Baccare
Effective October 15, 2026. Brigade Management, Inc. ("Baccare," "we," "us").
1. What this notice covers
This notice lists the cookies and browser storage used on baccare.com, app.baccare.com and our iPhone, iPad and Android apps (the "Service"): what is set, by whom, why, and for how long, and how to clear it. It is part of our Privacy Policy, which uses the same terms. Information about children is also covered by the Children's Privacy Notice.
2. What these technologies are
- Cookies are small text files a website asks your browser to keep and send back with later requests.
- Local storage lets a page save small values on your device until they are cleared. Session storage does the same until the browser tab is closed. Neither is sent to a server automatically; a page reads it only while it is open.
- A service worker is a small script the browser keeps so the app can show a short "you're offline" screen when the connection drops.
3. Strictly necessary storage
These items make sign-in, Child mode and security work. Baccare cannot work without them. All are first-party browser storage set by Baccare's code, except where the table says otherwise.
| Item | Purpose | How long |
|---|---|---|
Sign-in session (sb-…-auth-token), set by our sign-in provider's library on baccare.com and app.baccare.com | Keeps you signed in. | Until you sign out (it renews itself while you use the Service). |
Child mode flag (baccare:supervised) | Keeps Child mode on after a reload so the Parent's pages stay locked. | Until a Parent turns Child mode off. |
Current learner (baccare:learner, session storage) | Shows the right child's work. | Until the tab is closed. |
Pending family invitation (baccare:join) | Remembers an invitation link you opened until you sign in to accept it. | Removed once the invitation is used. |
Canvas activity session (baccare:lti, session storage) | Runs an activity a school opened from Canvas. | Until the tab is closed. |
Redirect counter (baccare:redirect-hops, session storage) | Stops a page from redirecting in a loop. | Until the tab is closed. |
App sign-in key (bc-native-oauth…), in the iPhone and Android apps | Completes Sign in with Google securely. | Removed as soon as sign-in finishes. |
Phone notification address (bc.pushToken), in the iPhone and Android apps | Lets Baccare turn off notifications for this phone when you sign out. | Until you sign out or delete the app. |
| Service worker | Shows the offline screen. It does not store your family's information. | Until you clear site data. |
4. Preferences
These remember choices made on this device. Clearing them only resets the choice.
- In the app: theme (
theme), look (baccare:skin), sidebar and menu state (gentelella:sidebar-rail, andgentelella:nav-openin session storage), last subject chosen for each child (bc-learn-subject:followed by an internal learner identifier), the count of flashcards due (bc-review-due, refreshed within two days), Calendar view (bc-planner-view), printing choice (bc-print-choice), read-aloud voice (bc-voice,bc-voice-es), whether you dismissed the home-screen tip (bc-install-tip), and whether Bacc has already said hello on a page (bc-owl-hello:, session storage). - On baccare.com, app.baccare.com, teach.baccare.com and brief.baccare.com: that you closed the cookie notice (
baccare:cookie-note, the time you tapped OK), so it does not show again on that site. In the app it is not shown on a child's screens: not in Child mode, not on pages a learner uses, not on activities opened from the app, and not in the iPhone and Android apps. - In Free Play and the Learn previews on baccare.com, which need no account: sound and grade settings, stars and best scores (for example
baccare:mute,baccare:stars,bc-fp-muted,bc-fp-grade,bc-fp-best,bc-race-best,bc-growlab-log,bc-growlab-stars), and in the Sky game the nearby city you pick from a list (bc-sky-city). These stay on your device and are never sent to us. - In the skills check and the Level check (on baccare.com, and inside the app): where a child stopped, so the check can pick up at the same question after a break (
bc-check-progress:followed by the kind of check, an internal learner identifier, the subject and the grade). It holds the questions still to come and how many were right in each topic so far, stays on your device, is removed when the check is finished, and is ignored after 7 days.
Local storage items last until you clear them; session storage items last until the tab is closed.
4A. Where you came from (bc_src)
When you arrive at a page for parents on baccare.com or app.baccare.com from a link that carries campaign tags (the utm_ labels on a link in an email, a search ad or a partner's handout), a partner code (?ref=), or from another website, our code sets one first-party cookie, bc_src, shared by the two sites. It holds only:
- the campaign tags and partner code on that link;
- the name of the website you came from (for example,
google.com), not the page or search; - the first Baccare page you landed on, and the date.
It holds no name, email, account number, device identifier or anything else unique to you; everyone who follows the same link gets the same value. It is never set on the Learn previews or Free Play, the pages a child may use without an account. Advertising click identifiers that some ad links add (such as gclid or fbclid) are ignored and never stored.
If you create an account, the contents are saved with your account (section 3 of the Privacy Policy) and the cookie is deleted. If you do not, it expires after 90 days. Only the first visit is kept; a later link does not replace it. Blocking cookies stops it with no effect on how the Service works.
5. Cookies set by others
| Set by | Cookies | Purpose | How long |
|---|---|---|---|
| Cloudflare (our hosting and security provider) | __cf_bm, and cf_clearance after a security check | Telling people from automated traffic and protecting the Service. Not used to track you across sites. | Short-lived: __cf_bm about 30 minutes; cf_clearance for the period set for a passed check. |
| Cloudflare Turnstile | Data its bot check needs, inside its own frame | The bot check on the sign-in, create-account and password-reset pages. | As Cloudflare sets for the check. |
| Stripe | Stripe's own cookies, on Stripe's checkout and billing pages | Processing payments and preventing fraud, under Stripe's privacy policy. | As Stripe sets. |
| Google's own cookies, on Google's sign-in pages | Signing you in, only if you choose Sign in with Google. | As Google sets. | |
| Microsoft | Microsoft's own cookies, on Microsoft's sign-in pages | Signing you in, only if you choose Sign in with Microsoft. | As Microsoft sets. |
Baccare does not receive these cookies. Some pages also load script libraries from jsDelivr or cdnjs; like any website, they receive your IP address to send the file, and they set no cookies for us.
6. No advertising or analytics cookies
- Baccare's code sets no cookie other than
bc_src(section 4A), and no advertising, retargeting or analytics cookies are used on the Service. - There are no social media pixels, no advertising or analytics tracking code, and no cross-site tracking.
- Where we have turned it on, Cloudflare Web Analytics counts visits and measures page speed for us in aggregate. Cloudflare describes it as using no cookies and no local storage. It does not identify you or follow you to other sites.
7. Children and Child mode
In Child mode, and on the Free Play and Learn pages a child may use without an account, the Service uses only the strictly necessary and preference items above. Cookies and stored identifiers are used only for the internal operations listed in section 6 of the Children's Privacy Notice: never to contact a child, for advertising, or to build a profile.
8. Do Not Track and Global Privacy Control
We do not track visitors across other websites, so we treat every visitor the same whether or not the browser sends a Do Not Track signal. We treat a Global Privacy Control signal as a request to opt out of the sale of personal data and of targeted advertising. Because we do neither, the signal does not change how the Service works for you; if that ever changes, we will honor the signal as an opt-out before it does. Section 13.2 of the Privacy Policy says more.
9. How to clear or block it
- Sign out to remove the sign-in session from that browser.
- Clear site data for baccare.com and app.baccare.com in your browser's settings to remove everything in sections 3, 4 and 4A, including the service worker. This signs you out and resets your preferences.
- Block cookies in your browser's settings. Blocking Cloudflare's security cookies or storage for our sites may stop sign-in or the bot check from working.
- In the iPhone and Android apps, signing out removes the session; deleting the app removes everything it stored.
10. Changes
Before we add anything that is not strictly necessary or a preference, we will update this notice and change the date at the top. Material changes will be announced to account holders as section 18 of the Privacy Policy describes.
11. Contact
Questions about this notice: use the contact form (choose the Privacy topic), or write to Brigade Management, Inc., Attn: Privacy, 3400 Coit Rd. #262084, Plano, TX 75026.