Cookie Policy
Last updated: 11 September 2026
This policy explains the cookies and browser storage that ResmiAI uses. There are two groups. The first is strictly necessary: session storage that keeps you signed in, plus transient cookies that protect the sign-in redirect. The second is optional measurement: Google Analytics 4, which tells us which pages and features are actually used so we can improve them. We use no advertising, retargeting or cross-site tracking cookies.
1. What we use and why
Session state is kept in your browser’s local storage rather than in tracking cookies, which means it is scoped to this site and is never sent to third parties. These items are strictly necessary: without them you cannot stay signed in.
| Item | Type | Purpose | Duration |
|---|---|---|---|
aicv_access | Browser storage (localStorage) | Holds your short-lived access token so authenticated requests can be sent to the API. | Until you sign out or the token expires. |
aicv_refresh | Browser storage (localStorage) | Holds the refresh token used to obtain a new access token without signing in again. Rotated and revoked server-side on sign-out. | Until you sign out, revoke the session, or it expires. |
aicv_user | Browser storage (localStorage) | Caches your basic profile (name, email, avatar, onboarding state) so the interface can render instantly. Never used for advertising. | Until you sign out or clear it. |
OAuth correlation cookies | First-party cookies | Set transiently by the Google/LinkedIn sign-in handlers to protect the sign-in redirect against tampering. Not readable by scripts. | Removed automatically when sign-in completes. |
2. Measurement cookies (Google Analytics 4)
We measure how the service is used with Google Analytics 4 (measurement ID G-JM3XX8T3B9). The measurement runs entirely through Google’s own script; we do not create our own visitor identifier, and we keep no analytics profile of you in our own systems.
| Item | Type | Purpose | Duration |
|---|---|---|---|
_ga | Analytics cookie (first-party, set by Google Analytics 4 on our domain) | Distinguishes one browser from another so visits and sessions can be counted in aggregate. It is not an advertising identifier and it is never shared with advertisers or data brokers. | Up to 2 years (Google Analytics 4 default). |
_ga_<container-id> | Analytics cookie (first-party, set by Google Analytics 4 on our domain) | Keeps the measurement session state for our property (measurement ID G-JM3XX8T3B9), including which campaign or referring site brought you here. | Up to 2 years (Google Analytics 4 default). |
What the measurement records
- Which pages you visit and how you moved between them, with the page title.
- How you arrived — referring site, search engine or campaign parameters such as utm_source and utm_campaign.
- Coarse technical context: device type, browser, language and approximate region derived from your IP address (Google Analytics 4 does not store your IP address).
- Aggregate product milestones: that an account was created or signed in to, that a profile was completed, that a CV or cover letter was generated, that an ATS check ran, that pricing was viewed or that a subscription started — always as a category or a score band.
- Anonymous visitors are counted without any identifier created by us.
- When you are signed in, your account’s opaque internal ID is used so the same account is recognised across sessions and devices. It cannot be used to identify you outside ResmiAI.
What is never sent
Your career documents are the most sensitive thing you give us, so they are excluded from measurement by design — enforced in code, not just in policy.
- Your email address, name, phone number or address.
- Your CV or resume text, cover letters, job descriptions or uploaded file names.
- Passwords, access or refresh tokens, or any sign-in credential.
- The prompts sent to or the responses returned by our AI providers.
- Payment details, card data, billing address or Stripe identifiers.
3. Third-party cookies
The only third-party cookies you may encounter come from our payment provider, and only if you choose a paid plan.
| Item | Type | Purpose | Duration |
|---|---|---|---|
| Stripe payment cookies | Third-party cookies (on Stripe’s own domain) | Set only when you open the Stripe-hosted checkout or billing portal, to process a payment securely and prevent fraud. We never set these ourselves and we never see your card data. | Per Stripe’s policy for the checkout session. |
4. What we do not use
- Advertising, retargeting or remarketing cookies — ResmiAI is an ad-free service.
- Cross-site tracking pixels, advertising identifiers or social-media trackers.
- Behavioural profiling or audience-segmentation cookies — measurement is limited to aggregate usage statistics.
- Data-broker cookies, or the sale of any measurement data.
5. Your choice about measurement
Under the ePrivacy Directive and the GDPR, strictly necessary storage such as your sign-in tokens does not require consent — without it you simply could not stay signed in. The Google Analytics 4 cookies described in section 2 are not strictly necessary: they are the only optional storage we use, and they are limited to aggregate usage statistics with no advertising, profiling or data selling behind them.
You can refuse or remove them at any time, and the service keeps working exactly the same:
- Block or delete cookies for
resmiai.comin your browser’s privacy settings. - Use Google’s official Google Analytics opt-out browser add-on.
- Use a content or privacy blocker that blocks
googletagmanager.com— if that script cannot load, no measurement happens at all. - Send a request to [email protected] and we will erase the measurement data associated with your account.
Because we never use this data for advertising, retargeting or profiling, it does not affect what you see in the product or what you pay.
6. Managing or clearing storage
- Signing out removes your stored tokens and cached profile from the browser.
- You can clear local storage at any time through your browser’s privacy settings; doing so simply signs you out.
- Blocking first-party storage generally prevents sign-in, because the session cannot be maintained without it.
- Stripe’s cookies are controlled on Stripe’s own domain, in line with their policies.
7. Changes and contact
If we introduce a new cookie or storage item, we will update this page and, where required, ask for your consent first. Questions about this policy or about the measurement we run? Email [email protected].