Cookie Policy | CogniHR

1.The short version

We use one cookie, and it is the one that keeps you signed in. There is no advertising, no analytics, no tracking pixel and no third-party script on this site.

That is also why you have not seen a consent banner. Cookies that are strictly necessary to deliver a service the user asked for are exempt from consent requirements under the UK and EU ePrivacy rules. If we ever add a cookie that is not, we will ask first — and this page will say so before we do.

3.The cookie we set

Cookies set by CogniHR
Name	Category	What it does	Expires
`cognihr_refresh`	Strictly necessary	Keeps you signed in between visits. Holds the token used to renew your session.	30 days

Three properties of this cookie are worth stating, because they limit what it can do:

HttpOnly. JavaScript cannot read it — not ours, and not anything injected into the page.
SameSite=Lax. It is not sent on cross-site requests, which is what stops another site from acting as you.
Scoped to /auth. It is only sent to the endpoints that renew a session, not to every request.

It contains a session token and nothing else. No name, no email, no browsing history, and nothing that identifies you to any other site.

4.What else we keep in your browser

Not cookies, but stored on your machine and worth listing. These live in your browser's local storage, are never sent to another site, and are cleared when you sign out.

Browser storage
Key	What it holds
`access_token`	Short-lived token authorising each request. Expires in 26 minutes.
`user_name`	Your display name, so the interface does not have to refetch it on every page.
`user_email`	The email on your account.
`user_id`	Your account identifier.
`user_role`	Your role, used to decide which navigation to render.
`sidebar_collapsed`	Whether you last left the sidebar collapsed.

5.Third-party cookies

We set none, and we embed no third-party script on the marketing site or in the application.

Two flows hand you over to another company, and that company's own policy applies while you are there:

Sign in with Google. Google sets its own cookies on its own domain during sign-in.
Payment. Checkout runs on Stripe, which sets cookies it needs for fraud prevention.

Neither reports back to us about your browsing.

6.Controlling cookies

Every browser lets you view, block and delete cookies, usually under Settings then Privacy. Deleting ours is safe — you will simply be signed out and have to sign in again.

Blocking it entirely means you cannot stay signed in, so the application will not be usable. The marketing pages will work fine.

Signing out clears the cookie and everything in local storage, which is the cleanest way to leave a shared machine.

7.Changes

If we add or change a cookie, this page changes first and the date at the top moves. Adding anything beyond a strictly necessary cookie would also mean asking for your consent. Related reading: our Privacy Policy and Security page. Questions go to [email protected].