Cookie Policy
Version: 1.0
Effective Date: To be updated before public launch
Platform: Diplotix
Contact: support@diplotix.com
Diplotix is currently a pre-launch / beta hiring platform. This Cookie Policy explains how Diplotix uses cookies and similar browser storage technologies.
For more detail about how Diplotix collects, uses, shares, and retains information, please review the Privacy Policy.
Contact us at support@diplotix.com for questions about this Cookie Policy.
1. Introduction
Cookies are small text files stored on your browser or device when you visit a website. They can help a website remember that you are signed in, keep a session working, complete a payment or sign-in flow, remember a preference, or support security and fraud-prevention features.
Similar technologies include local storage and session storage. These are browser storage areas that can remember information on your device. Unlike cookies, local storage and session storage are not automatically sent with every web request, but they can still be used by the application running in your browser.
This policy uses "cookies" broadly where helpful, but separates cookies from local storage and session storage where the current product uses them differently.
2. Scope
This Cookie Policy applies to Diplotix websites, workspaces, portals, dashboards, and related browser-based services, including:
diplotix.com.- The recruiter portal and recruiter dashboard.
- The candidate portal and candidate dashboard.
- The partner portal.
- The admin portal.
This policy covers cookies and browser storage used by Diplotix and by third-party services that support authentication, payments, diagnostics, referral attribution, and other platform operations.
3. Cookie Categories
Essential Cookies
Essential cookies are needed for core product functions. If you block them, parts of Diplotix may not work.
Current essential-cookie uses include authentication, session continuity, security, routing after sign-in, workspace selection, subscription checkout, and partner referral attribution.
| Cookie or category | Current use | Notes |
|---|---|---|
| Supabase authentication/session cookies | Keep users signed in, refresh sessions, and support authentication through Supabase. | Exact cookie names and durations can vary by Supabase configuration and must be runtime-verified before publication of a detailed cookie table. |
diplotix:roleIntent and roleIntent | Remember whether a sign-in or sign-up flow is intended for a candidate or recruiter. | Current code sets these for a short sign-in helper window. |
diplotix:continueTo and continueTo | Remember the in-product path to continue to after authentication. | Current code sets these for a short sign-in helper window. |
active_workspace_id | Helps recruiter workspace flows remember the selected workspace where used. | Current code reads this as a browser cookie. Runtime verification should confirm where and how it is set in production. |
diplotix_partner_referral | Stores partner referral attribution data after a user visits a partner referral link. | Current implementation uses a 90-day referral window. |
diplotix_partner_visitor | Stores a partner referral visitor identifier used with referral attribution. | Current implementation uses a 90-day referral window. |
| Payment-provider cookies | Support Razorpay or Stripe checkout, billing portal, payment verification, fraud checks, and payment-session continuity. | These cookies are controlled by the payment provider during payment flows. |
| Google OAuth cookies | Support optional Google sign-in where a user chooses that flow. | These cookies are controlled by Google. |
Authentication Cookies
Diplotix uses Supabase for authentication. Supabase authentication/session cookies are used to keep users signed in, refresh sessions, and support secure account access.
Diplotix also uses short-lived role and continue-path helper cookies during sign-in and onboarding flows:
diplotix:roleIntentroleIntentdiplotix:continueTocontinueTo
These helper cookies are used to complete the requested sign-in or onboarding flow. They are not advertising cookies.
Session Cookies
Session-related cookies and storage help Diplotix:
- Keep users signed in.
- Restore the intended destination after authentication.
- Remember the selected recruiter workspace where applicable.
- Complete OAuth, subscription, billing, and partner referral flows.
Provider session cookies may also be used by Supabase, Google OAuth, Razorpay, and Stripe during the flows they operate.
Security Cookies
Security-related cookies and storage may be used to:
- Verify authenticated sessions.
- Reduce unauthorized access.
- Support account and workspace access checks.
- Support checkout and payment security.
- Support fraud-prevention and referral-abuse review.
- Support diagnostics and abuse investigation.
Diplotix does not publish detailed security-control internals in this policy because doing so could weaken platform security.
CSRF Cookies
The audited product does not show a clearly named first-party CSRF cookie. Some frameworks, authentication providers, payment providers, or OAuth providers may use tokens or cookies for request protection during selected flows.
This needs engineering verification before Diplotix publishes a detailed cookie table with exact names and durations.
Load Balancing Cookies
No clearly named first-party load-balancing cookie was verified in the audited product.
Hosting, infrastructure, payment, authentication, or provider systems may use load-balancing or routing technologies outside the application code. The specific production hosting provider and live cookie behavior should be verified before public launch.
Preference Cookies
Preference cookies remember choices that make the product easier to use. In the audited product, most verified preference-like behavior is implemented through local storage or session storage, not clearly named first-party preference cookies.
| Preference area | Current implementation status |
|---|---|
| Language | No general language preference cookie was verified in the audited product. Candidate profile language fields are profile data, not browser language cookies. |
| Theme | No general theme preference cookie was verified in the audited product. Razorpay checkout may receive theme configuration, but that is not a Diplotix preference cookie. |
| UI preferences | Some UI preferences are stored in local storage or session storage, such as job filters, saved recruiter job views, recent searches, and flow helpers. |
Diplotix may introduce additional preference cookies in the future. If that happens, this policy will be updated.
Analytics Cookies
Diplotix does not currently operate a verified dedicated web analytics cookie system such as Google Analytics, Meta Pixel, Hotjar, or Microsoft Clarity in the audited product.
The product does include some usage and event tracking, including:
- Company profile event tracking.
- Search and activity events stored by the platform.
- Partner referral events.
- Sentry diagnostics and error monitoring where configured.
Some of this uses server-side records, local storage, or session storage rather than dedicated analytics cookies. Sentry or other providers may use cookies or similar technologies depending on configuration and browser behavior, so provider behavior should be runtime-verified.
If Diplotix introduces non-essential analytics cookies in the future, this policy will be updated and consent mechanisms will be implemented where legally required.
Marketing Cookies
No dedicated marketing cookie system was verified in the audited product.
Diplotix does not currently claim to use advertising trackers such as Google Analytics advertising features, Meta Pixel, Hotjar, Microsoft Clarity, or similar marketing pixels in the audited product.
Partner referral cookies are used for referral attribution, not general advertising retargeting. Partner referral and attribution behavior may still have legal and consent implications and should be reviewed before public launch.
If marketing cookies are introduced in the future, this policy will be updated and consent mechanisms will be implemented where legally required.
4. Local Storage
Diplotix uses local storage and session storage in the browser for some product flows and preferences.
Local storage can remain on your browser unless it expires through product logic, is removed by the product, or is deleted through your browser settings. Session storage is usually cleared when the browser tab or session ends, depending on browser behavior.
Current verified local storage examples include:
| Storage key or category | Current use | Retention notes |
|---|---|---|
diplotix:roleIntent and roleIntent | Remember candidate or recruiter role intent during sign-in and onboarding. | Cleared after the relevant auth flow where the product does so. |
diplotix:continueTo and continueTo | Remember the path to continue to after authentication. | Cleared after the relevant auth flow where the product does so. |
diplotix_attr_* | Stores candidate job attribution source for invite or recommendation links. | Current code uses a 30-day TTL and removes expired entries when read. |
| Job feed filters | Remembers job search and filter choices. | Exact key and retention should be runtime-verified before a detailed public table. |
| Recruiter saved job views | Remembers recruiter job-table saved views. | Exact key and retention should be runtime-verified before a detailed public table. |
| Recruiter recent searches | Remembers recent recruiter search terms. | Exact key and retention should be runtime-verified before a detailed public table. |
| Recently viewed jobs | Remembers recently viewed job records in the browser. | Exact retention should be runtime-verified before a detailed public table. |
Current verified session storage examples include:
| Storage key or category | Current use | Retention notes |
|---|---|---|
ijobs_company_profile_session_id | Anonymous company profile event session identifier. | Stored for the browser session. The ijobs prefix appears in current code and should be reviewed if the brand naming is updated. |
ijobs_company_profile_viewed:* | Avoids repeatedly sending the same company profile view event in one browser session. | Stored for the browser session. |
| Recruiter onboarding draft state | Stores recruiter onboarding state during the browser session. | Stored for the browser session. |
| Exit-intent offer state | Tracks whether a marketing/contact offer was shown during a browser session. | Stored for the browser session. |
5. Third-Party Technologies
Diplotix uses third-party services to operate the platform. Some of these services may place cookies or use similar technologies when you interact with the flows they support.
| Service | Current role | Cookie or similar technology notes |
|---|---|---|
| Supabase | Authentication, database, storage, server-side access, and row-level access controls. | Supabase authentication/session cookies are essential for login and account access. Exact names and durations depend on configuration. |
| Google OAuth | Optional Google sign-in. | Google may use cookies or similar technologies during OAuth sign-in. This applies only when you use Google sign-in or otherwise interact with Google-controlled flows. |
| Razorpay | INR subscription checkout, payment verification, and billing webhooks. | Razorpay may use cookies or similar technologies during checkout and payment flows for session, security, fraud prevention, and payment completion. |
| Stripe | Checkout, billing portal, webhooks, and subscription sync. | Stripe may use cookies or similar technologies during checkout, billing portal, fraud prevention, and payment flows. |
| Sentry | Error monitoring and diagnostics where configured. | Sentry may process diagnostic information and may use cookies or similar technologies depending on configuration. Runtime verification is required for exact browser behavior. |
| OpenRouter | Recruiter-facing AI decision-support provider. | Current OpenRouter use is server-side for recruiter AI features. No OpenRouter browser cookie was verified in the audited product. |
| Resend | Transactional and notification email delivery. | Resend is used for email delivery. No Resend browser cookie was verified in the audited product. |
Third-party providers may change their cookie names, durations, security practices, or browser behavior. Diplotix should perform a runtime cookie audit before public launch and after major provider changes.
6. Managing Cookies
You can manage cookies through your browser settings. Most browsers let you:
- View cookies and site data.
- Delete cookies and browser storage.
- Block some or all cookies.
- Block third-party cookies.
- Clear local storage and session storage.
- Use private or incognito browsing modes.
Your browser controls may affect both Diplotix cookies and cookies set by third-party providers during sign-in, checkout, or other flows.
If you delete cookies, you may be signed out and may need to sign in again. If you block cookies or browser storage, some parts of Diplotix may not work correctly.
Diplotix does not currently provide a full cookie preference center in the audited product.
7. Essential Services
Disabling essential cookies or required browser storage may prevent or disrupt:
- Login and session management.
- Email magic-link, OTP, or OAuth sign-in flows.
- Candidate dashboard access.
- Recruiter dashboard access.
- Partner portal access.
- Admin portal access.
- Subscription checkout and billing portal flows.
- Payment verification and fraud-prevention checks.
- Security checks and account access controls.
- Partner referral tracking and attribution.
- Workspace selection and onboarding continuation.
Some provider-controlled flows, such as Google OAuth, Razorpay checkout, and Stripe checkout or billing portal, may not work if third-party cookies or storage are blocked.
8. Future Analytics
Diplotix may introduce additional analytics, measurement, product-experiment, or marketing cookies in the future.
If non-essential analytics or marketing cookies are introduced, Diplotix will update this Cookie Policy and implement consent mechanisms where legally required.
Diplotix should not claim that a consent banner, consent-management platform, or cookie preference center exists until that functionality is implemented and verified.
9. Policy Updates
We may update this Cookie Policy as the product, providers, cookies, browser storage, legal requirements, or business operations change.
If we make material changes, we will update the version or effective date and may provide notice through the website, product, email, or another reasonable method.
10. Contact
For cookie, privacy, support, or legal questions, contact:
Diplotix
Email: support@diplotix.com