Cookie Policy

1. What Are Cookies & Why We Mostly Don't Use Them

Traditional HTTP cookies are small text files stored by your browser that websites read on subsequent visits. Many websites use cookies for advertising, cross-site tracking, and analytics.

InterviewSeason takes a different approach. Our application is built as a stateless, token-authenticated SPA (Single Page Application). Instead of traditional cookies, we rely on browser local storage and session storageto maintain your session. This means no cookies are set by InterviewSeason's web application for authentication or tracking purposes.

2. Storage We Use

The following table describes all browser storage we use:

All storage entries listed above are strictly necessary for the service to function. We do not set any storage for advertising, cross-site tracking, or analytics profiling.

3. Authentication — How It Works

When you sign in, Supabase issues a short-lived JWT access token and a longer-lived refresh token. These are stored in localStorage under keys prefixed with sb-.

• The access token is sent in the Authorization: Bearer header on every API request — not in a cookie
• The refresh token is used by Supabase to silently issue a new access token when it expires
• Signing out removes both tokens from local storage immediately
• Because there is no authentication cookie, InterviewSeason is not vulnerable to cross-site request forgery (CSRF) attacks of the type that affect cookie-based authentication

4. Chrome Extension Storage

The InterviewSeason Chrome extension (Manifest V3) uses the Chrome Extension Storage API, which is separate from your browser's website localStorage. The extension stores:

• Your authentication token (to authenticate extension API calls to our backend)
• Extension settings and state (e.g. whether the extension panel is expanded)
• Temporary job capture data before it is submitted to the backend

Extension storage is isolated: websites (including interviewseason.com) cannot read or write to it, and the extension cannot read your website localStorage. This provides a strong security boundary.

You can clear extension storage by removing and reinstalling the extension, or by signing out from within the extension popup.

5. What We Do Not Do

• We do not set third-party advertising cookies
• We do not use tracking pixels, web beacons, or fingerprinting scripts
• We do not embed third-party social media widgets that track you (e.g. Facebook Like buttons, Twitter embeds)
• We do not use Google Analytics, PostHog, Mixpanel, or similar third-party analytics trackers on the main application (interviewseason.com)
• We do not honour or disregard browser Do Not Track (DNT) signals because we do not perform any tracking that DNT would opt you out of

6. Push Notification Service Worker

If you opt into browser push notifications, InterviewSeason registers a Service Worker in your browser. This service worker:

• Runs in the background to receive push messages from our server
• Does not track your browsing activity on other websites
• Does not set any cookies
• Can be removed by revoking notification permissions in your browser settings, which will also unregister the service worker

7. How to Control Storage

Because we use browser local storage rather than cookies, standard cookie controls (e.g. browser cookie settings, cookie consent banners) do not apply. However, you have full control:

Clearing local storage

You can clear all InterviewSeason local storage data via your browser's developer tools (Application → Local Storage → interviewseason.com → Clear) or by clearing your browser data. This will sign you out of InterviewSeason.

Signing out

Signing out via the InterviewSeason UI removes all authentication tokens from local storage immediately.

Revoking push notifications

Go to your browser's site settings for interviewseason.com and revoke the Notifications permission. This will deregister the push subscription from our servers automatically on your next visit.

8. Jurisdiction-Specific Notes

India

Under the Digital Personal Data Protection Act 2023 (DPDPA), browser storage used for strictly necessary purposes (authentication and core functionality) does not require separate consent beyond account creation. We do not use any storage for purposes beyond what is necessary to provide the service.

European Economic Area / UK (note)

Although InterviewSeason does not currently market to EEA/UK users, we note that our use of local storage for strictly necessary functionality falls within the "strictly necessary" exemption under the ePrivacy Directive (EU Cookie Law) and does not require a cookie consent banner.

United States — California

We do not engage in cross-context behavioural advertising and do not share any data stored in browser local storage with third parties for advertising. California residents' rights under CCPA are addressed in our Privacy Policy.

Canada

Under CASL and PIPEDA, our use of local storage is limited to functional purposes for which consent is implied by your use of the service. No marketing or tracking storage is deployed.

Australia

Our local storage practices are consistent with the Australian Privacy Principles (APP 1 — open and transparent management of personal information). The data stored locally does not constitute a "collection" of personal information under the Privacy Act 1988 as it remains on your device and is not transmitted to third parties.

9. Changes to This Policy

If we introduce any new storage practices — including traditional cookies — we will update this policy and notify you at least 14 days in advance. We commit to maintaining a no-advertising-cookies policy as a core principle of InterviewSeason.

10. Contact

For questions about this Cookie Policy: