Cookie Policy

What are cookies and browser storage?

Cookies are small text files that are placed on your device when you visit a website. They are widely used to make websites work properly, improve performance, and provide a better user experience.

Modern web applications also use other forms of browser storage — such as localStorage, sessionStorage, and IndexedDB — to store data locally on your device. These serve purposes similar to cookies (for example, keeping you logged in) but operate differently under the hood. This policy covers all of these technologies.

Scope of this Cookie Policy

This Cookie Policy applies to all Peak Rise websites and resources under the peakrise.eu domain, including every subdomain.

Each subdomain may use different backend technologies, frameworks, and third-party services to power its features. For example, one subdomain may use a self-hosted identity provider while another may use a cloud-based service. Regardless of the underlying technology, our cookie and storage principles remain the same across the entire platform: essential use only.

Our cookie approach: essential only on every subdomain

Across all Peak Rise websites and resources (present and future), we keep things simple and privacy-respecting. We only use essential cookies and browser storage: the minimum necessary to make our services function correctly. This principle applies uniformly to every subdomain, regardless of which backend technology or third-party service powers it.

We do not use tracking, advertising, analytics (except integrated Cloudflare analytics), or any other non-essential cookies or storage mechanisms on any part of our platform. If a subdomain requires authentication, commenting, form submission tracking, or any other interactive feature, only the storage strictly needed for that feature is used.

Cookies and storage we use

Essential / strictly necessary cookies and storage

These cookies and storage entries are required for the services to function and cannot be switched off in our systems. They are set only in response to actions you take, such as logging in, acknowledging a notice, submitting a form, or storing a preference.

Main website (peakrise.eu)

1. A cf_clearance cookie from Cloudflare may be present to confirm successful completion of a security challenge for a secure server connection.
2. The main site currently uses Formspree for contact form submissions. No persistent tracking data is stored on our end.
   1. Formspree may use browser storage (IndexedDB or localStorage) to manage form delivery.
   2. Formspree may collect and store some information for security and spam prevention purposes. This could include your IP address and browser information. For more details on how Formspree handles your data, please review their Privacy Policy.

Peak Rise Client Portal (app.peakrise.eu) and Introducer Portal (partner.peakrise.eu)

Peak Rise uses SoftCycle (self-hosted) client management system and Keycloak (self-hosted) as its identity and access management service for sign-in and account management. Keycloak sets essential session cookies to keep you logged in and to secure your account. These cookies are strictly necessary — without them, authentication and portal access cannot function.

Cookie Name	Purpose	Duration
KEYCLOAK_SESSION	Maintains your authenticated session on the Peak Rise portals.	Session / configurable
KEYCLOAK_IDENTITY	Stores your identity token to keep you signed in across pages.	Session
AUTH_SESSION_ID	Tracks the active authentication session during the login flow.	Session
KC_RESTART	Allows Keycloak to resume an interrupted authentication flow.	Session

Peak Rise may also use additional browser storage (such as localStorage or sessionStorage for essential features — for example, saving your progress or preferences locally. This data remains on your device and is never used for tracking.

Future and Other Subdomains

As the Peak Rise service grows, we may introduce additional subdomains for new services — such as apps, tools, dashboards, or other resources. Each new subdomain may use its own backend technology stack, which could include (but is not limited to):

• Identity providers (e.g., Keycloak, or other self-hosted solutions) that set session cookies or store tokens in browser storage for authentication
• Backend frameworks that set CSRF (Cross-Site Request Forgery) protection tokens as cookies to secure form submissions
• Cloud or self-hosted databases that may require client-side tokens stored in localStorage or IndexedDB
• Session management cookies set by web servers or application frameworks to maintain your active session.

Regardless of the specific technology, our commitment remains the same: only essential cookies and storage will be used. No subdomain will ever use cookies for tracking, advertising, analytics (except integrated Cloudflare analytics), or profiling. When a new subdomain is added, this policy will be updated to list its specific cookies and storage, but the essential-only principle is guaranteed across the entire platform.

Common essential storage patterns across subdomains

Because our subdomains use different technologies, you may encounter the following types of essential storage across the platform. All of these are strictly functional:

Type	Purpose	Examples
Session Cookies	Maintain your login state and authenticated session while you use a service. Deleted when you close your browser unless a “remember me” option is used.	Keycloak session cookies, framework session IDs
CSRF Tokens	Protect against cross-site request forgery attacks when you submit forms. These are a security measure, not tracking.	CSRF cookies set by backend frameworks
Authentication Tokens	Store your identity or access tokens so you remain signed in. May be stored as cookies, in localStorage, or in IndexedDB depending on the service.	Keycloak identity cookies, JWT tokens
User Preferences	Remember choices you have explicitly made, such as dismissing a banner, selecting a theme, or choosing a language.	Any banner dismissal, UI preferences

What we do not use on any subdomain, ever

The following types of cookies and storage are never used on any Peak Rise resource, regardless of which backend technology powers the subdomain:

• Analytics Cookies: We do not use Google Analytics, Hotjar, Mixpanel, or any other analytics service that tracks your behaviour across our properties. We rely exclusively on privacy-preserving, integrated analytics provided by Cloudflare (our hosting and security infrastructure provider via Cloudflare Pages). Cloudflare Analytics runs at the network edge to measure overall traffic, performance, and security threats. It does not use client-side tracking cookies, build individual user profiles, or track you across different websites:
  • No Cross-Site Tracking: Data is aggregated and strictly limited to traffic on the Peak Rise website.
  • Privacy-First Measurement: Cloudflare Web Analytics operates without storing persistent client-side identifier cookies for tracking personal behavior.
  • Essential Operation: Because our site is protected and hosted by Cloudflare, basic edge performance and security metrics are integrated into the core infrastructure.
• Advertising Cookies: We do not run ads and do not use any advertising, retargeting, or remarketing cookies on any subdomain.
• Social Media Tracking Cookies: We do not embed social media widgets or pixels that track you across the web.
• Personalisation / Profiling Cookies: We do not build profiles about you, track browsing patterns, or personalise content based on tracked behaviour.
• Cross-Subdomain Tracking: We do not use cookies or any other mechanism to track your activity across our different subdomains.
• Third-Party Marketing Scripts: We do not load any third-party marketing, tracking, or data-collection scripts on any subdomain.

Embedded Video Content

Some pages across our subdomains may include embedded videos from YouTube. To protect your privacy, we use the YouTube Privacy-Enhanced Mode (youtube-nocookie.com) for all video embeds.

In Privacy-Enhanced Mode, YouTube will not set cookies on your device to track your browsing activity unless you choose to play the video. This is a deliberate choice we have made to minimise any third-party cookie impact on our visitors.

If you do play an embedded video, YouTube may set its own cookies subject to Google’s Privacy Policy. We have no control over those cookies once the video is played.

Third-Party Services by Subdomain

Different parts of our platform rely on different backend services. Each is chosen for its functionality and privacy commitments. Here is a summary of the current services in use:

Resource/website	Service	Description
peakrise.eu, docs.peakrise.eu	AstroJS	Astro is a modern web framework built to create fast, content-focused websites. It sends zero unnecessary JavaScript to the browser by default, rendering pages as lightweight static HTML for top-tier speed and performance.
peakrise.eu, docs.peakrise.eu	Formspree	Formspree is a form backend, API, and email service for HTML & JavaScript forms.
app.peakrise.eu, partner.peakrise.eu	Keycloak	Keycloak (self-hosted) provider is used for identity and access management and for managing the learning experience. No authentication data is shared with third-party advertising or analytics services.
app.peakrise.eu, partner.peakrise.eu	SumSub	User identity verification. Legitimate interest.
app.peakrise.eu, partner.peakrise.eu	SoftCycle	User management system (self-hosted). Offers a secure user platform for account creation and interaction, including document uploads, account access, and portfolio viewing.
app.peakrise.eu, partner.peakrise.eu	Mailgun	Mailgun is a cloud-based email delivery platform built for developers and businesses.

---

As our service evolves, individual subdomains may adopt, replace, or remove third-party services. Some subdomains may use Keycloak, others may use a different identity solution. The specific services are an implementation detail — our privacy commitment is not:

• We will only integrate services that are necessary for service functionality.
• We will never integrate advertising networks, data brokers, or behavioural tracking services.
• Any material changes to the services used will be reflected in this policy with an updated date.

Your control over cookies and storage

Because we only use essential cookies and storage, there is nothing to opt out of on our end. However, you always have control through your browser settings:

• You can view, manage, and delete cookies through your browser’s settings or developer tools.
• You can clear your localStorage, sessionStorage, and IndexedDB at any time through your browser’s developer tools, which will reset preferences and sign you out of any services.
• Blocking essential cookies may affect how our services function — for example, you may not be able to sign in to the Client or Introducer Portals.

For guidance on managing cookies in popular browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Changes to this Cookie Policy

We may update this Cookie Policy from time to time — for example, when we add a new subdomain, adopt a new backend service, or change how an existing service stores data. Any changes will be posted on this page with an updated date (under the page title). Our essential-only approach to cookies will not change, but the specific list of cookies and storage used may be updated as the platform evolves.

Contact Us

If you have any questions about our use of cookies or browser storage on any Peak Rise subdomain, please reach out using our Contact page.

---