Cookie Policy
Last updated: October 11, 2026
Current use
WizeCV uses cookies and browser storage for sign-in, session security, requested language, currency and theme preferences, and service operation. Optional Google Analytics 4 (GA4) measures approved public pages and resources only after explicit analytics consent and when configured. Google Tag Manager (GTM) also requires that consent and configuration; all container tags remain blocked. We do not activate advertising tracking.
Optional analytics
Before you accept, we do not load the GA4 or GTM scripts or send their analytics/container requests. After acceptance, configured GA4 sends manual pageviews for approved public pages and published resources. WizeCV disables the pageview sent automatically by its GA4 configuration and supplies manual pageviews; Google signals and advertising personalization signals are disabled in our code. Google's separate Enhanced Measurement settings must also be configured to disable automatic history-based pageviews; those provider-side settings are managed separately. Page paths and page titles use the approved route without query strings or fragments; the page referrer is blank. We do not intentionally send resume text, job descriptions, generated content, names, email addresses, phone numbers, or user/resume IDs. WizeCV-sent pageviews exclude authenticated application, auth, checkout, and payment-return routes. Google may process technical information such as browser/device information and the IP address used to connect to its servers. ad_storage, ad_user_data and ad_personalization remain denied.
Current Google Tag Manager role
GTM currently loads its container only on approved public routes after analytics consent, when a valid container is configured. The empty gtm.allowlist: [] blocks all container tags, triggers and variables, including additional GA4 and marketing tags. GTM does not independently send WizeCV pageviews or change the shared Google consent state. Its loader does not create a separate WizeCV tracking cookie. The allowlist is a tag restriction, not a security sandbox: Google receives the container request, and JavaScript already loaded cannot be unloaded when you withdraw consent or navigate. Our tracking controls stop future WizeCV analytics dispatches and keep the container tags blocked.
Cookies and browser storage
The table describes storage used by the current application. Necessary storage and preferences support the functions you request; they are separate from optional analytics. Cookie expiry is not the same as account or server-record retention. localStorage has no automatic expiry set by WizeCV unless stated; browser clearing or restrictions can remove it earlier. sessionStorage normally lasts for the tab session.
| Name / service | Storage | Purpose / category | Duration and removal |
|---|---|---|---|
| sb-<project-ref>-auth-token; sb-<project-ref>-auth-token-code-verifier; .0, .1, … | Supabase authentication cookies | Necessary: sign-in session and authentication-flow verification. | Installed Supabase SSR cookie defaults allow up to 400 days; refresh, completed authentication flows or sign-out may update/remove cookies earlier. Token and session validity are separate. Cookies use path / and SameSite=Lax and are browser-accessible, not HttpOnly. |
| NEXT_LOCALE; preferred-locale | Cookie; localStorage | Functional preference: selected English or Arabic interface and a local copy of the language choice. | NEXT_LOCALE: session cookie when set by locale middleware; up to one year when set by the language switcher. Path /, SameSite=Lax, browser-accessible. preferred-locale: until replaced or browser storage is cleared. |
| wizecv_currency_preference | Cookie and localStorage | Functional preference: remember the display currency; not a payment authorization. | Cookie: one year, HttpOnly, Secure in production, SameSite=Lax, path /. localStorage: until replaced or cleared; stores only the currency preference. |
| theme | localStorage | Functional preference: remember the selected interface appearance. | Until replaced or browser storage is cleared; no application expiry. |
| wizecv_analytics_consent_v1 | localStorage | Necessary consent preference: granted or denied for Analytics, with no personal identifiers. | Until changed or browser storage is cleared; no automatic expiry or marketing consent. |
| wizecv.session.lastActivityAt; wizecv.session.startedAt; wizecv.session.id; wizecv.session.logout | localStorage | Necessary: session activity timestamps, session identifier, and logout synchronization between tabs. | The first three keys are cleared during sign-out; the logout signal remains until overwritten or browser storage is cleared. Session timeout controls are separate from storage lifetime. |
| wizecv.session.logoutIntent; manual_logout | sessionStorage | Necessary: record an intentional sign-out. | For the tab session or until explicitly cleared. |
| wizecv:operation:v1:<userId>:<feature>:<sourceId|new> | sessionStorage | Necessary: avoid duplicate AI operations on retries. Stores an operation identifier and input hash, not raw content; the key can contain user/source IDs. | Removed on successful completion, release, or certain failed operations; otherwise lasts for the tab session. |
| wizecv_guest_purchase_<purchaseId> | First-party cookie (purchase ID without hyphens) | Necessary: signed, purchase-scoped guest checkout access. | 30 minutes. HttpOnly, Secure in production, SameSite=Lax, path /. |
| _ga; _ga_* | GA4 cookies, only after Analytics consent | Optional Analytics: distinguish visits and maintain analytics session information on approved public pages. | Google documents a default of two years, subject to browser restrictions and provider settings; this is not a verified property-specific retention setting. Withdrawal attempts to remove accessible matching cookies. |
A configured hCaptcha challenge on sign-in, registration, password reset or guest checkout, and the payment interface selected at checkout, may use provider-controlled cookies or storage for security and transaction completion. Supported checkout integrations include Checkout.com, Lemon Squeezy, Tap and Paddle; the configured provider is identified at checkout. Their exact cookie names and durations depend on the provider, environment and browser; they are not represented as a fixed WizeCV cookie list. Analytics withdrawal cannot clear storage on a separate provider origin.
Your choices
You can accept or reject analytics. Rejecting analytics does not block essential WizeCV features. Change or withdraw your choice using Cookie settings here or in the footer. We store only granted or denied under wizecv_analytics_consent_v1 in localStorage; this preference contains no personal identifiers and has no automatic expiry. Changes are synchronized with other open tabs when browser storage events are available. If browser storage is unavailable, the choice applies in this tab and you may be asked again on a later visit. Necessary storage supports the requested service; the current optional choice is Analytics only.
Withdrawing consent
Withdrawal stops future WizeCV analytics dispatches and removes accessible _ga and _ga_* cookies where possible. It does not delete data already received by Google or unload JavaScript already loaded. We do not remove auth, payment, language, currency, or other application storage as part of analytics withdrawal. You can separately clear browser storage, which may sign you out, reset preferences, or interrupt checkout and pending operations. Blocking necessary cookies in your browser may affect essential service functions.
Future marketing and separate consent
Google Ads, Meta Pixel and TikTok Pixel are not active integrations. Marketing is reserved as a separate consent category and remains denied; accepting Analytics never grants Marketing consent. Any future advertising integration requires a separate explicit Marketing choice, an updated storage inventory and policies, and review of public-route and data boundaries before activation. Resume files and text, job descriptions, generated documents, account identity, and purchase details must remain outside advertising events. No marketing cookies or new marketing preference are written by the current consent system.
Questions: support@wizecv.com