Cookie Policy
This Cookie Policy explains how JobApply.io ("we", "us", or "our") uses cookies and similar storage technologies when you visit or use the jobapply.io website and the JobApply.io application at app.jobapply.io (together, the "Service"). It also explains your choices for managing these technologies.
Last updated and effective: October 1, 2026
1. Summary
- Cookies and browser storage are small pieces of data kept in your browser that help the Service function correctly.
- Some of them are strictly necessary for sign-in, sessions, security, holding the document you are editing, and storing your consent choice — these cannot be disabled.
- Optional cookies and storage let us measure performance, replay sessions with passwords, codes and payment details left out, provide support chat, and measure advertising conversions.
- Analytics is on for every visitor by default, and you can switch it off at any time. Google Ads measurement cookies are set by default; switch them off in Cookie settings.
- There are three categories: Essential (called strictly necessary elsewhere in this policy), Analytics and Advertising. You can change the two optional ones at any time through the Cookie settings link in our website footer, through Cookie settings in Account Settings in the application, or through your browser.
2. What Are Cookies?
Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, provide a better user experience, and supply information to site operators.
Cookies can be "first-party" (set by JobApply.io directly) or "third-party" (set by a service provider that we use, such as an analytics tool). They can also be "session" cookies (deleted when you close your browser) or "persistent" cookies (stored until they expire or you delete them).
3. Types of Cookies and Storage We Use
3.1 Strictly Necessary Cookies
These cookies are essential for the Service to function. Without them, core features such as account login, session management, and security protections would not work. These cookies cannot be disabled.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| jobapply_shared_access | Short-lived cross-surface authentication session | Until the access session expires | First-party, HttpOnly |
| jobapply_shared_refresh | Cross-surface session renewal | 30 days | First-party, HttpOnly |
| jobapply_nav_hint | Marks this browser as having signed in, so the application can skip a pointless session check for a visitor who never signed in. Its value is the single character 1 — it carries no identifier and no personal data. It is the only cross-surface sign-in marker page scripts can read; the shared session cookies themselves are HttpOnly. | Up to 30 days, or the shorter access-session lifetime | First-party |
| jobapply_tailor_guest | Keeps a guest job-description tailoring session separate from other visitors | 90 days | First-party, HttpOnly |
| jobapply_editor_guest | HttpOnly guest editor grant for CV preview and one bounded CV import before sign-in. | 30 days | JobApply.io Strictly necessary |
| jobapply_cookie_consent | Stores the default cookie setting or your own choice | 12 months | First-party |
One more first-party cookie is still set by the application, although it is not strictly necessary and nothing on either site reads it any more: jobapply_entitlement_hint. The application sets it to the single character 1 when your account has or has had a subscription, and removes it when you sign out. It carries no identifier and no personal data, is shared by jobapply.io and app.jobapply.io, and lasts 30 days. It was used by an earlier version of the website navigation; we are retiring it, and until it is gone it is listed here so that this policy names every cookie the Service sets.
3.2 Performance and Analytics Cookies
These cookies and storage keys collect information about how visitors use the Service, which pages are visited, and whether errors occur. We use this data to improve reliability, fix bugs, and understand feature adoption. Analytics is on by default, so they are created on your first visit unless you switch Analytics off in Cookie settings. Analytics events are sent through our own server on the surface you are using (jobapply.io/ingest or app.jobapply.io/ingest) before reaching PostHog, so your browser makes fewer direct third-party requests.
Session replay. Analytics, which is on by default, also turns on PostHog session replay, which records a reconstruction of your visit: the pages you open and the text on them, including the text of your CV and cover letters, what you type, your clicks, your scrolling and your navigation. Passwords, sign-in codes, payment details and hidden fields are never recorded. Recordings are kept by PostHog, our analytics provider, in the EU for 30 days. We may keep copies of some recordings for up to 90 days to improve the product, then delete them. Declining Analytics, or withdrawing it later, stops the recording.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| ph_<project token>_posthog | PostHog's identifier for your browser and your visits, used to count visits, measure usage and tie a session replay together. It is anonymous until you sign in; from then on it is linked to your JobApply.io account, and signing out of the application starts a new anonymous identifier. Written both as a cookie on .jobapply.io, so the same identifier is used on the website and the application, and as a browser local-storage key of the same name. | Cookie: 365 days. Local storage: until you withdraw Analytics consent or clear browser storage | First-party cookie and local storage |
| ph_<project token>_window_id, ph_<project token>_primary_window_exists | Tells PostHog which browser tab a session and its replay belong to | Until you close the browser tab | First-party session storage |
| jobapply-campaign-attribution | The campaign tags of the ad or link that brought you to the app (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the website page you came from, so a purchase can be counted against the campaign. Kept on app.jobapply.io only. | 30 days, or until you withdraw Analytics consent, sign out, or clear browser storage | First-party browser local storage |
| ph_conv_… | Keeps the state of a PostHog support chat conversation | Until you withdraw Analytics consent or clear browser storage | First-party cookie or browser storage |
| jobapply-ai-operation:v1:outcome-features, jobapply-ai-operation:v1:outcome-settled | Remembers which AI feature started a request, so a result that arrives after a page reload is credited to that feature, and which requests were already counted, so each is counted once in usage analytics. Opaque request identifiers and a feature name only | Until you close the browser tab, sign out, or switch Analytics off | First-party session storage |
3.3 Browser Storage Used by the Application
The application at app.jobapply.io keeps your work and your sign-in state in your browser as well as on our servers. This storage is strictly necessary: without it the editor could not hold the document you are working on, and you would be signed out on every page load. Most keys the Service writes itself are named with a jobapply prefix; the browser storage created by PostHog and by the Google tag, and the three analytics keys and two advertising keys the Service writes itself, are listed in the tables above and below.
| Storage | Purpose | Lifetime | Category |
|---|---|---|---|
| jobapply-auth-session, jobapply-auth-session:tokens | Your signed-in identity (account id, email address, when it was verified) in local storage, and the matching access and refresh tokens in session storage | Identity: until you sign out or delete your account. Tokens: until you close the browser tab | Strictly necessary |
| jobapply-resume-builder | An IndexedDB database holding your working copy of your profile, your resumes and your cover letters — including any photo you add — and the queue of changes still waiting to sync to our servers. It is the largest store the Service creates on your device | Until you delete your account from Account Settings, or clear the site data for app.jobapply.io in your browser. Signing out does not remove it, and clearing cookies does not remove it | Strictly necessary |
| jobapply-resume-stage:<id>, jobapply-resume-download-stage-reached:<id>, jobapply-template-style-overrides:<id>, jobapply-ai-change-history:<id>, jobapply-atomic-ai:…, jobapply-ai-operation:v1:<id>, jobapply-cover-letter-ai:active-operation:v1:<id>, jobapply:cover-letter-ai-session:<id>, jobapply-resume-preview-cache:v1 | Editor state: which step you reached, your template and accent-colour choices, the history of AI changes so you can undo them, an AI request still running so it survives a page reload, the cached document preview, and — for a cover letter you are tailoring — the job description you pasted together with the wording the AI suggested for it, until you accept or discard those suggestions | Local storage: until you sign out, delete your account or clear browser storage. Session storage: until you close the browser tab | Strictly necessary |
| jobapply-local-resume-editor-access:<id> | A session marker for the draft opened in this tab. After confirmed checkout, it lets the editor clear return markers from the URL without interrupting access | Session storage: until you close the tab, sign out, delete your account or clear browser storage | Strictly necessary |
| jobapply-onboarding-contact, jobapply-funnel-mint-welcome, jobapply-plg-checkout-owner, jobapply-checkout-profile-prefill, jobapply-checkout-origin, jobapply-checkout-attempts-v1, jobapply-checkout-return-access, jobapply-checkout-banner-continuation, jobapply-pending-checkout-return-intent, jobapply-pending-download-intent, jobapply-pending-subscription-claim, jobapply-subscription-status-snapshot | Sign-up and checkout state: the email address you entered, which screen a checkout was started from, what you asked to download, and what still has to finish when PayPal returns you to the Service | Local storage: until you sign out, delete your account or clear browser storage. Session storage: until you close the browser tab. The one exception is jobapply-checkout-origin, which signing out does not remove: checkout ignores and deletes it the next time it is read, and never accepts it more than 2 hours after it was written | Strictly necessary |
3.4 Marketing and Advertising Cookies
Google Ads measurement cookies are set by default; switch them off in Cookie settings. With Advertising consent, we send ad_storage and ad_user_data as granted while keeping ad_personalization denied.
With Advertising consent, Google Ireland Limited may receive conversion and campaign-attribution data, and Google Ads may use the following first-party storage for that measurement. We keep ad_personalization denied and do not use the Service to show personalized ads.
| Storage | Purpose | Duration | Type |
|---|---|---|---|
| _gcl_au | Google tag conversion measurement | Up to 90 days | First-party cookie |
| _gcl_aw | Google Ads click and conversion attribution | 90 days after the ad click | First-party cookie |
| _gcl_ls | Google Ads click information used for conversion attribution | Persistent until cleared or replaced | First-party browser local storage |
| jobapply-google-click-id | The Google Ads click identifier (gclid, wbraid or gbraid) of the ad you clicked, so a purchase can be matched to that click. Kept on app.jobapply.io only. | 30 days, or until you withdraw Advertising consent, sign out, or clear browser storage | First-party browser local storage |
| jobapply-google-ads-trial-activated:<subscription ID> | Prevents sending the same trial-activation conversion more than once and stores the provider subscription identifier in the key | Until Advertising consent is withdrawn or browser storage is cleared | First-party browser local storage |
4. Similar Technologies
In addition to cookies, the Service uses three kinds of browser storage. The individual keys, their purpose and their lifetime are listed in the tables in Section 3.
- Local storage: keeps small values in your browser until something removes them. Unlike cookies, local storage is not sent to the server with every request.
- Session storage: the same, but cleared when you close the browser tab.
- IndexedDB: a database inside your browser. The application keeps its working copy of your profile, your resumes and your cover letters — including any photo you add — in a database named jobapply-resume-builder, together with the changes still queued to sync to our servers. Clearing cookies does not remove it. Deleting your account from Account Settings does, and so does clearing the site data for app.jobapply.io in your browser.
We treat all these technologies with the same level of care and transparency as cookies.
5. How to Manage Cookies
5.1 Consent Controls
We do not show a cookie banner. Analytics is on for every visitor by default. Google Ads measurement cookies are set by default; switch them off in Cookie settings. To change either, use the Cookie settings link in the footer of jobapply.io or of the application, or Cookie settings under Privacy in Account Settings in the application. Your choice is stored once for both the website and the application. If you clear the Service's cookies stored by your browser, the default applies again on your next visit.
5.2 Browser Settings
Most browsers allow you to manage cookies through their settings. You can typically:
- View and delete existing cookies.
- Block all cookies or only third-party cookies.
- Set your browser to notify you before a cookie is placed.
- Clear cookies when you close your browser.
Here are links to cookie management instructions for common browsers:
5.3 Impact of Disabling Cookies
If you block or delete strictly necessary cookies, parts of the Service may not function correctly. Specifically:
- You may not be able to log in or maintain an active session.
- Security features may be impaired.
- Live support chat may not open or remember the current support ticket.
- Your cookie consent choice may not be remembered.
Declining the optional categories (Analytics and Advertising) costs you nothing in the product itself: editing, templates, exports and your account all work exactly the same. It stops the usage measurement and session replay that run in your browser, and the PostHog support chat is not loaded, so you would write to us by email instead.
6. Third-Party Cookies
Some cookies and storage on the Service are placed by third-party service providers that help us operate and improve the platform:
- Analytics providers: PostHog provides product analytics and session replay. Its SDK, its storage and its requests are created while Analytics is on, which it is by default; switching Analytics off stops them.
- Support providers: PostHog Support may store support chat state and process support messages when you use live chat while Analytics is on.
- Advertising measurement: Google Ads measurement cookies are set by default; switch them off in Cookie settings.
- Hosting and monitoring providers: tools that measure page performance, errors, and service reliability.
- Payment processors: PayPal, our payment provider, may set cookies necessary for processing transactions securely (e.g., fraud detection). These are governed by the provider's own cookie policy.
Each provider processes personal data under its own standard data-processing terms. Where a provider processes data outside the EU/EEA, we rely on that provider's EU-U.S. Data Privacy Framework certification where it holds one and otherwise on the Standard Contractual Clauses incorporated in the provider's data-processing terms. The Privacy Policy names each provider, what it receives and where it processes it.
7. How Long Cookies and Storage Last
How long something stays on your device depends on what it is for:
- Session-bound cookies: expire with the access session, or after the duration shown in the tables in Section 3.
- Persistent cookies: stay on your device until they expire or you delete them.
- Browser storage: has no expiry date of its own. Session storage disappears when you close the tab; local storage and the IndexedDB database stay until they are removed as described in Section 3.
The tables in Section 3 list each cookie and storage key described in this policy with its lifetime.
8. Legal Basis for Cookies and Storage (EU/EEA)
Article 5(3) of the ePrivacy Directive covers any storing of, or access to, information on your device — cookies, local storage, session storage and IndexedDB alike. We apply it to all of them:
- Strictly necessary cookies and storage do not require consent, because they are needed to deliver the service you asked for: signing you in, keeping your session, protecting the account, holding the document you are editing, and remembering your consent choice itself (Art. 5(3) ePrivacy Directive exception).
- Optional cookies and storage — Google Ads measurement cookies are set by default; switch them off in Cookie settings. Analytics, which includes session replay, is on by default and we treat your use of the Service as agreement to it. You can switch either category off at any time in Cookie settings, and we act on that choice.
9. Do Not Track
Some browsers transmit a "Do Not Track" (DNT) signal. There is no uniform standard for responding to DNT signals. We currently do not change our data collection or use practices in response to DNT signals, but we respect opt-out choices made through our cookie consent controls and browser settings.
10. Changes to This Cookie Policy
We may update this Cookie Policy when we add new cookies, change providers, or when legal requirements evolve. When we make material changes, we will update the "Last updated" date and, where appropriate, provide notice through the website or email.
We encourage you to review this policy periodically to stay informed about our use of cookies and related technologies.
11. Contact Us
If you have questions about our use of cookies or this Cookie Policy, please contact us:
For broader questions about how we handle your personal data, please refer to our Privacy Policy.