Effective date: 6 July 2026 Version: 1.2
Introduction
This Cookie Policy explains what cookies and browser storage are used on Civium, and why. Civium uses strictly necessary authentication cookies and optional Google Ads conversion tracking cookies (when you consent to marketing cookies).
Authentication Cookies
Civium sets first-party cookies when you sign in. All are HttpOnly (inaccessible to JavaScript), Secure (HTTPS only), and SameSite=Lax. They are set server-side by the Next.js application and are strictly necessary for the service to function.
Sign-in session cookies
Three short-lived cookies are set the moment you submit the sign-in form. They exist only during the Magic Link authentication handshake and are deleted as soon as sign-in completes (or on sign-out).
| Cookie | Purpose | Personal data | Duration |
|---|---|---|---|
civium_magic_session | Stores the Cognito authentication session token between the moment you request a Magic Link and the moment you click it. Required for the sign-in challenge to complete in the same browser. | Opaque session token (no readable PII) | 3 minutes |
civium_magic_email | Stores your email address so the verification page can recover it after the Magic Link redirect. | Email address | 15 minutes |
civium_return_url | Stores the page you were trying to reach so you are redirected there after sign-in. | Relative URL path (no PII) | 15 minutes |
All three cookies are deleted automatically on successful sign-in, on sign-out, or when they expire — whichever comes first.
Authenticated session cookies
Three cookies are set once sign-in succeeds and remain active during your session.
| Cookie | Purpose | Personal data | Duration |
|---|---|---|---|
civium_access | Cognito access token — authorises API calls | Auth metadata (sub, username, expiry) | 30 minutes |
civium_id | Cognito ID token — carries your identity claims | Email address, Cognito sub | 30 minutes |
civium_refresh | Cognito refresh token — allows silent renewal of access/ID tokens, keeping you signed in without requiring a new Magic Link for up to 2 days | Opaque token (no readable PII) | 2 days |
The access and ID tokens are automatically renewed by the server-side middleware before they expire, as long as you remain active. The refresh token has a fixed 2-day lifetime from the point of sign-in and is not extended by activity. Once it expires you will be signed out and will need to sign in again.
Legacy note: A cookie named civium_user may be present in browsers from a prior implementation. It may contain your email address. It is no longer required and is deleted automatically when you next sign in or out.
Browser Storage (Not Cookies)
localStorage
Three categories of items are stored in localStorage. None contain authentication tokens, billing information, or payment data.
Session Management:
| Key | Purpose | Duration |
|---|---|---|
cm_session_start_ts | Unix timestamp of when the current session started; used to enforce session timeout rules | Removed on sign-out; may persist until browser storage is cleared |
cm_last_activity_ts | Unix timestamp of the last user interaction; used to enforce session timeout rules | Removed on sign-out; may persist until browser storage is cleared |
Consent Management:
| Key | Purpose | Data | Duration |
|---|---|---|---|
civium_consent_preferences | Stores your cookie consent choices (analytics, marketing, personalization) as a JSON object with a timestamp | {"analytics": true/false, "marketing": true/false, "personalization": true/false, "timestamp": milliseconds} | Until you clear browser storage or withdraw consent |
civium_consent_banner_shown | Flags that the cookie consent banner was displayed to you to prevent it from showing repeatedly | "true" (string) | Until you clear browser storage |
sessionStorage
Several items are stored in sessionStorage to preserve transient UI state within a browser tab. All are cleared automatically when the tab is closed. These items do not contain authentication tokens or payment data. Some onboarding draft values may include preferences you entered.
| Key | Purpose |
|---|---|
hasUnsavedChanges | Flags unsaved target preference edits so you are warned before navigating away |
skipBeforeUnload | Suppresses the browser's navigation warning after an intentional save action |
billingPageNavigated / billingPageNavigating | Tracks a Stripe Billing Portal round-trip to display a confirmation banner on return |
civium_onboarding_draft_{id} | Temporary draft of your onboarding selections, such as job types, positions, skills, and preferences; cleared on completion |
Privacy-Friendly Analytics
When analytics are enabled in the deployment configuration, Civium uses Plausible Analytics to collect aggregate site-usage statistics. Plausible is configured as cookieless analytics and does not use cookies or identify individual visitors. No consent is required.
Google Ads Conversion Tracking
Civium uses Google Ads conversion tracking to measure key events in your user journey, such as trial sign-ups and feature previews. This service is provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA).
Cookies set by Google Ads: Google sets cookies and uses identifiers on your device to:
- Recognize you across visits
- Track conversion events (trial start, preview access)
- Measure campaign performance
- Attribute conversions to Google Ads campaigns
These cookies are only set when you have explicitly consented to marketing cookies. You can manage your Google Ads preferences in your cookie preferences.
Data shared with Google: The following information is sent to Google Ads:
- Conversion events (trial signup, feature preview)
- Conversion values and currency (where applicable)
- A transaction ID to deduplicate conversions
- Your consent state
No personal data (email address, CV, job preferences) is sent to Google. For more information, see Google's Privacy Policy and Google Ads Data Policy.
Consent and Controls
Essential cookies (authentication) do not require consent and cannot be disabled.
Marketing cookies (Google Ads conversion tracking) are optional and only set when you explicitly consent. You can:
- Accept marketing cookies by clicking "Accept All" in the banner
- Reject marketing cookies by clicking "Reject"
- Manage your preferences at any time in your cookie preferences
- Withdraw consent by updating your preferences
Withdrawing consent does not affect the lawfulness of tracking conducted before withdrawal. You can delete cookies and clear browser storage at any time through your browser settings; doing so will sign you out.
Third-Party Cookies
Stripe (payment processing)
When you initiate a subscription or billing action you are redirected to Stripe's hosted pages (stripe.com, billing.stripe.com). Stripe may set cookies on its own domain for fraud prevention and checkout continuity. These cookies are governed by Stripe's Privacy Policy and are outside Civium's control. Stripe does not set cookies on mycivium.com.
Third-Party Resources (Not Cookies)
Organisation logos displayed in the dashboard are fetched via a server-side proxy (/api/logo). The proxy contacts Google faviconV2 and DuckDuckGo on the server; your browser only communicates with mycivium.com. Your IP address is never sent to these third parties. No cookies are set and no user personal data or browser identifiers are transmitted.
Cookie and Storage Retention Summary
| Item | Type | Duration |
|---|---|---|
civium_access | HttpOnly cookie | 30 minutes |
civium_id | HttpOnly cookie | 30 minutes |
civium_refresh | HttpOnly cookie | 2 days |
cm_session_start_ts | localStorage | Removed on sign-out; may persist until browser storage is cleared |
cm_last_activity_ts | localStorage | Removed on sign-out; may persist until browser storage is cleared |
| sessionStorage flags | sessionStorage | Until tab closed |
civium_magic_session | HttpOnly cookie | 3 minutes (deleted on sign-in completion or sign-out) |
civium_magic_email | HttpOnly cookie | 15 minutes (deleted on sign-in completion or sign-out) |
civium_return_url | HttpOnly cookie | 15 minutes (deleted on sign-in completion or sign-out) |
| Stripe (on stripe.com) | Third-party cookie | Session-based or persistent, depending on Stripe's configuration |
Contact
For cookie-related questions, contact us at privacy@mycivium.com.