Cookie Policy

This page describes the cookies and similar browser-storage items CareerPilot AI uses, what they're for, and how long they last. Short version: we don't use any third-party tracking or advertising cookies. Everything below is first-party and necessary for the product to work or to remember your preferences.

Strictly necessary

These keep you signed in and the app functional. They can't be disabled without breaking the service.

• next-auth.session-token(cookie, up to 30 days) — your authenticated session. Set by Auth.js when you sign in. Lifetime depends on whether you ticked "Remember me" at signin: 30 days when checked (the default), 1 day when not. Removed when you sign out or it expires.
• next-auth.csrf-token (cookie, session) — anti-CSRF for sign-in forms.
• next-auth.callback-url (cookie, session) — remembers where to send you after sign-in completes.

Preference

These remember small UI choices so the app feels consistent across visits. Stored in your browser only.

• careerpilot:theme (localStorage) — light / dark / auto theme preference.
• careerpilot:sidebar-collapsed(localStorage) — whether you've collapsed the left navigation.
• careerpilot:signin:rememberedEmail(localStorage) — your email address, saved when you check "Remember me" at sign-in so the email field pre-fills on your next visit. Cleared the next time you sign in with "Remember me" unchecked. Never includes your password.
• careerpilot:plan-banner-dismissed(sessionStorage, current session only) — hides the "You're on the Free plan" banner once you dismiss it for this browsing session.

Visitor analytics — no cookies involved

We collect first-party visitor analytics (pageviews, traffic source, country/city) to understand how the product is used. This is described in detail in our Privacy Policy. It does not set any cookies. Visitors are identified server-side by the combination of IP address and browser user-agent, and the client-side pageview ping is sent via the navigator.sendBeacon API which is cookie-less by design.

What we DON'T use

• No Google Analytics, Plausible, Mixpanel, Amplitude, or any other third-party web analytics SDK.
• No advertising cookies (Meta, Google Ads, TikTok pixel, etc.).
• No marketing-automation cookies (HubSpot, Marketo, Drift, Intercom, etc.).
• No session-replay tools (Hotjar, FullStory, LogRocket).
• No A/B testing platforms.
• No cross-site retargeting.

If we ever add any of these, this page will be updated before they go live and existing account holders will receive notice.

Third-party cookies set on our domain

When you sign in with Google, the Google OAuth flow briefly redirects to accounts.google.com. Cookies set during that redirect are Google's, governed by Google's Privacy Policy. They are not accessible to CareerPilot once you're back on our domain.

When you reach the Stripe Checkout page to upgrade to Pro, Stripe sets its own cookies on checkout.stripe.com. Those are governed by Stripe's Privacy Policy.

Managing your cookies

You can clear all CareerPilot cookies and local storage from your browser settings at any time. Doing so will sign you out, reset your theme preference, and expand the sidebar. Clearing cookies does not delete your account or any data stored on our servers — for that, use Settings → Delete account.

Browser-level Do Not Track

We don't serve any third-party content that would track you, so a "Do Not Track" signal from your browser has nothing to act on — there's nothing for us to disable.

Changes

Any change to our cookie usage will appear here with an updated "last updated" date at the top of this page.