Everything Itya stores in your browser
Itya sets 10 browser entries in total: 5 strictly necessary and 5 that remember a preference. There is no advertising cookie, no cross-site tracking cookie, and no third-party analytics or session-recording script on any Itya page.
| Name | Stored as | Purpose | Duration | Category |
|---|---|---|---|---|
__Host-refresh | Cookie | Holds the session refresh token so a signed-in member stays signed in. HttpOnly, Secure, SameSite, and scoped to this origin only. | 7 days, rotated on every refresh | Strictly necessary |
__Host-csrf | Cookie | Cross-site request forgery token bound to the session. | 7 days, rotated with the refresh token | Strictly necessary |
__Host-oauth-tx | Cookie | Binds one in-flight OAuth sign-in or integration-connect round trip to the browser that started it. | Minutes — cleared when the OAuth round trip finishes | Strictly necessary |
itya_locale | Cookie | Remembers the language you picked so pages render in it. | 1 year | Preference |
sidebar_state | Cookie | Remembers whether the workspace sidebar is expanded or collapsed. | 7 days | Preference |
itya_theme | Local storage | Remembers your light or dark appearance choice. | Until you clear site data | Preference |
itya_csrf_token | Local storage | Mirror of the CSRF token, used when the web app and API are served from different origins and the cookie cannot be read from script. | Until you sign out or clear site data | Strictly necessary |
itya_session_hint | Cookie | A flag saying "this browser probably has a session", so the app can send you to your workspace and attempt a silent refresh instead of bouncing you to sign-in. Holds no credential. Kept as a cookie on this origin and mirrored in local storage. | 7 days, refreshed on every sign-in or token refresh; cleared when you sign out | Strictly necessary |
itya:job-brief-draft:v1 | Local storage | Keeps an unsent job-brief draft so a reload does not lose your work. | Until the draft is submitted or you clear site data | Preference |
itya_cookie_notice | Local storage | Records that you dismissed the cookie notice on the public site so it stays dismissed. | Until you clear site data | Preference |
The public marketing, legal, pricing, support and status pages set nothing at all until you interact with them. Signing in is what creates the session cookies; changing language, theme or the sidebar is what creates the preference entries.
Why we do not ask for consent
Under the ePrivacy rules, consent is needed for storage that is not strictly necessary for a service the user has actively requested. Itya only stores two kinds of thing:
- Strictly necessary. Authentication, cross-site request forgery protection, and binding one OAuth round trip to the browser that started it. Without these you cannot sign in, and the service cannot be delivered securely. These are exempt from consent.
- Preferences you set on purpose. Language, light or dark appearance, sidebar state, an unsent draft, and the fact that you dismissed the cookie notice. Each one is written only because you performed the action that asks for it to be remembered, and each is exempt on the same basis.
Because nothing here is used for advertising, profiling or cross-context behavioural tracking, Itya does not show a consent wall with toggles that would not change anything. We show a short notice with a link to this page instead. If that ever stops being true, this page and the notice change first.
Your controls
- Clearing site data in your browser removes every entry in the table above. The next page load starts from defaults, and you will be asked to sign in again.
- Blocking cookies for this site will stop you from signing in. The public pages will still work.
- Signing out clears the session cookies immediately from both your browser and our server, and revokes the session.
- Every stored preference is per-browser and per-device. Nothing in the table is shared with a third party.
Changes and contact
If we add browser storage that is not strictly necessary or a straightforward preference, we will update this page before it ships and put a real consent choice in front of you.
The privacy policy covers everything else we process, and the subprocessor list names every third party involved. Questions go to security@itya.ai.