Cookie Notice
Version 2.1 · Effective 23 October 2026. Replaces version 2.0 of 13 October 2026. New: a full list of every cookie and storage item.
1. About this notice
This notice explains how eco-heroes.org, run by Eco Heroes International SL (CIF B44915940, Girona (Spain)), stores and reads information on your device. It follows Article 22.2 of the Spanish Information Society Services Act (LSSI-CE), the EU ePrivacy rules and the guide on cookies of the Spanish data protection authority (AEPD).
"Cookies" here also means similar technologies, such as your browser's local storage and session storage. Personal data collected through them is handled as described in our Privacy Policy.
2. How we ask for consent
- On your first visit to a page for adults, a banner offers three choices: Accept all, Reject non-essential and Customize. Rejecting is as easy as accepting.
- Until you choose, only strictly necessary cookies are used. Optional categories load only after you switch them on.
- Your choice is saved in your browser's local storage (entry
eco_cookie_consent) for 12 months. After that, or if we change the categories, we ask again. - If your browser sends a "Do Not Track" signal, we treat it as a rejection of all optional categories and do not show the banner.
- Pages made for children never show the banner, because nothing optional runs there.
3. What we use
3.1 Strictly necessary (always on)
These are needed for a service you ask for, so they do not need consent. They cannot be switched off in the banner. They keep you signed in, protect forms against abuse, remember your language and your cookie choice, and keep your game progress on your device. Game progress stays on your device and is not sent to us, unless you join a school class with a class code (see our Privacy Policy). Section 4 lists each item.
3.2 Fonts (self-hosted)
Our typefaces are stored on our own server and load from eco-heroes.org, like the rest of the page. No request is sent to Google or any other font provider, no cookies are set and no consent is needed.
3.3 Analytics (optional)
Loads Google Analytics on pages for adults, such as the teachers' area and the contact page, so we can count visits and understand how the site is used. On the pages made for children (the games, the adventure game, trivia, the library, the goal pages, Wordle and the missions) Google Analytics never loads and we do not ask for analytics consent; only strictly necessary storage is used there. Google Analytics sets its own cookies (usually named _ga and _ga_ followed by an identifier). We use the results only in aggregate. We do not use them for advertising or to profile anyone.
We use no advertising, social media or cross-site tracking cookies.
4. The full list
"First party" means set by eco-heroes.org; "third party" means set by another company's domain.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| Session cookie | First party | Keeps teachers, school staff and families signed in; protects forms against forgery; controls access to paid content. Secure, scripts cannot read it | Until you sign out or the session expires on our server |
eco_remember | First party | Keeps you signed in on this device after you enter an access code. Signed by our server, scripts cannot read it | 180 days, or until you sign out |
eh_oidc | First party (only under /game/) | Links a staff sign-in through the organisation's own identity provider to the same browser; holds only a random value. Strictly necessary | 10 minutes |
eh_lang, i18n_redirected | First party | Remembers the language you chose, so every part of the site uses it | 12 months |
ehlti | First party (only under /lti/) | Links a sign-in from a school's learning platform (LTI) to the same browser; works inside the platform's frame | 10 minutes |
eh_qtok | First party | One-time token that protects the quote request form against automated abuse | 10 minutes, deleted when the form is sent |
__cf_bm, cf_clearance, _cfuvid | Cloudflare, on our domain | Bot protection, proof that a security check was passed, and rate limiting; set only when Cloudflare applies these checks to a request | 30 minutes (the rate-limiting cookie: until you close the browser) |
| Turnstile | Cloudflare (third party, challenges.cloudflare.com) | Security check on sign-in and registration forms; may store information in its own frame | Set by Cloudflare; only for the check |
_ga, _ga_… | Google Analytics (first-party cookies set by Google's script) | Counting visits on pages for adults. Optional, only after consent | Up to 2 years |
| Storage item | Where | Purpose | Duration |
|---|---|---|---|
eco_cookie_consent | Local storage | Your cookie choice | 12 months |
eco_lang, eh_lang | Local storage | Your language | Until you clear your browser's storage |
eh6_…, eh6c_…, eh6q_…, eh6sp_…, eh6w_…, eh6x_…, ehq_…, eco_qstats, eco_game_state, eco_profile, eco_hero_auto, eh_lb, eh_wordle_… | Local storage | Game progress, points, badges, settings, game statistics and the last leaderboard seen, all kept on your device | Until you clear your browser's storage |
eco_activation, eco_class, eco_class_pending | Local storage | Whether this device has entered an access code or joined a class, and the class token that saves progress | Until you sign out, leave the class or clear storage |
eh_age_video, eco_tour_done, eco_hub_tour_done | Local storage | The video age version you chose; whether you have seen the guided tour | Until you clear your browser's storage |
ecoHeroesState, eh_live, eh_cpd_login, eh_lang_redirect, eh_ch:… | Session storage | The game in progress, a live class quiz, the CPD course sign-in, one language redirect, game chapters already loaded | Until you close the tab |
eh_access | Local storage | Your reading settings in the "Aa" accessibility panel: font, text size, contrast, reduced motion, underlined links | Until you clear your browser's storage |
eco_registered, eco_books_read, eh_sv_done_… | Local storage | That this device registered, the books marked as read on the family page, and the surveys already answered on this device | Until you clear your browser's storage |
eh_eval_v1:…, ecoHeroesTriviaResult | Session storage | Unsent answers of a class questionnaire, kept if the page reloads; the hand-over from the adventure game to the trivia | Until you close the tab |
dma.lang, dma.answers.… | Local storage | The language and the unsent answers of the VSME sustainability assessment | Until you clear your browser's storage |
sdg-games-v…, eh-game-… | Cache storage (service worker) | The pages, images and fonts of the games, so that they work offline. Members-only content is never stored | Until a new version replaces it, or you clear the site's data |
5. Embedded videos
Some educational videos come from YouTube in its privacy-enhanced mode (youtube-nocookie.com). The player loads only when you choose to play a video. From then on, YouTube (Google) may store or read information on your device under its own privacy policy.
6. Changing or withdrawing your choice
- After your first choice, a Privacy settings button appears at the bottom of every page for adults. Open it to switch any optional category on or off, then select Save preferences. Or select Reject non-essential to withdraw all optional consent at once.
- Withdrawing is as easy as giving consent. It takes effect from the next page you load. It does not affect what was done before you withdrew.
- Cookies that Google Analytics has already set stay in your browser until they expire or you delete them. You can delete them, and block cookies in general, in your browser's settings. If you block all cookies, sign-in will not work.
7. Third parties and international transfers
- Google provides Google Analytics and YouTube. Google may process this data in the United States.
- Cloudflare delivers the website, runs the Turnstile security check and protects the site from attack through a global network.
Where data is processed outside the European Economic Area, the transfer relies on a European Commission adequacy decision (including the EU–US Data Privacy Framework where the provider is certified under it) or on the Commission's Standard Contractual Clauses. See section 6 of our Privacy Policy.
8. The Eco Heroes app
The app uses no cookies, no advertising identifier and no third-party analytics. A child's progress is stored in a database on the device. See section 2 of our Privacy Policy.
9. Changes and contact
We publish every change on this page with a new version number and date. If we add or change an optional category, the banner asks for your consent again. Questions: info@eco-heroes.org.