Last updated: 22 July 2026

Cookie Policy

Short version: we use the handful of cookies needed to keep you signed in, plus one that remembers your answer to the cookie banner. No advertising cookies, no tracking pixels, no third-party analytics of any kind. There is one optional thing: a first-party usage log we run on our own servers, off by default, which only starts if you switch the analytics toggle on — and it is named and described in section 4. Here is the complete list, by real cookie and storage name.

1. What these things are

Cookies are small text files a site stores in your browser and reads back on later requests. Local storage and session storagedo a similar job with different rules: local storage persists until it is cleared, session storage is wiped when you close the tab. Cookie law (the UK’s PECR and the EU ePrivacy Directive) covers all three, so all three are listed below.

Strictly necessary items are the ones without which the service cannot do what you asked — keeping you signed in, protecting the sign-in form. Those do not require consent. Everything else does, and we ask first.

2. Cookies we set

In plain English: Four cookies. Three of them exist purely so that being logged in works and the sign-in form cannot be hijacked. The fourth remembers what you told the cookie banner.

NamePurposeTypeDuration
next-auth.session-token
(__Secure-next-auth.session-token over HTTPS)
Your signed-in session. Holds an encrypted token identifying your account so you do not have to log in on every page. Set by our authentication library (NextAuth). HttpOnly, SameSite=Lax, Secure over HTTPS.Essential30 days, refreshed while you are active; cleared on sign-out
next-auth.csrf-token
(__Host-next-auth.csrf-token over HTTPS)
Cross-site request forgery protection for sign-in and sign-out, so another site cannot submit those forms as you. HttpOnly, SameSite=Lax.EssentialSession cookie — deleted when you close the browser
next-auth.callback-url
(__Secure-next-auth.callback-url over HTTPS)
Remembers where to send you after you sign in, so you land back on the page you were trying to reach. HttpOnly, SameSite=Lax.EssentialSession cookie
clb_cookie_consentStores your answer to the cookie banner, so we do not ask again on every visit and so the server knows what you chose. Contains only your preference — no identifier, no tracking value. Deliberately readable by the page (not HttpOnly) because the banner itself needs to read it. SameSite=Lax, Secure over HTTPS.Essential (consent record)12 months

Session-cookie durations above are set by the browser, not by us. Where a duration is given in days, it is the maximum age we set; signing out clears the session cookie immediately.

3. Local and session storage

KeyStorePurposeTypeDuration
clb_cookie_consentlocalStorageThe same cookie preference, mirrored locally so the banner can decide whether to show itself before the page finishes loading — which is what stops it flashing at you on every navigation.Essential (consent record)Until you clear it or change your choice
clb-themelocalStorageWhether you asked for the light theme, the dark theme, or for the app to follow your device. A single word — light, dark or system. No identifier, and it is never sent to us or to anyone else.Essential (functional)Until you clear it or change your choice
mindset-auto-<signal>sessionStorageA one-shot flag so a coaching insight is generated at most once per browsing session for a given trigger, instead of regenerating in a loop. Value is literally "1".Essential (functional)Until you close the tab
review.readyToSend.openedsessionStorageSame job, on your Review screen: remembers which draft you just opened (a job posting, your mail app or LinkedIn), so that when you come back we can ask whether you actually sent it. Holds the item’s internal id, where you were sent and a timestamp — nothing about the recipient or the content. Cleared as soon as you answer.Essential (functional)Until you close the tab
outreach.sendQueue.openedsessionStorageRemembers which outreach message you just opened in your mail app, so that when you come back we can ask whether you actually sent it. Holds the message’s internal id, the channel used and a timestamp — nothing about the recipient or the content. Cleared as soon as you answer.Essential (functional)Until you close the tab
reconfirm-notice.dismissed:<campaign>sessionStorageRemembers that you tapped “Not now” on the note telling you your search targeting changed, so it does not follow you from screen to screen for the rest of the sitting. Holds your own search’s internal id and the value "1" — nothing else.Essential (functional)Until you close the tab
clb_analytics_sessionsessionStorageA random identifier for our first-party usage log (section 4), so we can tell that a sequence of events belongs to one sitting without knowing anything else about the browser. Pure chance — not derived from your account, your device or anything at all. Only ever written after you opt in to analytics; with the toggle off this key does not exist.Analytics (opt-in)Until you close the tab

4. Analytics — the one optional thing, and what we still do not use

In plain English: An earlier version of this page promised that if we ever added analytics, we would list it here by name before it ships. This is that listing.

What the analytics toggle now controls

The tool is our own: a first-party, self-hosted usage-event log, written by this app into this app’s database. No analytics company is involved — no script is loaded from anyone else’s server, and nothing is sent to one. When the toggle is on, the app records named events about how you use the product — for example page_view, approval_approved or marked_sent — each with a few coarse properties (the kind of item, a bucketed length — never the text), the path of the page you were on, and the random per-tab session id from the table above.

What it deliberately never records: your IP address, your user-agent, or free text of any kind — nothing you typed, no résumé or message content, no names or email addresses. Events are deleted automatically after 180 days. The whole thing is off by default: until you switch the analytics toggle on — in the cookie banner or in Settings — not a single event is recorded, and switching it off stops recording immediately.

What we still do not use

  • No third-party advertising cookies. No ad networks, no retargeting pixels, no conversion tags, no social-media tracking pixels.
  • No third-party analytics. No Google Analytics, no PostHog, no Mixpanel, no telemetry SaaS of any kind — the first-party log above is the whole story, and it never leaves our servers.
  • No session replay, heatmaps or fingerprinting.
  • No cross-site tracking. Every cookie above is first-party and SameSite=Lax; none of them follows you to another site.

No third-party requests either

Cookies are not the only way a page can leak who you are — an embedded font, script or image loaded from someone else’s server discloses your IP address and browser to them without ever setting a cookie. There are none here. Our typeface is self-hosted and served from this domain at build time, so loading a page in Career Love Builder does not contact Google or anyone else.

6. Changes and contact

If we add or remove a cookie, we will update this page and its last-updated date, and where the new item is non-essential we will ask for your consent before it runs. Questions about anything here go to [email protected]. For the wider picture — what data we hold and why — see the Privacy Policy, and for the rules of the service itself see the Terms of Service.