Cookie notice
This notice lists each cookie and equivalent item of local storage employed by this site, its purpose and its duration. Storage which is strictly necessary is set without consent, as permitted. All other storage is set only upon consent.
Last updated: 2026-10-01
1. Scope
The Service is a single-page application and holds most of what it requires in the browser's own local storage rather than in cookies. Both are treated alike for the purposes of this notice and of the law applying to it.
Nothing listed below is transmitted from the browser save for the authentication tokens, which are presented to our servers to establish identity.
2. Strictly necessary storage
The items below are required for the operation of the service you have requested. Consent is not required for them and none is sought. They cannot be disabled.
| Name | What it is for | How long it lasts |
|---|---|---|
| CognitoIdentityServiceProvider.* | The tokens that keep you signed in. Issued by Amazon Cognito when you sign in. | Until you sign out. If you did not tick "keep me signed in", they are held in session storage instead and are gone when you close the tab. |
| rs-remember-me | Whether you asked to stay signed in on this device, which decides where the tokens above are kept. | Until you sign out or clear your browser. |
| rs-consent | The cookie choice you made on this page, so you are not asked again on every visit. | Until you clear your browser, or until this notice changes and the choice is asked again. |
| rs-theme | Light or dark mode, so the site does not flash back to light on every visit. | Until you clear your browser. |
| rs-locale | The language you chose. | Until you clear your browser. |
| basic, education, experience, skills, awards, activities, volunteering, themes, resumeSectionVisibility, resumeSectionLayouts, resumeName, selectedTemplateId | The resume you are editing and how you have laid it out, held in your browser so a refresh does not lose your work. This is your own content and is never read by anyone else from here. | Cleared when you sign out, so a shared computer does not keep your resume. You are asked whether to save it to your account first. Otherwise until you clear it, or clear your browser. |
| rs-cv-level-scheme | The colour scheme you picked on the country rules page. | Until you clear your browser. |
| Cloudflare Turnstile | The bot check in front of signing up, signing in and password reset. It is what stops someone running stolen passwords against this site at scale. Turnstile is loaded from challenges.cloudflare.com and any storage it sets belongs to that address, not to this one. | Set and cleared by Cloudflare, typically within the hour. |
3. Analytics
Optional, and not set in the absence of consent. Failure to respond to the banner is treated as a refusal.
Google Analytics 4 is used to count visits and to see which pages are read. It is loaded only after consent has been given: refusal, withdrawal, or a Global Privacy Control signal results in no request being made to Google and none of the storage below being set. The originating IP address is truncated before storage, Google advertising signals are disabled, and the data is not used for advertising or combined with any advertising audience.
Sentry Session Replay records how the builder is used: the layout of its screens, where the pointer moved, clicked and scrolled, and the pages and requests the page made. Text, typing, images and the resume itself are hidden in the browser before anything is sent. It runs only with consent and stops when the builder is left or consent is withdrawn.
| Name | What it is for | How long it lasts |
|---|---|---|
| _ga | Distinguishes one browser from another so that repeat visits are not counted as new people. Set by Google Analytics under this domain. | Two years from the last visit, unless cleared sooner. |
| _ga_9Q0D13Y5LJ | Holds the state of the current visit for the analytics property belonging to this site. | Two years from the last visit, unless cleared sooner. |
| sentryReplaySession | Session storage set by Sentry Session Replay while it runs in the builder, so one recording is not split in two by a reload. | Until the tab is closed. A recording ends after 15 minutes without activity, or after an hour in all. |
4. Advertising
Optional, and not set in the absence of consent. Failure to respond to the banner is treated as a refusal.
Google Ads conversion measurement is used to learn whether a visit that arrived from one of our advertisements led to an account or a purchase. It operates only after the Marketing choice has been allowed: refusal, withdrawal, or a Global Privacy Control signal results in no advertising request being made to Google and none of the storage below being set. It is not used to show advertising on this site and builds no advertising profile here.
The LinkedIn Insight Tag serves the same purpose for advertisements shown on LinkedIn, and is governed by the same Marketing choice. It is loaded from snap.licdn.com only after consent, and while consent is in force it reports each page viewed as well as sign ups, purchases and the first PDF download. Refusal or a Global Privacy Control signal means it is never loaded. Withdrawal means no further event is sent, the entries it set under this domain are expired at once, and the tag is not loaded again on any later page. LinkedIn also sets storage under its own linkedin.com domains, which we can neither read nor remove; it lists them in its own cookie table.
The Microsoft Advertising UET tag serves the same purpose for advertisements shown on Bing and other Microsoft properties, and is governed by the same Marketing choice. It is loaded from bat.bing.net only after consent, and while consent is in force it reports each page viewed. Refusal or a Global Privacy Control signal means it is never loaded and no request is made to Microsoft at all. Withdrawal means the tag is told through Microsoft's consent mode that consent is denied, so it stops setting and using identifiers, and the entries it set under this domain are expired at once; the already-loaded tag may still report pages viewed, without identifiers, until the page open at the time is left, and it is not loaded again on any later page. Microsoft also sets storage under its own bing.com domains, which we can neither read nor remove; it lists that storage in its own cookie documentation.
| Name | What it is for | How long it lasts |
|---|---|---|
| _gcl_au | Set by Google Ads to connect a visit that came from an advertisement with what happens on this site afterwards. | Three months, unless cleared sooner. |
| _gcl_aw and similar _gcl_ entries | Hold the identifier of the advertisement click that brought you here, so a later sign up or purchase can be attributed to it. | Three months, unless cleared sooner. |
| li_fat_id | Set by the LinkedIn Insight Tag under this domain. Holds the identifier of the LinkedIn advertisement click that brought you here, so a later sign up or purchase can be attributed to it. | Thirty days from the most recent click, unless cleared sooner. |
| li_giant | Set by the LinkedIn Insight Tag under this domain. An indirect identifier for a group of LinkedIn members, used for conversion measurement. | Seven days, unless cleared sooner. |
| li_adsid | Set by the LinkedIn Insight Tag under this domain for visitors outside the EU, EEA, UK and Quebec only: a pseudonymous LinkedIn Ads identifier used as an additional conversion signal. Not set for visitors in those territories. | As stated in LinkedIn's cookie table, unless cleared sooner. |
| bcookie, lidc, li_gc, li_sugr, UserMatchHistory, AnalyticsSyncHistory | Set by LinkedIn under its own linkedin.com domains when the Insight Tag runs: a browser identifier, routing, LinkedIn's own consent record, a probabilistic match of your identity, and the timing of identifier synchronisation. They belong to LinkedIn, not to this site. | From one day to one year, as stated in LinkedIn's cookie table at linkedin.com/legal/l/cookie-table. |
| _uetsid | Set by the Microsoft Advertising UET tag under this domain. Identifies the current visit, so the pages of one visit are counted together. | One day, unless cleared sooner. |
| _uetvid | Set by the Microsoft Advertising UET tag under this domain. Distinguishes one browser from another across visits, so a later sign up or purchase can be attributed to an earlier advertisement click. | Thirteen months, unless cleared sooner. |
| _uetmsclkid | Set by the Microsoft Advertising UET tag under this domain when you arrive from a Microsoft advertisement. Holds the identifier of that click, so what happens afterwards can be attributed to it. | One day, unless cleared sooner. |
| MUID and similar Microsoft entries | Set by Microsoft under its own bing.com domains when the UET tag runs: a browser identifier used for conversion measurement across Microsoft properties. They belong to Microsoft, not to this site. | Up to thirteen months, as stated in Microsoft's own cookie documentation. |
| rs-li-once | Our own note, in local storage, that a first PDF download has already been reported to LinkedIn for this account on this device, so it is reported once rather than on every download. Written only after the Marketing choice is allowed. | Until consent is withdrawn, which removes it, or until you clear your browser. |
5. Payment
Payment is processed by Polar in its own checkout window. That window appears on our page but is served from Polar's domain, and Polar sets storage under its own domain and under its own privacy policy, which we can neither read nor control.
6. Withdrawal of consent
Consent may be withdrawn at any time by means of the cookie settings link in the footer. Withdrawal is as straightforward as the giving of consent and takes immediate effect.
Where the browser transmits a Global Privacy Control signal, that signal is treated and recorded as a refusal and the banner is not presented.