Updated November 6, 2026 · Version 2026-11-06.3
Cookies & browser storage
The small pieces of information used to keep the study tools working.
Functional storage
The current interface uses cookies and browser storage for authentication, temporary guest visits, resuming blocks and interface preferences. It does not include advertising pixels or optional analytics SDKs. Infrastructure providers may still use security mechanisms and logs.
You can read this notice without accepting optional advertising or analytics. Storage purposes, including preferences, must be assessed under applicable rules; this page does not claim a blanket exemption for everything called functional. If optional tracking is introduced, we must explain its purpose and provide any choices or consent required before activation.
Authentication and guest cookies
| Cookie | Purpose | Configured lifetime |
|---|---|---|
qbank_access | Account authentication | Token expiry, capped at 24 hours |
qbank_refresh | Renewing an authenticated session | Up to 30 days when set; renewal can reset this period |
qbank_guest | Isolating a temporary guest visit | Browser-session cookie; visit access also has four-hour idle expiry and can end sooner |
These cookies use HttpOnly, SameSite and Secure protections over HTTPS. Browser session restoration can preserve a session cookie after a window is closed. The guest cookie works with the encrypted visit copy in tab session storage; the cookie alone does not contain the study history.
Tab storage and device preferences
freeusmle:guest-state in session storage holds an encrypted copy of the temporary guest visit, including its current study state. It is sent in the X-QBank-Guest-State request header and updated from the service’s response. The service decrypts it temporarily; guest state is not saved to a persistent personal database.
Guest resume identifiers also use session storage. Account resume identifiers use account-namespaced local storage where account identity is provided. The selected exam step is stored as usmle-dashboard-step in local storage and is not account-specific. Account resume pointers and exam preferences can remain until you clear them.
Session storage normally lasts for the tab’s lifetime, subject to browser restore behavior. Separate tabs can fork temporary histories. Four-hour server-side idle expiry still applies, and losing the tab copy or changing the service’s encryption key can end access. Eviction or redeployment alone need not destroy a visit when its valid encrypted copy remains available.
Ending the guest visit clears its current cookie and the current tab’s encrypted copy. It is not guaranteed revocation of an older copied token, which may remain usable until expiry. Do not put patient information in notes or browser storage.
Your controls
Sign out or end a guest visit on shared devices. You can also block or clear cookies and site storage through your browser settings, which can sign you out or make temporary blocks unavailable. Clearing browser storage does not by itself delete cloud account records.
Third-party official practice links can use their own cookies after you choose to visit those websites. Their own notices apply.