Cookies and similar technologies

This notice explains what OpenStaff stores on your phone or computer, and why. In short: two cookies that keep you signed in, a small amount of browser storage that remembers your place in a feature and your cookie choices, and two optional extras that we use only if you allow them: remembering how you like the screen laid out, and a tool on our public homepage that counts visits. We do not use advertising cookies and we do not track you across other websites.

What these words mean

A cookie is a small text file that a website asks your browser to keep, and to send back each time you use the site. Browser storage is similar: the site keeps a small piece of information in your browser, but the browser does not send it back automatically. The rules are the same for both, so this notice covers both.

What we store on your device

The table at the end of this notice lists everything we store on your device, and the one tool we load from another company. For each item it gives the name, what it does, its type, how long it lasts and how to turn it off. The sections below explain them in more detail.

The two sign-in cookies

We set these ourselves when you sign in. Both of them:

• are HttpOnly, which means scripts running in the page cannot read them;
• are Secure, which means they are sent only over an encrypted connection;
• are SameSite=Strict, which means your browser does not send them when you arrive from another website;
• apply to the whole of our site (path /).

access holds a token that says which account is signed in and whether it is a candidate account or an employer account. The token is valid for 60 minutes and is renewed automatically while you use the site. The cookie has no expiry date of its own, so it lasts until you close your browser.

refresh holds a token whose only job is to get a new access token. Each time it is used, we replace it with a new one and the old one stops working. It lasts for 10 days from its last renewal. If you do not use OpenStaff for 10 days, you are signed out.

When you sign out, we delete both cookies. We also stop your other devices renewing their sign-in, so they are signed out within an hour. If you close your account, your other devices are signed out straight away.

We may change the names of these cookies to __Host-access and __Host-refresh. They would do the same job. The prefix is a browser security rule that ties a cookie to our exact web address.

If you block these cookies, you cannot sign in. The public pages still work.

Browser storage

Your place in your matched jobs. While you review your matched jobs, we keep lists of the jobs you have skipped, saved or applied for in your browser's session storage. This stops a job you have already dealt with from coming back.

• The name of the entry ends with your account ID. That is a string of letters and numbers, not your name or email address. It is there so that two people who use the same browser do not see each other's progress.
• The entry holds the IDs of jobs and nothing else.
• It stays in your browser. We do not read it on our servers.
• Your browser deletes it when you close the tab. We delete it when you sign out.

The employer side menu. If you allow display preferences, and then collapse or expand the side menu of the employer area on a computer, we store the word "true" or "false" in your browser's local storage, so that the menu stays the way you left it. OpenStaff works the same without it. This is off until you allow it, with "Accept all" in the cookie banner or the "Display preferences" switch in cookie settings. If you turn it off again, we delete what is stored and stop storing it, and the menu opens in its usual state each time. Otherwise it stays until you clear your browser's storage.

Your cookie choices. When you answer the cookie banner or save your cookie settings, we store your choices in your browser, so that we can respect them the next time you visit. They apply to that browser only, and signing out does not remove them. If you clear your browser's storage, or use another device, we ask again.

Counting visits to our homepage

If you allow it, we use Vercel Web Analytics on our public homepage, and nowhere else. Vercel is the company that hosts our website. When the tool is loaded, it sends Vercel a record of each page view, and we see the totals. This tells us how many people visit the homepage.

• We use it only if you allow it, with "Accept all" in the cookie banner or the "Website statistics" switch in cookie settings. Until then, we do not load the tool at all.
• You can change your mind at any time in cookie settings. Once you turn it off, we stop loading the tool.
• We use it for statistics only. We do not use it for advertising, we do not use it to build a profile of you, and we do not link it to your account.
• It does not run on the pages you see after you sign in.

What we do not use

• No advertising cookies, and no cookies or scripts from advertising networks or social media sites.
• No tracking across other websites.
• No session recording, and no analytics other than the visit counting described above.
• No fonts, maps, videos or chat tools loaded from other companies. Our fonts are served from our own site.

Photos and logos are loaded from our own file storage at Amazon Web Services. Like any web server, it receives your IP address when your browser fetches an image. It does not set cookies.

Our staff admin area, which people who use OpenStaff cannot reach, sets its own sign-in and security cookies for our staff only.

Paying for a job post. When an employer pays for a job post, OpenStaff sends them to a payment page run by our payment provider, Stripe. That page is Stripe's, and Stripe's own cookie notice covers it. We load no Stripe script, and set no cookie for it, on our own pages.

Emails

Our emails do not contain tracking pixels. We do not track whether you open an email or which links you click. Links in our emails go straight to OpenStaff. Our marketing emails contain no images, and their unsubscribe link opens a page on our site that stores nothing on your device.

An email that tells you about a new message can show the employer's logo. If your email app loads images, it fetches the logo from our file storage when you open the email. We do not use that to record whether you opened it.

Your choices

• The cookie banner. The first time you visit, a banner asks whether you accept the optional extras, display preferences and visit counting. "Reject all" is as easy as "Accept all", and "Manage settings" lets you choose each one. Nothing optional runs until you answer, and nothing is switched on for you.
• Cookie settings. Go to cookie settings, or choose "Cookie settings" at the bottom of our public pages, our sign-in and sign-up pages, the candidate pages or the employer area's Settings pages (Company Profile, Account and Billing), to change your choice at any time, as easily as you gave it. A change takes effect straight away, in the browser you make it in. You do not need an account to use it.
• Your browser. You can block or delete cookies and site storage in your browser's settings. If you block our sign-in cookies, you cannot sign in. If you delete your cookie choices, we ask again.

If we ever add something else that is optional, such as advertising, or change what one of these options covers, we will ask you again before it runs, and saying no will be as easy as saying yes.

Changes and questions

We update this notice whenever we add, change or remove anything in the table below. If you have a question about it, email privacy@openstaff.co.uk. Our privacy notice explains how we use personal information and what your rights are.