Cookie & Tracking Policy

This Cookie & Tracking Policy (this "Policy") describes how JAYOBE, Inc. ("JAYOBE," "we," "us," or "our") and the third-party service providers that operate parts of the Platform use cookies, local storage, session storage, and similar technologies on the JAYOBE website and web application located at jayobe.io (the "Platform").

This Policy applies to all Users of the Platform, including Employers and Job Seekers. Capitalized terms used in this Policy and not otherwise defined have the meanings given to them in the Terms of Service located at jayobe.io/terms.

This Policy is a companion to the JAYOBE Privacy Policy, located at jayobe.io/privacy, which describes how JAYOBE collects, uses, shares, retains, and protects personal information more generally. Where this Policy and the Privacy Policy address the same subject matter, they are intended to be read consistently with one another.

From a legal and privacy standpoint, the category of storage that most warrants scrutiny is persistent identifiers that enable tracking across sessions or across websites — not every use of client-side storage. A cookie that stores your logged-in session is functionally very different from a cookie that records your browsing activity across unrelated websites for advertising purposes.

JAYOBE's Platform uses a combination of cookies, local storage, and session storage. Every storage mechanism used on the Platform is either strictly necessary for Platform functionality or optional and subject to your affirmative opt-in through the cookie banner and Manage Preferences modal described in Section 3. JAYOBE does not use advertising cookies, retargeting pixels, or cross-site tracking of any kind. See Section 5.

When you first visit the Platform, JAYOBE displays a minimized bottom banner that describes the Platform's use of cookies and similar technologies at a high level and provides a link to open the Manage Preferences modal.

Key Design Principles

JAYOBE's Platform uses the following tools. Each tool is described in its own subsection with the purpose of the tool, the storage mechanism used, the classification under this Policy, the party that controls the tool, and a link to the provider's privacy policy where applicable.

4.1 Supabase — Authentication and Session Management

Purpose. Maintaining your logged-in session and enabling secure authentication to the Platform.

Storage.Local storage (containing JSON Web Token access and refresh tokens issued by Supabase Auth), and session cookies, depending on the browser's configuration. Without this storage, you would be required to log in on every page navigation.

Classification. Strictly necessary.

Controlled by.JAYOBE (Supabase acts as JAYOBE's database, authentication, and file storage provider under a data processing agreement).

Provider privacy policy. Available at supabase.com/privacy.

4.2 Stripe — Payments and Fraud Prevention

Purpose. Secure payment processing for paid Employer subscriptions and trials, and fraud prevention through Stripe Radar.

Storage. Stripe sets the following on pages where Stripe's checkout and billing components are loaded: __stripe_mid — a persistent cookie with a one-year expiry, used by Stripe for machine identification and fraud detection across Stripe's merchant network. __stripe_sid — a session cookie used by Stripe during an active checkout or billing interaction. Session storage entries used by Stripe to manage checkout state during a transaction.

Classification.Strictly necessary. Disabling Stripe's storage disables payment processing — including the ability to start a free trial, subscribe to a paid plan, or update billing information.

Controlled by. Stripe, Inc.

Provider privacy policy. Available at stripe.com/privacy.

4.3 Mapbox — Interactive Map

Purpose.Rendering the Platform's interactive job map and caching map tiles for rendering performance.

Storage. Local storage, consisting of two categories: Map tile cache — cached fragments of rendered map imagery used so that the map does not need to re-download the same tiles on every page load. Browser-local identifier — Mapbox GL JS generates a universally unique identifier (stored under the key mapbox.eventData.uuid) that Mapbox uses for its own SDK operational purposes. This identifier is generated by your browser's JavaScript environment and is stored in your browser's local storage. It is not linked to your JAYOBE account, not linked to your name, email address, or other personal identifier you provide to JAYOBE, and is not transmitted to JAYOBE. The identifier is handled by Mapbox under Mapbox's privacy policy and JAYOBE's data processing agreement with Mapbox.

Classification.Strictly necessary. The interactive map is the Platform's primary interface for Job Seekers and tile caching is required for reasonable performance; without Mapbox's storage the map cannot render.

Controlled by. Mapbox, Inc.

Provider privacy policy. Available at mapbox.com/legal/privacy.

4.4 Vercel Analytics

Purpose. Understanding how the Platform is used in aggregate in order to improve performance, reliability, and features.

Loading behavior. Vercel Analytics is off by default. The analytics script is not loaded on page visits. Vercel Analytics is loaded only if you affirmatively enable the Analytics toggle in the Manage Preferences modal described in Section 3.

Data collected when enabled. Where enabled, Vercel Analytics collects aggregated page views, navigation patterns, web vitals performance metrics (such as load time, interactivity, and visual stability), general region (not precise location), browser type, and device category. Vercel Analytics does not collect names, email addresses, account identifiers, or any other personally identifying information.

Storage.Vercel Analytics does not rely on persistent cookies or persistent identifiers set by JAYOBE on your device. Where enabled, Vercel Analytics may generate ephemeral hashes from HTTP request metadata (such as the request URL, the User's IP address, and user agent) that rotate at least daily for the purpose of counting distinct visitors without tracking the same browser across days. Any such derived signals are processed under Vercel's privacy policy and are not shared with JAYOBE in identifiable form.

Classification. Analytics — not strictly necessary; User-opt-in only.

Controlled by. Vercel, Inc.

Provider privacy policy. Available at vercel.com/legal/privacy-policy.

4.5 JAYOBE First-Party Cookies and Storage

Purpose. Security, session management, User-preference persistence, and consent recording for the Platform.

Storage. JAYOBE sets a limited set of first-party cookies and first-party local storage items on your device, each of which is strictly necessary:

Classification. All of the above are strictly necessary. They serve security, consent compliance, and User-expected preference persistence; none is used for tracking, analytics, advertising, or profiling.

Controlled by. JAYOBE.

4.6 Resend — Transactional and Opt-In Email Delivery

Purpose. Delivering email communications sent by the Platform, including transactional emails (such as account verification, trial confirmations, trial end reminders, payment receipts, payment failure notices, cancellation confirmations, and application confirmations) and — where the recipient has opted in — commercial email messages and job alerts.

Storage on your device.None. Resend operates on the server side as JAYOBE's email delivery infrastructure. Resend does not set any cookies or local storage in your browser. JAYOBE does not use tracking pixels, open trackers, or click trackers in emails sent through Resend on the Platform.

Data received by Resend.Resend receives the recipient's email address and the content of the email message in order to deliver the message.

Classification.Back-end email delivery infrastructure. Not a browser-side tracking technology. Included in this Section 4 for transparency about the Platform's full set of third-party providers.

Controlled by. Resend, Inc.

Provider privacy policy. Available at resend.com/legal/privacy-policy.

Strictly necessary cookies, local storage, and session storage are technologies that cannot be disabled without breaking core Platform functionality. These are the technologies described in Sections 4.1, 4.2, 4.3, and 4.5.

All modern browsers allow you to view, manage, block, and delete cookies and local storage through their settings. You can also configure your browser to notify you when cookies are set or to block specific categories of cookies. Guidance for the most common browsers is published by each browser's maker:

Two practical notes about browser controls:

Clearing cookies and local storage will log you out of JAYOBE.JAYOBE's session is maintained through the authentication storage described in Section 4.1. Clearing cookies or local storage — whether manually, through a browser "clear browsing data" action, or through private or incognito browsing — ends your logged-in session and requires you to log in again.

Browser controls affect all websites, not just JAYOBE. Changes you make in browser settings apply to every website you visit. The JAYOBE Manage Preferences modal described in Section 3 is the primary Platform-specific control for Platform-specific tracking choices.

Some browsers send a "Do Not Track" (DNT) signal. JAYOBE detects the DNT signal on incoming requests. Because JAYOBE does not use cross-site tracking cookies, advertising tools, or any technology that follows Users across other websites, JAYOBE's data handling does not change based on the presence or absence of a DNT signal — there is no cross-site tracking to suppress. If JAYOBE's data practices ever change to include cross-site tracking, JAYOBE will update this Policy to describe how it responds to DNT signals at that point.

Global Privacy Control (GPC) is a browser-level privacy signal indicating that a User does not want their personal information sold or shared with third parties for cross-context behavioral advertising. GPC is sent as an HTTP header (Sec-GPC: 1) on every request from browsers or browser extensions that have enabled it.

No current sale or sharing.As of the Effective Date of this Policy, JAYOBE does not sell personal information to any third party and does not share personal information for cross-context behavioral advertising. JAYOBE's honoring of GPC therefore operates as a forward-looking commitment: if JAYOBE's practices ever change, the GPC signal already on record for your browser will continue to be honored automatically, without the need for renewed action on your part.

Disputes arising under or relating to this Policy — other than (i) statutory privacy rights requests that a User may make to JAYOBE under the California Consumer Privacy Act, state comprehensive privacy laws, or analogous laws, and (ii) complaints to state Attorneys General, the Federal Trade Commission, or any other regulator with jurisdiction — are resolved under the arbitration procedures set forth in Section 18 of the Terms of Service, subject to the carve-outs and opt-out right described in that Section. The opt-out right includes a time-limited window after first acceptance of the Terms of Service for a User to opt out of arbitration by written notice to legal@jayobe.io, as set out in Section 18.8 of the Terms of Service. The governing law, venue, and class action waiver provisions in Sections 18 and 19 of the Terms of Service apply to this Policy.

JAYOBE may modify this Policy at any time. The "Last Updated" and "Effective Date" shown at the top of this Policy will be revised to reflect the date of the most recent modification.

For broader information about how JAYOBE collects, uses, shares, retains, and protects personal information, please see the JAYOBE Privacy Policy at jayobe.io/privacy.