Cookie Policy
Updated: 2026-07-29 · Consent version: 2026-07-29.1
This policy lists the cookies and similar technologies (localStorage, sessionStorage, pixels) we use, for what purpose, for how long, and by which provider. Non-essential categories activate only with your consent — you can change your choice anytime.
Essential
Keeping you signed in, security (CSRF), remembering your language and theme, storing your consent, and basic abuse prevention.
| Name | Provider | Purpose | Expiration | Type |
|---|---|---|---|---|
| next-auth.session-token | CVPLEX (first-party) | Maintains your signed-in session. | 30 days | HTTP cookie |
| next-auth.csrf-token | CVPLEX (first-party) | CSRF protection on authentication forms. | Session | HTTP cookie |
| cv_consent | CVPLEX (first-party) | Stores your cookie consent and its version. Without it we'd re-ask on every load. | 12 months | HTTP cookie |
| cv_lang / cv_theme / cv_landing_accent | CVPLEX (first-party) | Remembers your chosen language, light/dark mode and accent colour. | 12 months / local storage | localStorage |
| cv_local_draft | CVPLEX (first-party) | Temporary draft of your logged-out editing, kept in your browser (never leaves your device). | Session | sessionStorage |
Functional
Extra convenience features (e.g. embedded help/chat, remembering prior choices). Core features still work without these.
| Name | Provider | Purpose | Expiration | Type |
|---|---|---|---|---|
| intercom-* (Intercom) | Intercom | Remembering embedded support chat state (if enabled). | 9 months | HTTP cookie |
Analytics
Aggregated, statistical measurement (traffic, which features are popular, where users get stuck) to improve the service. Data is handled as un-identifiably as possible.
| Name | Provider | Purpose | Expiration | Type |
|---|---|---|---|---|
| _ga / _ga_* | Google (Google Analytics 4) | Anonymous visitor statistics and usage measurement. | 2 years | HTTP cookie |
| _clck / _clsk | Microsoft (Clarity) | Aggregated usage patterns, heatmaps and session replay to improve UX. | 1 year | HTTP cookie |
| _hjSession* (Hotjar) | Hotjar | Behaviour and feedback measurement (if enabled). | 30 min – 1 year | HTTP cookie |
Marketing
Measuring ad campaign performance (conversion tracking) and showing more relevant ads on platforms such as Google Ads or Meta. You can use the service without this.
| Name | Provider | Purpose | Expiration | Type |
|---|---|---|---|---|
| _gcl_au / Google Ads | Google (Google Ads) | Ad conversion measurement and remarketing. | 90 days | HTTP cookie |
| _fbp (Meta Pixel) | Meta Platforms | Conversion measurement and ad targeting on Facebook/Instagram. | 90 days | HTTP cookie |
Personalization
Tailoring the interface, tips and recommendations based on your prior activity (e.g. relevant templates, suggestions). Without it you see generic content.
| Name | Provider | Purpose | Expiration | Type |
|---|---|---|---|---|
| cv_personalization | CVPLEX (first-party) | Personalising content and recommendations based on your prior activity. | 6 months | localStorage |
Third-party providers' cookies (e.g. Google, Meta, Microsoft, Hotjar, Intercom) are only set if you enabled the relevant category and the provider is actively connected. Google tools are governed by Google Consent Mode v2.