Cookie Policy

A cookie is a small piece of data your browser stores on your behalf. We use cookies (and a few similar things - localStorage entries, session tokens) only where they earn their place. The rest of this page tells you exactly what we set, why, and how long it lasts.

Under India’s Digital Personal Data Protection Act 2023, we need your consent before we use anything that isn’t strictly necessary to deliver the service. Strictly-necessary cookies (signing you in, preventing CSRF) are processed under the "performance of contract" basis and don’t need consent. Analytics cookies do, and you can decline them and still use TakeOne fully.

These keep TakeOne working. They are set as soon as you visit the site or sign in; they cannot be disabled because the site won’t work without them.

• Supabase auth session - set by sb-<project>-auth-token cookies. Holds your signed-in JWT so you don’t have to re-enter credentials on every page. Lifetime: 1 hour for the access token, 30 days for the refresh token.
• Admin console session - set by the sb-admin-auth-token cookie, only on the admin console and only for TakeOne staff. It is kept separate from your app session. Same lifetimes as the auth session above.
• CSRF / state cookies - short-lived cookies set while you sign in with your phone number (WhatsApp code or sign-in link). Lifetime: minutes; cleared after the sign-in redirect completes.
• Consent state - a localStorage entry called analytics-consent (and its companion analytics-consent-version) that records your choice, whether you made it in the consent banner or in the optional checkbox at signup. Lifetime: until you clear browser storage or change your mind from the footer link.
• Operational UX state - a small set of localStorage flags that prevent us from interrupting you with the same prompt twice. None of them carry your identity or link to your account; they’re used only to decide whether to show or hide a banner / prompt:
  • pwa_install_dismissed - set when you close the "Install TakeOne" banner. Stops the banner from re-appearing on the same browser.
  • has_viewed_profile - a marker that you’ve reached at least one public profile page. Used only to gate when the install / push prompt first becomes eligible to show.
  • has_prompted_push - set after the push-permission slidedown is shown once, so we don’t re-prompt the same browser repeatedly.
  Lifetime: until you clear browser storage. None of these keys are sent to any server.
• Referral attribution - if you arrive via a referral link or a job-apply link, we remember the referral / job code so it survives the multi-step sign-up (email code, etc.) and the right referrer or poster is credited. Arriving via a referral link (/r/<code>) sets a server-side, HttpOnly cookie to_ref (readable only by our server, not by page scripts); a legacy link stores the code in session-based browser storage and a plain cookie under takeone_referral_code and takeone_job_ref. The code names only who referred you and when you opened the link, and carries no other identity. Lifetime: up to 30 days, and cleared as soon as your sign-up is created.

Separately from PostHog, we count visits with our own cookieless first-party measurement. It sets no cookies, writes nothing to your browser’s storage and assigns you no identifier. Each visit is counted with a one-way hash of your IP address and browser string mixed with a random value that we replace, and delete, every day, so visits on different days cannot be linked and we never store your IP address or full browser string. We keep only the page (with profile names and IDs removed), the referring website, campaign tags, device type, browser family, a rough screen size, time on page, and approximate city-level location. Raw visit records are deleted after 90 days; only hourly totals are kept. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded.

We also use Vercel Web Analytics and Speed Insights from our hosting provider, Vercel, to count page views and measure how fast pages load. They are cookieless too: nothing is stored in your browser. Vercel tells visits apart with a one-way hash of your request that it replaces every day, so visits on different days cannot be linked. What is collected: the page address, reduced by us to the kind of page (no profile names, IDs, links or anything after the “?”), the referring website, device type, browser, operating system and country, plus page-speed measurements. Nothing is sent from staff pages, or at all under Do Not Track or Global Privacy Control.

With your explicit consent we use PostHog to understand how the site is being used - which pages are slow, where new users get stuck, which features are working. We send all analytics events through our own /ingest proxy so PostHog never sees your IP directly, and we set up person-profiles only after you sign in (so anonymous browsing stays untracked-by-identity). PostHog runs only on our public website and the TakeOne app, never on our internal staff tools.

• PostHog session storage - one localStorage entry per session for distinct-id, plus a small queue of pending events. No third-party cookies. Lifetime: ~1 year by default; cleared when you decline analytics or delete your account.
• Sentry - Sentry’s browser SDK does NOT use cookies and runs whether or not you accept analytics, because it captures crashes and uncaught errors only. We strip query strings, drop authentication tokens, and never collect form inputs.

Analytics events we capture include things like: signed up, completed onboarding, uploaded profile photo, started checkout, auto-fill begun. Our event data never includes your password, OTP, message contents, or images themselves - just the fact that you took an action.

If you accept analytics, we also record session recordings of how you use TakeOne: pages visited, clicks, scrolling and what is shown on screen. Anything you type into a field (including passwords, OTP codes, payment details and message drafts) is hidden and never recorded. See the session recording section of our Privacy Policy for details.

• Cashfree Payments - when you start checkout you’re taken to Cashfree Payments India Private Limited’s payment page. They set their own session cookies on their domain; we never see them.
• Supabase / Vercel / Cloudflare - infrastructure providers may set short-lived edge / region cookies. None track you across sites.

It depends on your device, but the choice and the effect are identical either way. On desktop we show a cookie banner with equally prominent Accept and Essential-only buttons. On phones, where a banner covers much of the screen, we instead offer the same choice as an optional checkbox while you create your account. It is unticked by default, nothing is gated on it, and leaving it unticked is a valid answer that we record so you are not asked again. If our privacy policy materially changes we re-ask on every device using the banner.

You can change your cookie preferences any time, on any device. The fastest way is the link below - it re-opens the banner so you can pick again, and whichever button you choose replaces your stored choice. Simply opening it changes nothing, so you can close it again and keep the setting you already had.

Cookie preferences

You can also clear all browsing data for takeonehq.com in your browser’s settings - that wipes everything we’ve stored, and we will ask again the next time we can: the banner on your next visit on desktop, and on a phone the link above any time (or the optional checkbox if you create another account).

For anything cookie-related, write to support@takeonehq.com or use our Grievance Officer channel.