Last updated 26 October 2026.
Cookies are small files a website stores in your browser; local storage and session storage do a similar job. The law lets a site use them without asking when they’re strictly necessary for something you’ve asked for, such as staying signed in. For anything else we ask first, in the cookie banner: Analytics (heatmaps and session replay) and Marketing (measuring our Google ads) are both off until you switch them on.
You can change your mind at any time: “Cookie settings” at the bottom of every page opens your choices again. If your browser sends Global Privacy Control, we treat it as “no” to both and don’t ask.
Cookies we set
| Name | What it does | How long |
|---|---|---|
sb-…-auth-token | Keeps you signed in. Only our server can read it | 90 days after you last used your account, or until you sign out |
ha_si | Tells the page you’re signed in, so it shows “Your account”. Holds no details | The same as the sign-in cookie |
ha_signin | Lets the sign-in button in our email sign you in straight away in the browser that asked for it | 1 hour |
ha_next | Remembers which page to bring you back to after you sign in | 1 hour |
ha_gm_draft | Links your browser to the CV and answers you’ve uploaded but not saved yet | Until you close your browser |
ha_consent | Remembers your cookie choices, so we don’t ask again on every page | 6 months |
Our hosting provider’s bot check runs a small invisible test in your browser when you send a form, to tell people from automated traffic. A bot-protection service runs a second check in a small frame of its own when you send a form or ask for a sign-in code; it sets no cookie on our site, and you normally see nothing (now and then it may ask you to tick a box).
Only if you say yes
| Name | What it does | How long |
|---|---|---|
ph_…_posthog | Analytics: lets our analytics service follow one visit across pages, for heatmaps and session replay. Typing in forms is never recorded | 1 year, or until you switch Analytics off |
_gcl_au and other _gcl_… cookies, and _gcl_ls in local storage | Marketing: Google Ads, to tell whether a visit came from one of our ads and led to an application or a CV | Up to 90 days, or until you switch Marketing off |
Switching either off removes its cookies from our site. Google may also use its own cookies on google.com when the ad tag loads: see the Google cookies policy. The privacy notice explains what Google receives.
Local and session storage
These stay in your browser and aren’t sent to us automatically.
| Name | What it does | How long |
|---|---|---|
ha_noengage | Remembers that you turned off visit counting | Until you turn it back on or clear your browser |
ha:jobs:search | Your last job search, so the jobs page opens where you left it | Until you clear your browser |
ha_pending | A job save or alert you started before signing in, to finish it after | Until it’s done |
Session storage (ha_visit, ha:jobs:…, gm-progress and similar) | Your place in a list or form, so “back” and a reload don’t lose it | Until you close the tab |
How we count visits without cookies
Unless you say yes to Analytics, we count which pages and agencies people use without any cookie or stored identifier, both in our own log and with the analytics service we use, which we then run in its cookieless mode: it sets no cookies and stores nothing in your browser. The privacy notice explains how, and has a switch to turn both off. Global Privacy Control in your browser turns them off too.
Google ratings
Agency profiles with a Google listing show the agency’s Google rating using Google Maps Platform. It loads from Google only when that part of the page comes into view, and Google may use its own cookies or similar storage when it does: see the Google cookies policy and the Google Privacy Policy.
Controlling cookies
Use “Cookie settings” at the bottom of any page to change your choices. You can also block or delete cookies in your browser’s settings. If you block ours, you won’t be able to stay signed in, but you can still read every ranking and job.