Cookie Policy

A cookie is a small piece of data your browser stores on your behalf. We use cookies (and a few similar things - localStorage entries, session tokens) only where they earn their place. The rest of this page tells you exactly what we set, why, and how long it lasts.

Under India’s Digital Personal Data Protection Act 2023, we need your consent before we use anything that isn’t strictly necessary to deliver the service. Strictly-necessary cookies (signing you in, preventing CSRF) are processed under the "performance of contract" basis and don’t need consent. Analytics cookies do, and you can decline them and still use TakeOne fully.

These keep TakeOne working. They are set as soon as you visit the site or sign in; they cannot be disabled because the site won’t work without them.

• Supabase auth session - set by sb-<project>-auth-token cookies. Holds your signed-in JWT so you don’t have to re-enter credentials on every page. Lifetime: 1 hour for the access token, 30 days for the refresh token.
• CSRF / state cookies - short-lived cookies set during the OAuth dance with Google or during the email-OTP verification step. Lifetime: minutes; cleared after the auth redirect completes.
• Consent state - a localStorage entry called analytics-consent (and its companion analytics-consent-version) that records your choice, whether you made it in the consent banner or in the optional checkbox at signup. Lifetime: until you clear browser storage or change your mind from the footer link.
• Operational UX state - a small set of localStorage flags that prevent us from interrupting you with the same prompt twice. None of them carry your identity or link to your account; they’re used only to decide whether to show or hide a banner / prompt:
  • pwa_install_dismissed - set when you close the "Install TakeOne" banner. Stops the banner from re-appearing on the same browser.
  • has_viewed_profile - a marker that you’ve reached at least one public profile page. Used only to gate when the install / push prompt first becomes eligible to show.
  • has_prompted_push - set after the push-permission slidedown is shown once, so we don’t re-prompt the same browser repeatedly.
  Lifetime: until you clear browser storage. None of these keys are sent to any server.
• Referral attribution - if you arrive via a partner referral link or a job-apply link, we remember the referral / job code so it survives the multi-step sign-up (email code, etc.) and the right partner or poster is credited. Arriving via a canonical partner link (/r/<code>) sets a server-side, HttpOnly cookie to_ref (readable only by our server, not by page scripts); a legacy link stores the code in session-based browser storage and a plain cookie under takeone_referral_code and takeone_job_ref. The code names only who referred you and carries no other identity. Lifetime: up to 30 days, and cleared as soon as your sign-up is created.

With your explicit consent we use PostHog to understand how the site is being used - which pages are slow, where new users get stuck, which features are working. We send all analytics events through our own /ingest proxy so PostHog never sees your IP directly, and we set up person-profiles only after you sign in (so anonymous browsing stays untracked-by-identity).

• PostHog session storage - one localStorage entry per session for distinct-id, plus a small queue of pending events. No third-party cookies. Lifetime: ~1 year by default; cleared when you decline analytics or delete your account.
• Sentry - Sentry’s browser SDK does NOT use cookies and runs whether or not you accept analytics, because it captures crashes and uncaught errors only. We strip query strings, drop authentication tokens, and never collect form inputs.

Analytics events we capture include things like: signed up, completed onboarding, uploaded profile photo, started checkout, auto-fill begun. We never capture your password, OTP, DM contents, or images themselves - just the fact that you took an action.

• Google - only if you sign in with Google. Google sets its own cookies during the OAuth flow on accounts.google.com; those are governed by Google’s policy, not ours.
• DodoPayments - when you start checkout you’re redirected to DodoPayments’ hosted page. They set their own session cookies on their domain; we never see them.
• Supabase / Vercel / Cloudflare - infrastructure providers may set short-lived edge / region cookies. None track you across sites.

It depends on your device, but the choice and the effect are identical either way. On desktop we show a cookie banner with equally prominent Accept and Essential-only buttons. On phones, where a banner covers much of the screen, we instead offer the same choice as an optional checkbox while you create your account. It is unticked by default, nothing is gated on it, and leaving it unticked is a valid answer that we record so you are not asked again. If our privacy policy materially changes we re-ask on every device using the banner.

You can change your cookie preferences any time, on any device. The fastest way is the link below - it re-opens the banner so you can pick again, and whichever button you choose replaces your stored choice. Simply opening it changes nothing, so you can close it again and keep the setting you already had.

Cookie preferences

You can also clear all browsing data for takeonehq.com in your browser’s settings - that wipes everything we’ve stored, and we will ask again the next time we can: the banner on your next visit on desktop, and on a phone the link above any time (or the optional checkbox if you create another account).

For anything cookie-related, write to grievance@takeonehq.com or use our Grievance Officer channel.