Cookie Policy

A cookie is a small file a website places in your browser to remember something — typically that you are logged in, or a preference you've chosen. A related technology called localStorage stores data on the same-origin basis without sending it back with every request. Stellenzu uses both, and we group them together as “cookies” in this policy for readability.

These are how we keep you signed in as you move between pages. They are essential — without them, you'd have to log in every time you clicked a link.

• pp_auth — a signed JSON Web Token issued by our backend when you sign in. It identifies your account and expires 24 hours after issue. Set with HttpOnly, Secure, and SameSite=Lax so it's not readable from JavaScript.
• oauth_state — a short-lived signed value used during Google / GitHub / LinkedIn sign-in to prevent cross-site request forgery. Deleted after the callback completes.

Blocking these will effectively log you out and prevent you from signing in. They're not optional.

These remember choices you make so the product feels consistent between visits. They are not essential — the product still works if you clear them, you'll just see default settings again.

• pp.jobTracker.v1 (localStorage) — the client-side Job Tracker used by the Resume Builder. Stores the job title, company, status, and source of each resume you tailored or downloaded. Only stored in your browser.
• pp.resumeCustomization (localStorage) — remembers the visual customization you applied in the Resume Builder (columns, colors, section order, etc.) so you don't have to re-configure it every time.
• pp.dismissedBanners (localStorage) — remembers which one-off banners or hints you've dismissed so we don't keep showing them.

Clearing these values just resets the corresponding setting or list. Nothing about your account changes.

We use Vercel Web Analytics to count how many people visit each page and where they came from. Vercel's analytics does not use a persistent cookie or a personal identifier, and it does not track you across other websites.

• __vercel_session — a short-lived, first-party cookie set by Vercel Analytics for basic session grouping. Contains no personal information and expires when your browser closes.

We do not use Google Analytics, Facebook Pixel, TikTok Pixel, HotJar, FullStory, or any similar tracking / session-replay tool. If we ever add another provider, we'll list it here.

When you sign in through Google, GitHub, or LinkedIn, those providers set their own cookies on their own domains as part of their OAuth flow. Those cookies are governed by each provider's own cookie / privacy policy, not by us — we don't read or write anything into them.

In your browser

Every modern browser lets you view, delete, and block cookies from Settings → Privacy. In Chrome and Edge you can also block cookies just for a specific site. Firefox and Safari have similar controls under “Manage Website Data.”

Inside Stellenzu

Where cookies power an optional feature, you can turn the feature off from your profile page (for example, disabling the resume customization presets clears the related localStorage entry).

We honour the Global Privacy Control signal where your browser sends it — if you've enabled GPC, we won't load the Vercel Web Analytics script for your session. Do Not Track (the older DNT header) is inconsistently implemented across browsers so we don't rely on it in isolation.

If we add, remove, or change a cookie, we'll update the “Last updated” date and, for material changes, we'll show a banner inside the product.