Cookie & Tracking Policy

This Cookie & Tracking Policy (this "Policy") describes how JAYOBE, Inc. ("JAYOBE," "we," "us," or "our") and the third-party service providers that operate parts of the Platform use cookies, local storage, session storage, and similar technologies on the JAYOBE website and web application at jayobe.io and the JAYOBE mobile applications (together, the "Platform").

This Policy applies to all Users of the Platform, including Employers and Job Seekers. Capitalized terms used in this Policy and not otherwise defined have the meanings given to them in the Terms of Service located at jayobe.io/terms.

This Policy is a companion to the JAYOBE Privacy Policy, located at jayobe.io/privacy, which describes how JAYOBE collects, uses, shares, retains, and protects personal information more generally. Where this Policy and the Privacy Policy address the same subject matter, they are intended to be read consistently with one another.

From a legal and privacy standpoint, the category of storage that most warrants scrutiny is persistent identifiers that enable tracking across sessions or across websites — not every use of client-side storage. A cookie that stores your logged-in session is functionally very different from a cookie that records your browsing activity across unrelated websites for advertising purposes.

JAYOBE's Platform uses a combination of cookies, local storage, session storage, and an application data cache. Every storage mechanism used on the Platform is strictly necessary for Platform functionality. JAYOBE's analytics are first-party and aggregate, set no persistent identifier on your device, and can be turned off at any time through the Manage Preferences modal described in Section 3. JAYOBE does not use advertising cookies, retargeting pixels, or cross-site tracking of any kind.

When you first visit the Platform, JAYOBE displays a banner that describes the Platform's use of cookies and similar technologies at a high level and provides a link to open the Manage Preferences modal.

Key Design Principles

JAYOBE's Platform uses the following tools. Each tool is described in its own subsection with the purpose of the tool, the storage mechanism used, the classification under this Policy, and the party that controls the tool.

4.1 Authentication and Session Management

Purpose. Maintaining your logged-in session and enabling secure authentication to the Platform.

Storage. Local storage (containing JSON Web Token access and refresh tokens issued by JAYOBE's authentication provider), and session cookies, depending on the browser's configuration. Without this storage, you would be required to log in on every page navigation.

Classification. Strictly necessary.

Controlled by. JAYOBE, through its database, authentication, and file storage provider, under a data processing agreement.

4.2 Payments and Fraud Prevention

Purpose. Secure payment processing for paid Employer subscriptions and trials, and fraud prevention, through the payment processor named in the Billing Terms.

Storage. The payment processor sets the following on pages where its checkout and billing components are loaded: __stripe_mid — a persistent cookie with a one-year expiry, used by the processor for machine identification and fraud detection across its merchant network. __stripe_sid — a session cookie used by the processor during an active checkout or billing interaction. Session storage entries used by the payment processor to manage checkout state during a transaction.

Classification. Strictly necessary. Disabling the payment processor's storage disables payment processing — including the ability to start a free trial, subscribe to a paid plan, or update billing information.

Controlled by. JAYOBE's payment processor, named in the Billing Terms.

4.3 Interactive Map

Purpose. Rendering the Platform's interactive job map and caching map tiles for rendering performance.

Storage. Local storage, consisting of two categories: Map tile cache — cached fragments of rendered map imagery used so that the map does not need to re-download the same tiles on every page load. Browser-local identifier — the maps provider's map library generates a universally unique identifier (stored under the key mapbox.eventData.uuid) that the maps provider uses for its own operational purposes. This identifier is generated by your browser's JavaScript environment and is stored in your browser's local storage. It is not linked to your JAYOBE account, not linked to your name, email address, or other personal identifier you provide to JAYOBE, and is not transmitted to JAYOBE. The identifier is handled by the maps provider under its privacy policy and JAYOBE's data processing agreement with it.

Classification. Strictly necessary. The interactive map is the Platform's primary interface for Job Seekers and tile caching is required for reasonable performance; without the maps provider's storage the map cannot render.

Controlled by. JAYOBE's maps provider.

4.4 Analytics

Purpose. Understanding how the Platform is used in aggregate in order to improve performance, reliability, and features.

Loading behavior. Analytics is on by default: the analytics script is loaded on page visits unless you have switched the Analytics toggle off in the Manage Preferences modal described in Section 3, in which case it is not loaded.

Data collected. The analytics tool collects aggregated page views, navigation patterns, web vitals performance metrics (such as load time, interactivity, and visual stability), general region (not precise location), browser type, and device category. It does not collect names, email addresses, account identifiers, or any other personally identifying information.

Storage. It does not rely on persistent cookies or persistent identifiers set by JAYOBE on your device. The analytics tool may generate ephemeral hashes from HTTP request metadata (such as the request URL, the User's IP address, and user agent) that rotate at least daily for the purpose of counting distinct visitors without tracking the same browser across days. Any such derived signals are processed under the analytics provider's privacy policy and are not shared with JAYOBE in identifiable form.

Classification. Analytics — not strictly necessary; on by default and can be switched off at any time in the Manage Preferences modal.

Controlled by. JAYOBE's analytics and hosting provider.

4.5 JAYOBE First-Party Cookies and Storage

Purpose. Security, session management, User-preference persistence, and consent recording for the Platform.

Storage. JAYOBE sets a limited set of first-party cookies and first-party local storage items on your device, each of which is strictly necessary:

Classification. All of the above are strictly necessary. They serve security, consent compliance, and User-expected preference persistence; none is used for tracking, analytics, advertising, or profiling.

Controlled by. JAYOBE.

4.6 Transactional and Opt-In Email Delivery

Purpose. Delivering email communications sent by the Platform, including transactional emails (such as account verification, trial confirmations, trial end reminders, payment receipts, payment failure notices, cancellation confirmations, and application confirmations) and — where the recipient has opted in — commercial email messages and job alerts.

Storage on your device. None. JAYOBE's email delivery provider operates on the server side. It does not set any cookies or local storage in your browser. JAYOBE does not use tracking pixels, open trackers, or click trackers in emails sent on the Platform.

Data received by the email provider. The email provider receives the recipient's email address and the content of the email message in order to deliver the message.

Classification. Back-end email delivery infrastructure. Not a browser-side tracking technology.

Controlled by. JAYOBE's email delivery provider.

JAYOBE does not sell personal information collected through these technologies and does not share it for cross-context behavioral advertising, as described in Section 6 of the Privacy Policy.

Strictly necessary cookies, local storage, session storage, and application data caches are technologies that cannot be disabled without breaking core Platform functionality. These are the technologies described in Sections 4.1, 4.2, 4.3, and 4.5.

All modern browsers allow you to view, manage, block, and delete cookies and local storage through their settings. You can also configure your browser to notify you when cookies are set or to block specific categories of cookies. Guidance for the most common browsers is published by each browser's maker:

Two practical notes about browser controls:

Clearing cookies and local storage will log you out of JAYOBE. JAYOBE's session is maintained through the authentication storage described in Section 4.1. Clearing cookies or local storage — whether manually, through a browser "clear browsing data" action, or through private or incognito browsing — ends your logged-in session and requires you to log in again.

Browser controls affect all websites, not just JAYOBE. Changes you make in browser settings apply to every website you visit. The JAYOBE Manage Preferences modal described in Section 3 is the primary Platform-specific control for Platform-specific tracking choices.

Some browsers send a "Do Not Track" (DNT) signal. JAYOBE detects the DNT signal on incoming requests. Because JAYOBE does not use cross-site tracking cookies, advertising tools, or any technology that follows Users across other websites, JAYOBE's data handling does not change based on the presence or absence of a DNT signal — there is no cross-site tracking to suppress. If JAYOBE's data practices ever change to include cross-site tracking, JAYOBE will update this Policy to describe how it responds to DNT signals at that point.

Global Privacy Control (GPC) is a browser-level privacy signal indicating that a User does not want their personal information sold or shared with third parties for cross-context behavioral advertising. GPC is sent as an HTTP header (Sec-GPC: 1) on every request from browsers or browser extensions that have enabled it.

No current sale or sharing. As of the Effective Date of this Policy, JAYOBE does not sell personal information to any third party and does not share personal information for cross-context behavioral advertising. JAYOBE's honoring of GPC therefore operates as a forward-looking commitment: if JAYOBE's practices ever change, the GPC signal already on record for your browser will continue to be honored automatically, without the need for renewed action on your part.

Disputes arising under or relating to this Policy — other than (i) statutory privacy rights requests that a User may make to JAYOBE under the California Consumer Privacy Act, state comprehensive privacy laws, or analogous laws, and (ii) complaints to state Attorneys General, the Federal Trade Commission, or any other regulator with jurisdiction — are resolved under the arbitration procedures set forth in Section 18 of the Terms of Service, subject to the carve-outs and opt-out right described in that Section. The opt-out right includes a time-limited window after first acceptance of the Terms of Service for a User to opt out of arbitration by written notice to legal@jayobe.io, as set out in Section 18.8 of the Terms of Service. The governing law, venue, and class action waiver provisions in Sections 18 and 19 of the Terms of Service apply to this Policy.

JAYOBE may modify this Policy at any time. The "Last Updated" and "Effective Date" shown at the top of this Policy will be revised to reflect the date of the most recent modification.

For broader information about how JAYOBE collects, uses, shares, retains, and protects personal information, please see the JAYOBE Privacy Policy at jayobe.io/privacy.