# Cookie Policy — Civium > Which cookies and browser storage Civium uses, what each one does and how long it lasts, and how to accept, reject or change your optional advertising cookies. Canonical page: https://mycivium.com/cookies Last updated: 2026-07-06 Effective date: 2026-07-06 · Version 1.2 ## Introduction This Cookie Policy explains what cookies and browser storage are used on Civium, and why. Civium uses strictly necessary authentication cookies and optional Google Ads conversion tracking cookies (when you consent to Google Ads cookies). ## Authentication Cookies Civium sets first-party cookies when you sign in. All are **HttpOnly** (inaccessible to JavaScript), **Secure** (HTTPS only), and **SameSite=Lax**. They are set server-side by the Next.js application and are strictly necessary for the service to function. ### Sign-in session cookies Three short-lived cookies are set the moment you submit the sign-in form. They exist only during the Magic Link authentication handshake and are deleted as soon as sign-in completes (or on sign-out). | Cookie | Purpose | Personal data | Duration | |---|---|---|---| | `civium_magic_session` | Stores the Cognito authentication session token between the moment you request a Magic Link and the moment you click it. Required for the sign-in challenge to complete in the same browser. | Opaque session token (no readable PII) | 3 minutes | | `civium_magic_email` | Stores your email address so the verification page can recover it after the Magic Link redirect. | Email address | 15 minutes | | `civium_return_url` | Stores the page you were trying to reach so you are redirected there after sign-in. | Relative URL path (no PII) | 15 minutes | All three cookies are deleted automatically on successful sign-in, on sign-out, or when they expire — whichever comes first. ### Authenticated session cookies Three cookies are set once sign-in succeeds and remain active during your session. | Cookie | Purpose | Personal data | Duration | |---|---|---|---| | `civium_access` | Cognito access token — authorises API calls | Auth metadata (sub, username, expiry) | 30 minutes | | `civium_id` | Cognito ID token — carries your identity claims | Email address, Cognito sub | 30 minutes | | `civium_refresh` | Cognito refresh token — allows silent renewal of access/ID tokens, keeping you signed in without requiring a new Magic Link for up to 2 days | Opaque token (no readable PII) | 2 days | The access and ID tokens are automatically renewed by the server-side middleware before they expire, as long as you remain active. The refresh token has a fixed 2-day lifetime from the point of sign-in and is not extended by activity. Once it expires you will be signed out and will need to sign in again. **Legacy note:** A cookie named `civium_user` may be present in browsers from a prior implementation. It may contain your email address. It is no longer required and is deleted automatically when you next sign in or out. ## Browser Storage (Not Cookies) ### localStorage Three categories of items are stored in `localStorage`. None contain authentication tokens, billing information, or payment data. **Session Management:** | Key | Purpose | Duration | |---|---|---| | `cm_session_start_ts` | Unix timestamp of when the current session started; used to enforce session timeout rules | Removed on sign-out; may persist until browser storage is cleared | | `cm_last_activity_ts` | Unix timestamp of the last user interaction; used to enforce session timeout rules | Removed on sign-out; may persist until browser storage is cleared | **Consent Management:** | Key | Purpose | Data | Duration | |---|---|---|---| | `civium_consent_preferences` | Stores your Google Ads cookie consent choice as a JSON object with a timestamp | `{"analytics": true/false, "marketing": true/false, "personalization": true/false, "timestamp": milliseconds}` | Until you clear browser storage or withdraw consent | | `civium_consent_banner_shown` | Flags that the cookie consent banner was displayed to you to prevent it from showing repeatedly | `"true"` (string) | Until you clear browser storage | | `ga_conversion_trial_started_{userId}` | Deduplication flag — prevents the trial-started Google Ads conversion from being sent more than once per user per device | Boolean flag | Until you clear browser storage | | `ga_conversion_subscription_started_{userId}` | Deduplication flag — prevents the subscription-started Google Ads conversion from being sent more than once per user per device | Boolean flag | Until you clear browser storage | ### sessionStorage Several items are stored in `sessionStorage` to preserve transient UI state within a browser tab. All are cleared automatically when the tab is closed. These items do not contain authentication tokens or payment data. Some onboarding draft values may include preferences you entered. | Key | Purpose | |---|---| | `hasUnsavedChanges` | Flags unsaved target preference edits so you are warned before navigating away | | `skipBeforeUnload` | Suppresses the browser's navigation warning after an intentional save action | | `billingPageNavigated` / `billingPageNavigating` | Tracks a Stripe Billing Portal round-trip to display a confirmation banner on return | | `civium_onboarding_draft_{id}` | Temporary draft of your onboarding selections, such as job types, positions, skills, and preferences; cleared on completion | ## Privacy-Friendly Analytics When analytics are enabled in the deployment configuration, Civium uses [Plausible Analytics](https://plausible.io) to collect aggregate site-usage statistics. Plausible is configured as cookieless analytics and does not use cookies or identify individual visitors. No consent is required. ## Google Ads Conversion Tracking Civium uses Google Ads conversion tracking to measure key events in your user journey, such as trial starts and subscription sign-ups. This service is provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). **Cookies set by Google Ads:** Google sets cookies and uses identifiers on your device to: - Recognize you across visits - Track conversion events (trial start, subscription start) - Measure campaign performance - Attribute conversions to Google Ads campaigns These cookies are only set **when you have explicitly consented to Google Ads cookies**. You can manage your Google Ads preferences in your [cookie preferences](/cookies#cookie-preferences). **Data shared with Google:** The following information is sent to Google Ads: - Conversion events (trial start, subscription start) - Conversion values and currency (where applicable) - A transaction ID to deduplicate conversions - Your consent state No personal data (email address, CV, job preferences) is sent to Google. For more information, see [Google's Privacy Policy](https://policies.google.com/privacy) and [Google Ads Data Policy](https://support.google.com/adspolicy/answer/143465). ## Consent and Controls **Essential cookies** (authentication) do not require consent and cannot be disabled. **Google Ads cookies** (conversion tracking) are optional and only set when you explicitly consent. You can: - Accept cookies by clicking **Accept** in the cookie banner - Reject optional cookies by choosing **Reject All** in the cookie preferences dialog - Manage your preferences at any time via [cookie preferences](/cookies#cookie-preferences) - Withdraw consent by updating your preferences Withdrawing consent does not affect the lawfulness of tracking conducted before withdrawal. You can delete cookies and clear browser storage at any time through your browser settings; doing so will sign you out. ## Third-Party Cookies ### Stripe (payment processing) When you initiate a subscription or billing action you are redirected to Stripe's hosted pages (`stripe.com`, `billing.stripe.com`). Stripe may set cookies on its own domain for fraud prevention and checkout continuity. These cookies are governed by [Stripe's Privacy Policy](https://stripe.com/privacy) and are outside Civium's control. Stripe does not set cookies on `mycivium.com`. ## Third-Party Resources (Not Cookies) Organisation logos displayed in the dashboard are fetched via a **server-side proxy** (`/api/logo`). The proxy contacts Google faviconV2 and DuckDuckGo on the server; your browser only communicates with `mycivium.com`. Your IP address is never sent to these third parties. No cookies are set and no user personal data or browser identifiers are transmitted. ## Cookie and Storage Retention Summary | Item | Type | Duration | |---|---|---| | `civium_access` | HttpOnly cookie | 30 minutes | | `civium_id` | HttpOnly cookie | 30 minutes | | `civium_refresh` | HttpOnly cookie | 2 days | | `cm_session_start_ts` | localStorage | Removed on sign-out; may persist until browser storage is cleared | | `cm_last_activity_ts` | localStorage | Removed on sign-out; may persist until browser storage is cleared | | sessionStorage flags | sessionStorage | Until tab closed | | `civium_magic_session` | HttpOnly cookie | 3 minutes (deleted on sign-in completion or sign-out) | | `civium_magic_email` | HttpOnly cookie | 15 minutes (deleted on sign-in completion or sign-out) | | `civium_return_url` | HttpOnly cookie | 15 minutes (deleted on sign-in completion or sign-out) | | Stripe (on stripe.com) | Third-party cookie | Session-based or persistent, depending on Stripe's configuration | --- ## Contact For cookie-related questions, contact us at [privacy@mycivium.com](mailto:privacy@mycivium.com).