Cookie notice
Version 2026-10-12 · Effective October 12, 2026
The cookies Kyrolane sets, and the tracking we do not do with cookies.
What this notice covers
This notice explains cookies and similar storage on Kyrolane. The Privacy Policy explains the rest of our processing. You can delete cookies in your browser. Deleting the sign-in cookie signs you out.
Essential cookies
These cookies are needed to provide the service you ask for. They are httpOnly where noted, so page scripts cannot read them. In production they are marked secure.
| Cookie | Why | How long |
|---|---|---|
| kyrolane_session | Keeps you signed in | 7 days |
| jobpilot_session | An older sign-in cookie name. We still accept it until that session ends, and we delete it when a new session is set. | Until replaced or it expires |
| kyrolane_guest | Holds a short setup session before you create an account | 7 days |
| kyrolane_ref | Stores a referral code from a ?ref= link so it can be attached when you sign up | 30 days, unless a different period is configured |
| oauth_state | Protects Google or GitHub sign-in against forgery | 10 minutes |
| oauth_redirect | Remembers where to send you after sign-in | 10 minutes |
| email_oauth_state | Protects connecting Gmail or Outlook | 10 minutes |
| email_oauth_user | Ties the mailbox connection to your account during that short flow | 10 minutes |
Analytics
We use Gentlytics to measure pages visited, clicks, outbound links, and form submissions. Form metadata is collected, not field values such as passwords. Gentlytics does not set a cookie and does not use invasive fingerprinting.
Google Analytics and Tag Manager are not loaded, including when their environment values are present, because they set cookies.
We do not show a cookie-consent banner. A banner is for non-essential cookies. We do not set those.
Email open pixels
An open pixel is a tiny image in an email. When the image loads, we can record that the message was opened. It is not a cookie on your browser.
On a job application you send from your own mailbox, the pixel is added only if you turn on open tracking in Settings. The default is off.
On commercial mail (Kyrolane sales mail and agency pitches), a pixel is off for recipients we place in the EU, the UK, or Quebec, and for domains we cannot place, such as .com. For other domains, such as .ca or .us, the pixel is on unless the commercial tracking setting is turned off. You can turn commercial tracking off with that setting. Job-seeker application mail does not follow the commercial rule.
Your choices
- Use your browser controls to block or delete cookies. Blocking essential cookies will sign you out or stop sign-in.
- Leave open tracking off in Settings if you do not want a pixel on your applications.
- Use the unsubscribe link in a commercial message, or the privacy request form, to stop mail you do not want.
Changes
If we start setting a non-essential cookie, we will update this notice and ask for consent where the law requires it, before that cookie is set.
Other documents
- Legal hub — All current documents, with version history.
- Terms of Service — For job seekers using the Kyrolane workspace.
- Partner Terms — For recruitment agencies on the Partner Portal.
- Data Processing Addendum — How we process candidate and client data for agencies.
- Privacy Policy — What we collect, why, and the choices you have.
- Acceptable use — What you may not do with the service.
- Subprocessors — Companies that process personal information for us.
- Responsible AI — How matching and drafts assist, and do not decide.
- Privacy request — Access, export, correction, deletion, or a concern.
- Directory opt-out — Remove a business email from the contact directory.