Cookie and local-storage policy
- Last updated
- Sections
- 9
- Unresolved
- 8 marked in the text
This is a draft. No lawyer has read it. Every decision still outstanding is marked in the text, and counted at the top of this page.
On this page — 9 sections
In plain language
Crossing sets one cookie. It is the cookie that keeps you signed in. That is the entire list.
There is no analytics, no advertising, no A/B testing, no session replay, no fingerprinting, no tag manager, no pixel, no third-party cookie, and no cookie-consent banner — because there is nothing to consent to beyond the sign-in cookie, which you asked for by signing in.
Four small settings are stored in your browser's local storage — your theme, whether the sidebar is collapsed, your recent command-palette searches, and whether you have seen the apply-queue explainer. Those never leave your browser. Crossing's servers cannot read them.
Two things do reach hosts we don't control, and we would rather name them than let you find them in a network tab: company logos are loaded straight from wherever the job board hosts them, and when you press the button that opens an employer's application form, you are on the employer's site, under their cookie policy, not ours.
1The cookie
| Name | Type | What it is for | How long it lasts |
|---|---|---|---|
rjf_session | First-party, strictly necessary | Keeps you signed in. Without it, every page load would be a fresh sign-in. | 30 days, or until you sign out |
Details worth knowing, because they are the difference between a session cookie that is safe and one that is not:
- The cookie's value is a random session id (24 random bytes) followed by an HMAC-SHA256 signature of that id. The database stores only the id, never the signature or the key, so a copy of the database is not a working cookie.
- It is set
HttpOnly— JavaScript on the page cannot read it, so a cross-site scripting bug cannot simply hand your session to someone else. - It is set
SameSite=Lax— your browser will not attach it to a request another site makes on your behalf. That is the first half of our CSRF defence; the second half is anOrigincheck on every request that changes data. - It is set
Securein production, so it is only ever sent over HTTPS. - Signing out deletes the cookie and deletes the session row from the database. Changing your password deletes every session on the account and issues you one new one, so whoever you changed the password away from is signed out everywhere.
We do not set any other cookie. Not a "preferences" cookie, not a CSRF cookie, not a load-balancer cookie, not a marketing attribution cookie.
2Local storage (stays in your browser)
These are set by the app running in your browser and are never transmitted to us. You can clear them with your browser's "clear site data" control, and the app will just fall back to its defaults.
| Key | What it holds | Why |
|---|---|---|
rjf-theme | light, dark or system | Your theme. Also read by a tiny script in the page head so the page doesn't flash white before dark mode applies. |
rjf-sidebar-collapsed | 1 or 0 | Whether you collapsed the sidebar. |
rjf-command-recent | Your last few command-palette entries | So an empty search box is still useful. These are your own search terms. They stay on your device; delete them by clearing site data. |
rjf.apply.first-run-seen | 1 | Whether you have already seen the one-time explanation of how the apply queue works, so we stop showing it. |
Under EU/UK rules these are "storage on your device" and are treated like cookies. All four are either strictly necessary or a preference you set yourself by using the feature, which is why there is no banner.
3What we do not do
This section is deliberately checkable. If any of it ever stops being true, this page changes first.
- No analytics. No Google Analytics, Plausible, Fathom, PostHog, Mixpanel, Amplitude, Segment, Heap, or self-hosted equivalent. There is no analytics script anywhere in the application.
- No advertising or tracking pixels. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag, no TikTok pixel, no conversion tracking of any kind. Your job search is not advertising inventory, and a list of the roles you looked at is one of the most sensitive lists a person can generate.
- No session replay or heatmaps. Nothing records your mouse, your keystrokes or your screen.
- No A/B testing or feature-flag SDK reporting back to a vendor.
- No fingerprinting. We do not compute a device or canvas fingerprint, and we do not use one as a fallback for cookies.
- No third-party cookies at all, and no consent-management platform (which is itself usually a third-party tracker).
- No cross-site or cross-device tracking, no data brokers, and no sale or sharing of personal information for advertising. We have nothing to sell and nothing to share.
- No ad-supported model. Unresolved: REVIEW: confirm this is a durable commitment before it goes on the site — it is easy to write and expensive to walk back.
Fonts are self-hosted. The typefaces are pulled in at build time and served from our own origin, so loading a page does not tell Google (or anyone else) that you visited.
4The two third-party disclosures we will not bury
Company logos. Job listings carry a logo URL supplied by the board or the employer's applicant tracking system, and the app renders that URL directly. Your browser therefore makes a request to that host — which may be a board's CDN, a company's own server, or an image service — and that host sees your IP address, your browser's user-agent, and the referring page. It may set its own cookies in your browser as part of that request. We do not control those hosts and we do not receive anything from them.
The employer's application page. The core of Crossing is that it never submits anything for you: it prepares the answers and then opens the employer's own application form so you can read it and press Send yourself. The moment that page opens, you are the employer's visitor. Their site and their applicant tracking system will see your IP address and browser, will set their own cookies, and will receive everything you type into their form. That is governed by the employer's privacy notice and cookie policy, not by this one. This is a deliberate trade: an application you can see before it goes is worth more than one we send in the dark.
5Other places state is kept (not cookies, but you should know)
- Saved-search feeds. If you generate an RSS feed for a saved search, its URL contains a long random token instead of requiring a sign-in, because feed readers do not send cookies. Anyone with that URL can read that feed — treat it like a password.
- The apply-assist bookmarklet (currently disabled in the code, so nothing can use it today) is stateless by design: it stores nothing on the employer's page, sets no cookies, and sends nothing back.
- Server-side logs. Your IP address and browser user-agent are recorded on the session row when you sign in. That is the only place an IP address is stored anywhere in the product, and it is deleted when the session is deleted or your account is deleted. Unresolved: REVIEW: at launch, hosting and CDN providers will keep their own request logs; that belongs in the privacy policy's subprocessor section, not here.
6Payments
Billing is off by default. If card payments are switched on, the checkout page is hosted by our payments provider on their own domain, and they will set their own cookies there under their own policy. No card details are ever entered on, or stored by, Crossing. Unresolved: REVIEW: name the provider here once billing is live — the code integrates Stripe Checkout.
7Your controls
- Sign out — deletes the session cookie and the session record.
- Clear site data in your browser — removes the cookie and all four local-storage keys.
- Block cookies for this site — everything still renders, but you will not be able to stay signed in, because the sign-in cookie is the mechanism of being signed in.
- Do Not Track / Global Privacy Control — we honour them by construction: there is no tracking to switch off, and no sale or sharing of personal information to opt out of. Unresolved: REVIEW: CCPA/CPRA — confirm with counsel that "we do not sell or share" is accurate under the statutory definitions, given the logo hot-linking described above.
- Delete your account — in Settings. It removes your data, including every session.
8Changes
If Crossing ever adds a cookie or a third-party script, this page will be updated before that change ships, and the "Last updated" date at the top will change with it. If a change ever requires consent, you will be asked for it rather than opted in.
Who to ask
Questions about this page: Unresolved: REVIEW: contact address
Who "we" is: Unresolved: REVIEW: legal entity name and registered address