Cookie Policy

1. What this covers

This policy covers cookies and similar browser storage (local storage and session storage) used on careercaseos.com and in the CareerCaseOS web app. The iPhone app uses no cookies or trackers.

The website and the app load no advertising cookies, no Google or Meta tags and no outside analytics scripts today. Section 4 says what would change if we switch website measurement on.

2. Your choices

• Necessary storage is always on, because the site can't work without it.
• Analytics, Marketing measurement and Preferences stay off until you turn them on. Saying no costs you nothing.
• You can change your choices at any time: Privacy choices in the website footer, or the privacy control in the app (lower-left) and on the Cookie Policy page in the app.
• Global Privacy Control (GPC): if your browser sends GPC, Analytics and Marketing are turned off and cannot be turned on by the signal. The choice is recorded as coming from GPC.
• We record your choice (category, policy version, time, source, and a country code) so we can respect it and show we did.

3. What we use

3.1 Cookies

Name	Set by	Purpose	Category	Lifetime
authjs.session-token (with a __Secure- prefix on HTTPS)	app	keeps you signed in	Necessary	up to 30 days from your last visit, or until you sign out
authjs.csrf-token (with a __Host- prefix on HTTPS)	app	protects the sign-in form against forgery	Necessary	until you close the browser
authjs.callback-url (with a __Secure- prefix on HTTPS)	app	returns you to the right page after sign-in	Necessary	until you close the browser
authjs.pkce.code_verifier, authjs.state	app	used only if managed sign-in is enabled	Necessary	about 15 minutes
ccos_cookie_pref	app and website (shared across careercaseos.com)	remembers your privacy choices	Necessary	1 year
ccos_cookie_subject	app and website	a random ID that links your saved choices and, only if Analytics is on, your analytics events	Necessary for the consent record; used for Analytics only with consent	1 year
ccos_ref	app	remembers a referral code when you arrive from a referral link, so the person who referred you can be credited if you sign up	Necessary for the referral link you followed	30 days
ccos_staging_ok	app, test versions only	remembers the access code for a pre-launch test version	Necessary	7 days

3.2 Local storage and session storage

These stay in your browser. They are not sent to us automatically.

Key	Where	Purpose	Category	Cleared
ccos_consent_local_denial	website	remembers "Reject optional" if our consent server can't be reached	Necessary	when the policy version changes
ccos_cookie_pref_v1, ccos_cookie_subject	app	a copy of your privacy choices, kept only if you turn Preferences on	Preferences	removed when Preferences is off
ccos_lead_popup_done	app public pages	remembers that you closed the email sign-up pop-up, so it does not come back	Necessary (remembers a choice you made)	when you clear your browser's site data
ccos-nav-pinned	app	remembers whether you pinned the side menu	Necessary (remembers a choice you made)	when you clear your browser's site data
ccos:onboarding:draft:v1	app	saves your Snapshot answers before you sign in, so you don't lose them. It contains your answers.	Necessary (a feature you asked for)	when you finish, sign in, or clear the form
ccos_conversation_brief_v1	app, free career brief	saves your free career brief in your browser. It contains your brief.	Necessary (a feature you asked for)	when you clear the brief
ccos_tracked: followed by the page (session storage)	app public pages	stops the same page view being counted twice	Analytics (written only when Analytics is on)	when the tab closes

3.3 Page-speed measurement

If, and only if, you turn on Analytics, the app also measures how fast its pages load for you and sends the readings to our own server. Nothing goes to an outside company. We store the type of page (a pattern, not the page address), a device class (mobile, tablet or desktop), the day, and a speed range for each reading. We store no page address, no IP address and nothing that identifies you. These measurements are kept for up to 13 months. This measurement sets no cookie of its own, and it is not collected when your browser sends Global Privacy Control.

3.4 Items set without asking

Three of these are set without asking, because each only remembers something you did: ccos_ref (you followed a referral link), ccos_lead_popup_done (you closed a pop-up) and ccos-nav-pinned (you pinned a menu). None is used for advertising or shared with anyone.

4. If we switch on website measurement

The website is built so that two outside measurement tags can be switched on. They are off today.

• A Google Analytics tag would load only if you turn on Analytics.
• A Meta tag would load only if you turn on Marketing measurement.

Neither loads on the policy pages, and neither loads in the app. Before we switch either one on, we will update this page and the Privacy Policy and ask for your choice again. A choice you made before then does not count as a yes.

5. Changes

When we add or change a category we'll update this page, change the policy version, and ask again.