, fonts) and anonymized Firestore responses (case data, no PII). No auth tokens or PII are cached.

• The PWA is served from Vercel (https://rx-challenger.vercel.app) and GitHub Pages (https://imc-hub.github.io), both providing HTTPS by default with valid certificates.

• Service Worker Cache (Cache API): Static assets — cached for 30 days (CacheFirst, maxAgeSeconds: 2,592,000). API responses — NetworkFirst with 5-minute network timeout, cached for 5 minutes (maxAgeSeconds: 300). Manual clear: browser DevTools → Application → Clear storage, or 'Clear site data'.

• Firebase Auth Persistence (localStorage/IndexedDB): ID token expires in 1 hour; refresh token used to obtain new ID tokens. Refresh token persists until you sign out, revoke access, or account is deleted. 'Remember me' = persistent (survives browser restart). Session-only = cleared on tab close.

• User Preferences (localStorage): Persists indefinitely until you change the setting or clear browser data.

• PWA Install Prompt Dismissal (localStorage): 30 days, then reset.

• Update Toast Dismissal (sessionStorage): Current tab session only.

• Scroll Position (sessionStorage): Current tab session only.

• Firebase Analytics (if enabled): Event-level data retained 14 months in Firebase, then automatically deleted. User pseudonymous ID reset on analytics disable or account deletion.

You can clear all browser storage for the Rx Challenger origins at any time via your browser settings (see Section 8).

You can control and delete browser storage through your browser settings:

Google Chrome: Settings → Privacy and Security → Cookies and other site data → See all site data and permissions → Search 'imc-hub.github.io' or 'rx-challenger.vercel.app' → Delete. Or: DevTools (F12) → Application → Storage → Clear site data.

Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data → Search origin → Remove. Or: DevTools (F12) → Storage → Local Storage/Session Storage/IndexedDB/Cache → Right-click → Delete.

Apple Safari: Settings → Privacy → Manage Website Data → Search origin → Remove. Or: Develop menu → Web Inspector → Storage → Delete.

Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data → Search origin → Remove. DevTools same as Chrome.

Opera: Settings → Privacy & Security → Cookies → See all cookies and site data → Search origin → Delete.

Note: Clearing Essential storage (Service Worker cache, Firebase Auth) will sign you out and disable offline functionality until the Service Worker re-caches assets on your next visit. Clearing Functional storage will reset your preferences to defaults. Clearing Analytics storage (if enabled) stops future event batching but does not delete already-collected aggregated data in Firebase.

The Rx Challenger Web Properties do not use a cookie consent banner because:

• No non-essential cookies are set by default. Firebase Analytics is opt-in only (disabled by default).

• Functional storage is set only in direct response to your explicit actions (changing a setting, dismissing a prompt).

• Essential storage falls under the 'strictly necessary' exception.

If you enable Analytics in Settings (Settings → Analytics: On), that constitutes your explicit, informed consent for analytics storage. You may withdraw consent at any time by toggling Analytics off — this stops future collection and clears the local analytics buffer. Previously aggregated data in Firebase is retained per the 14-month retention but can no longer be linked to you.

For GDPR Art. 7 / LGPD Art. 8 / POPIA S. 11 compliance, we maintain records of your Analytics opt-in (timestamp, version) in Firestore linked to your account. You can request this record via imc.hub.eg@gmail.com.

Depending on your jurisdiction, you have the following rights regarding browser storage and the personal data processed through it:

European Union (GDPR): Right of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (for analytics).

California (CCPA/CPRA): Right to know, delete, opt-out of sale/share (not applicable — we don't sell/share), non-discrimination.

Brazil (LGPD): Confirmation, access, correction, anonymization/blocking/deletion, portability, information about sharing, revocation of consent.

South Africa (POPIA): Access, rectification, erasure, restriction, objection, withdrawal of consent.

To exercise these rights regarding browser storage: clear storage via browser settings (Section 8) for immediate local effect. For server-side data (Firebase Auth, Firestore, Analytics), contact imc.hub.eg@gmail.com with 'Privacy Request — Rx Challenger'. We verify identity and respond within legal timeframes (30 days GDPR, 45 days CCPA, 15 days LGPD).

We may update this Cookies Policy to reflect changes in the storage we use, legal requirements, or our practices. Material changes will be communicated via in-app notification and/or email (if you have an account) at least 30 days before the effective date. The 'Last Updated' date at the top will be revised. Your continued use of the Rx Challenger Web Properties after the effective date constitutes acceptance.

We encourage you to review this policy periodically. The current version is always available at https://imc-hub.github.io/digital-solutions/rx-challenger/cookies.

If you have questions about this Cookies Policy, our use of browser storage, or wish to exercise your data rights, please contact us:

Email: RxChallenger.app@gmail.com (support) or imc.hub.eg@gmail.com (privacy/legal)

Data Controller: Intelligent Mastery Coaching (IMC)

Developer: Ahmed Ezzat

Mailing Address: IMC Inc., Attn: Privacy Team, Giza, Egypt

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (EU: national DPA; UK: ICO; Brazil: ANPD; South Africa: Information Regulator; California: Attorney General).