Cookie policy
Last reviewed 2026-08-25
<h2>What are cookies</h2>
<p>Cookies are small text files your browser stores on your device. Similar technologies include localStorage, sessionStorage, pixel tags, and mobile SDKs. This policy refers to all of these as "cookies".</p>
<h2>Categories we use</h2>
<p>We group cookies into three consent categories. Essential cookies and essential app storage are always on because they are needed for sign-in, security, and requested product workflows. Analytics cookies and marketing cookies require your consent, which you can change any time in the banner or at <code>/cookies</code>. Limited Google Analytics page counts run without cookies or persistent identifiers as described below.</p>
<h3>1. Essential (always on)</h3>
<p>Required to deliver the service. Disabling these breaks core functionality.</p>
<table><thead><tr><th>Cookie</th><th>Purpose</th><th>Duration</th></tr></thead><tbody><tr><td><code>__Secure-next-auth.session-token</code> / <code>next-auth.session-token</code></td><td>Authenticate your session</td><td>Up to 7 days (customer) / 12 hours (admin)</td></tr><tr><td><code>__Host-next-auth.csrf-token</code> / <code>__Secure-next-auth.csrf-token</code></td><td>CSRF protection</td><td>Session</td></tr><tr><td><code>__Secure-next-auth.pkce.code_verifier</code></td><td>OAuth PKCE flow</td><td>Session</td></tr><tr><td><code>cookie_consent</code></td><td>Remembers your cookie preferences</td><td>12 months</td></tr><tr><td><code>hc_booking_access_<linkId></code></td><td>Authorizes only the requested public booking or booking-management workflow after the link credential is removed from the URL and exchanged for a signed, HttpOnly cookie</td><td>Up to 4 hours or the booking link's earlier expiry</td></tr></tbody></table>
<h3>2. Essential app storage (always on)</h3>
<p>Remember preferences and preserve requested workflows. No third-party tracking.</p>
<table><thead><tr><th>Cookie</th><th>Purpose</th><th>Duration</th></tr></thead><tbody><tr><td><code>theme</code></td><td>Light / dark / system theme preference</td><td>12 months</td></tr><tr><td><code>onboarding_step</code></td><td>Where you are in onboarding</td><td>30 days</td></tr><tr><td><code>hc_public_intent</code></td><td>Keeps a signed public-offer purchase callback bound to the browser that requested email verification</td><td>Up to 15 minutes</td></tr><tr><td><code>hc_public_intent_ready</code></td><td>Carries the signed, checkout-ready offer and pricing snapshot from email verification back to the exact offer page</td><td>Up to 5 minutes</td></tr><tr><td><code>hc_offer_image_<hash></code></td><td>Allows an invite-only offer page to load only the image files authorized for that offer and published version</td><td>Up to 15 minutes</td></tr><tr><td><code>hc-gift-claim:<intent></code> (sessionStorage)</td><td>Keeps a gift acceptance capability in the current tab after removing it from the URL; cleared after successful acceptance</td><td>Browser tab session or successful acceptance</td></tr><tr><td><code>hc-booking-request:<intent></code> (sessionStorage)</td><td>Reuses one idempotency key if a booking-link request is retried; cleared after the link is issued or the request expires</td><td>Browser tab session, usually one request</td></tr><tr><td><code>jobSearch.googleJobs.*</code> (sessionStorage)</td><td>Keeps requested job-search results and pagination cursors in the current tab, isolated by signed-in user and cleared on logout</td><td>Up to 15 minutes or browser tab session</td></tr></tbody></table>
<h3>2a. Limited account-registration source labels</h3>
<p>These first-party cookies record coarse source labels on document visits before an analytics choice. <code>hc_ft</code> keeps the first source; <code>hc_campaign</code> changes only when you visit another recognized audience signup page. Their labels can be attached to our server-side account-registration analytics. They do not store raw referral URLs, ad-click identifiers, email addresses, phone numbers, or document contents. Detailed browser campaign-view measurement still requires analytics consent.</p>
<table><thead><tr><th>Cookie</th><th>Purpose</th><th>Duration</th></tr></thead><tbody><tr><td><code>hc_ft</code></td><td>First registration source: a sanitized landing path, referring domain, safe campaign labels, click-ID presence only, and visit time</td><td>90 days</td></tr><tr><td><code>hc_campaign</code></td><td>The allowlisted identifier of the most recently visited audience signup campaign</td><td>30 days</td></tr></tbody></table>
<h3>3. Analytics cookies and detailed product analytics (consent required)</h3>
<p>Help us understand which features are used and where users get stuck. Data is processed by:</p>
<ul><li><strong>Vercel Analytics</strong>: site-level traffic and performance telemetry with query strings and fragments removed before pageviews are sent</li><li><strong>Amplitude</strong>: product analytics</li><li><strong>Mixpanel</strong>: product analytics</li><li><strong>PostHog</strong>: product analytics (event capture, funnels). Distinct ID is the Firebase UID when signed-in; email is attached only after analytics consent.</li></ul>
<p>These tools begin detailed capture only after analytics consent. The PostHog client SDK loads in opted-out-by-default mode and only begins capturing events after analytics consent is granted; revocation immediately stops capture and clears the PostHog distinct ID. Browser session-replay integrations, GTM, and LinkedIn Insight tags are disabled.</p>
<h3>3a. Limited Google Analytics measurement (no analytics cookie required)</h3>
<p>Google Analytics receives one query-free page-view measurement on each page by default under our legitimate interest in basic service measurement. Before analytics consent, Google Consent Mode denies analytics storage and all advertising signals. Google does not read or write analytics cookies or persistent device identifiers for these measurements. We send only the sanitized page location and referrer, consent state, and standard request metadata needed to deliver the measurement. We disable automatic page views, Google signals, ad personalization, and retained ad-click data. Behavioral events, user identification, analytics cookies, and detailed product measurement remain off until you enable Analytics through the existing cookie preference.</p>
<table><thead><tr><th>Storage</th><th>Purpose</th><th>Duration</th></tr></thead><tbody><tr><td><code>hc_offer_session</code> (sessionStorage)</td><td>Deduplicates consented views and funnel steps on public coach-offer pages. The server stores only keyed hashes and coarse allowlisted source labels, not the raw identifier, IP address, or referrer.</td><td>Browser tab session</td></tr></tbody></table>
<h3>4. Marketing (consent required)</h3>
<p>Measure campaign effectiveness and show relevant ads on partner platforms.</p>
<ul><li><strong>Meta (Facebook) Conversions API</strong>: server-side gift-flow conversion measurement with hashed identifiers. The client Meta Pixel is disabled.</li></ul>
<h2>Your choices</h2>
<ul><li><strong>Banner:</strong> on your first visit (and again when you clear cookies), you can accept all, reject all, or choose per-category.</li><li><strong>Account settings:</strong> <code>/settings/privacy</code>: change any time.</li><li><strong>Browser controls:</strong> you can block cookies at the browser level. Blocking essentials may prevent signin.</li><li><strong>Global Privacy Control:</strong> when your browser sends a GPC signal, we disable marketing cookie attribution and marketing conversion events, even if an earlier cookie choice allowed them. GPC does not change necessary cookies, your separate analytics choice, or email subscription preferences.</li></ul>
<p>Withdrawing consent takes effect immediately; we won't block your access to the site.</p>
<h2>How we record your consent</h2>
<p>When you make a choice in the cookie banner, we record:</p>
<ul><li>Which consent categories you accepted (analytics, marketing, or essential-only)</li><li>The version of the consent notice you saw</li><li>The timestamp of your choice</li></ul>
<p>If you are signed in, this record is persisted to your account so your choice follows you across devices. If you are not signed in, it is stored locally in your browser.</p>
<p>Consent change events are also appended to the application audit log and retained for 2 years per the <a href="/trust/docs/data-retention">data retention policy</a> as evidence of your decision.</p>
<p>If we make a material change to the categories of cookies or the trackers we use (for example, adding a new analytics provider), we increment the consent-notice version and re-prompt you. Your prior consent then applies only to the previous version; you choose afresh for the new one.</p>
<h2>Sub-processor links</h2>
<table><thead><tr><th>Provider</th><th>Privacy policy</th></tr></thead><tbody><tr><td>Google</td><td><code>policies.google.com/privacy</code></td></tr><tr><td>Amplitude</td><td><code>amplitude.com/privacy</code></td></tr><tr><td>Mixpanel</td><td><code>mixpanel.com/legal/privacy-policy</code></td></tr><tr><td>Meta</td><td><code>facebook.com/privacy/policy</code></td></tr><tr><td>PostHog</td><td><code>posthog.com/privacy</code></td></tr><tr><td>Sentry</td><td><code>sentry.io/privacy</code></td></tr><tr><td>Vercel</td><td><code>vercel.com/legal/privacy-policy</code></td></tr></tbody></table>
<p>See <code>hiringcoach.ai/sub-processors</code> for our full list.</p>
<h2>Changes</h2>
<p>We review this policy annually and update it when we add or remove trackers. Material changes are communicated through the banner re-opening and, where required, by email.</p>
<ul><li>2026-08-12: Documented the short-lived essential booking-capability cookie used after a public booking or management credential is removed from the URL.</li><li>2026-08-25: Restored direct GA4 in advanced Consent Mode. Query-free cookieless page counts run with storage and ad signals denied by default; the existing Analytics preference controls analytics cookies and detailed measurement.</li><li>2026-07-29: Removed Hotjar client initialization/session capture, GTM/GA/LinkedIn Insight browser tags, and the client Meta Pixel; stripped query metadata from remaining browser telemetry and disabled automatic Sentry DOM screenshots.</li><li>2026-07-26: Documented the short-lived essential cookies and tab storage used for public-offer verification, invite-only images, gift acceptance, and replay-safe booking-link requests.</li><li>2026-07-24: Added consent-gated, first-party coach-offer funnel measurement and its tab-session identifier; incremented the consent version so every user chooses again.</li></ul>
<h2>Contact</h2>
<p>Questions: <code>[email protected]</code></p>