Cookie Policy
Last updated: 10 August 2026
This Cookie Policy explains how Mentum uses cookies, localStorage, sessionStorage, and IndexedDB on your device. It is written to satisfy the UK Privacy and Electronic Communications Regulations 2003 (PECR) Reg. 6, the UK GDPR, and the Information Commissioner's Office (ICO) 2023 guidance on the use of cookies and similar technologies. The audit-grade master record, including file-and-line citations into our codebase, is published at docs/legal/cookies.md in our repository.
1. Who We Are
Mentum ("we", "us", or "our") is the data controller for any personal data linked to the storage described in this policy.
- Contact email: privacy@mentumjobs.com
- Data Protection Officer (de facto): dpo@mentumjobs.com — Mentum has not designated a formal DPO under UK GDPR Art. 37; this alias routes to the operator. See /contact for the canonical contact reference
2. What This Policy Covers
PECR Reg. 6 regulates any storage on, or access to, your terminal equipment — not only HTTP cookies. This policy therefore covers four classes of similar technology used by Mentum:
- HTTP cookies — small pieces of data sent in response headers and returned by your browser on later requests.
- localStorage — persistent key/value storage kept by your browser across sessions.
- sessionStorage — per-tab key/value storage that is cleared when you close the tab.
- IndexedDB — a structured client-side database scoped to our origin.
Where this policy refers to "cookies" generically, the rule applies to all four technologies unless the context makes clear that only HTTP cookies are meant.
3. The Categories We Use
| Category | Consent required? | What it means | Status at Mentum |
|---|---|---|---|
| Strictly necessary | No — exempt under PECR Reg. 6(4) | Essential to deliver the service you have explicitly requested: logged-in session, beta-gate access, offline queue, and the consent record itself. | In use; cannot be disabled. |
| Preferences (functional) | Not where the storage is set in direct response to a choice you make (ICO "user-set preferences" guidance); disclosed for transparency | Remembers a setting you chose: sidebar state, theme, dismissed prompts. | In use; you control these by changing the preference in-app or clearing browser storage. |
| Analytics | Yes — prior opt-in consent | Measures usage to help us improve the product. | Toggle in the consent banner. Default off. See § 5. |
| Marketing / advertising | Yes — prior opt-in consent | Tracks behaviour across sessions to deliver advertising or measure campaigns. | Not in use. Mentum runs no advertising network or remarketing pixel, so the consent banner offers no marketing control. If this ever changes we will re-prompt for opt-in consent first. |
4. Full Inventory
HTTP cookies
| Name | Purpose | Party | Duration | Category |
|---|---|---|---|---|
sb-<project-ref>-auth-token (and chunked variants .0, .1, …) | Keeps you logged in. Issued by Supabase Auth via the @supabase/ssr library; rotated on every authenticated request and cleared on logout. Secure, SameSite=Lax. It is not HttpOnly: the @supabase/ssr browser client writes and reads it from JavaScript, so JavaScript running on the page can read it. That trade-off is recorded and accepted in our architecture decision log (ADR-0015); the compensating controls are a strict Content-Security-Policy, sanitised HTML rendering, and short access-token lifetimes. | First-party | Persistent (refreshed automatically; cleared on logout) | Strictly necessary |
hyre_beta_access | Lets invited users through the closed-beta gate after they enter a valid access code. HttpOnly, SameSite=Lax. | First-party | 30 days | Strictly necessary |
sidebar_state | Remembers whether you collapsed or expanded the dashboard sidebar. SameSite=Lax; Secure in production. | First-party | 7 days | Preferences (functional) |
Our Python backend issues zero Set-Cookie headers. Authentication on the API uses an Authorization: Bearer token only, so there is no cookie-based session for our API to maintain.
localStorage
| Key | Purpose | Category |
|---|---|---|
hyre_cookie_consent | Your cookie consent record (version, essential, analytics, marketing, timestamp). This is the consent receipt itself. | Strictly necessary |
hyre_cookie_consent_synced | A versioned confirmation of the most recent consent payload for which every backend channel returned success, used to avoid re-sending unchanged consent on every page load. | Strictly necessary |
hyre_cookie_consent_sync_pending | A bounded retry record for consent channels that have not yet returned success. It is removed once the server record and your local choice are in sync. | Strictly necessary |
hyre_pwa_install_dismissed | Suppresses the "Install Mentum as a PWA" banner once you have dismissed it. | Preferences |
hyre_culture_fit_tab_visited | Marks the Culture Fit tab as visited so the "new feature" badge is not shown again. | Preferences |
hyre_dismissed_tips | IDs of feature-discovery tips you have dismissed. | Preferences |
theme | Your light / dark / system theme preference, written by next-themes. | Preferences (user-set) |
sb-<project-ref>-auth-token | A browser-side cache of the Supabase session, mirrored from the cookie above. Lets the SDK rehydrate your session without a server round-trip. | Strictly necessary |
sb-<project-ref>-auth-token-code-verifier | Used during OAuth sign-in with Google or LinkedIn as the one-shot PKCE verifier. Cleared as soon as the OAuth callback completes. | Strictly necessary |
mentum.nav.institution-enrolled | Remembers whether your account is enrolled with an institution, so the Institution item in the sidebar can render immediately instead of flickering in after the data loads. | Preferences |
mentum.scroll-offsets | Session-only. Records how far down a list you had scrolled, keyed by an opaque history entry id, so pressing Back returns you to the row you were reading instead of the top of the page. Holds nothing but scroll positions, and is discarded when you close the tab. | Preferences |
hyre.admin-nav.<section> | One key per collapsible admin sidebar section, recording whether you left it open or closed. Administrator accounts only. | Preferences |
hyre_employer_get_started_dismissed | Suppresses the employer "Get started" checklist card once you have dismissed it. | Preferences |
hyre_adviser_get_started_dismissed | The same, for the careers-adviser dashboard. | Preferences |
hyre_get_started_redirected | Records that we have already sent you to the Get Started flow once, so we never redirect you there a second time. | Preferences |
hyre_candidate_onboarding_step | Remembers the next incomplete Get Started step so the "Continue where you left off" action resumes your guided setup instead of restarting it. | Preferences |
hyre_candidate_onboarding_draft | Holds the Get Started answers you have given but not yet saved, so reloading the page mid-setup does not throw them away. Cleared when setup finishes. | Preferences |
hyre_mailbox_banner_dismissed | Suppresses the "confirm your email address" banner once you have dismissed it. | Preferences |
hyre_matches_no_radius_hint_dismissed | Suppresses the hint about widening your search radius on the Matches page once you have dismissed it. | Preferences |
hyre_career_hub_last_seen | Remembers the Career Hub figures you last saw (skill names and counts only) so the hub can say what changed since your last visit. Never sent to our servers; cleared with your site data. | Preferences |
hyre_employer_verify_prompt_dismissed | Suppresses the "verify your company" prompt on the employer dashboard once dismissed. | Preferences |
hyre_cv_freshness_nudge_dismissed | Suppresses the "your CV is getting old" nudge once dismissed. | Preferences |
hyre_chat_safety_ack | Records that you have acknowledged the chat safety notice, so it is shown once rather than on every conversation. | Preferences |
hyre_apply_followup_dismissed | IDs of apply-follow-up reminders you have dismissed. | Preferences |
hyre_job_alert_optin_prompted | Timestamp of when we last offered you job-alert notifications, so we do not ask again. | Preferences |
sessionStorage
| Key | Purpose | Category |
|---|---|---|
hyre_match_refresh_last_trigger | Five-minute cooldown stopping the dashboard from triggering a full match recompute on every visit. | Strictly necessary |
hyre_precompute_last_trigger | Cooldown for the fast precompute path. | Strictly necessary |
hyre_reconsent_<priv>_<tos> | Per-tab marker so that once you acknowledge a new policy version we do not show the re-consent modal again within the same tab. | Strictly necessary |
hyre.cv-save-warning.v1 | Keeps a per-tab warning visible when your profile details were saved but a replacement CV file was not, until you retry the upload or dismiss the warning. | Strictly necessary |
hyre_uat_draft (internal testing builds only) | Holds an in-progress issue report from the in-app feedback panel, so closing the panel by mistake does not lose what you had written. Cleared once the report is sent. | Strictly necessary |
sentryReplay* / sentryReplaySession (only when an error has fired) | Sentry's on-error session-replay integration buffers recent DOM activity so an error captured 30 seconds in still has 30 seconds of replay context. See § 6 for our Sentry classification. | Strictly necessary (service security and reliability) |
IndexedDB
| Database | Purpose | Category |
|---|---|---|
hyre-offline-queue | Queues mutations (e.g. saving a job, sending a chat message) made while you are offline, and replays them when connectivity is restored. | Strictly necessary |
5. How Consent Works
A consent banner appears the first time you visit Mentum. It explains that we only use essential cookies, and offers one optional preference under "Manage Preferences" — product analytics (default off). There is no marketing choice because we use no marketing technology (see § 3).
When you make a choice we store the record on your device under hyre_cookie_consent. If you are signed in we also send the same payload to our backend (see § 7) so that we have an audit record of your consent.
What Analytics actually controls today. If you accept Analytics, your in-app interactions (page views, match interactions) are sent to our backend for product analytics. If you reject Analytics, no events are sent. There is no third-party analytics destination today; the events go only to Mentum.
Why there is no Marketing toggle. There is nothing to consent to: Mentum runs no advertising network, no remarketing pixel, and no third-party ad-tech tag. If we ever introduce one, we will update this policy and ask for your opt-in consent before placing it on your device.
6. Third Parties That May Set Storage
Sentry (error monitoring)
We use Sentry to detect and diagnose runtime errors. When an error happens, Sentry uploads a short replay of the preceding seconds of DOM activity so that we can reproduce the bug. Before transmission we apply a server-side filter that strips email addresses, phone numbers, and authentication headers from the event. Sentry does not continuously record sessions; replays are captured only on errors.
Sentry stores a short-lived buffer in your browser's sessionStorage (the sentryReplay* keys listed above). It does not set HTTP cookies on Mentum's origin.
Our position is that this storage is strictly necessary under PECR Reg. 6(4)(b), because reliable error monitoring is a load-bearing security and service-quality control without which we could not honour our obligations under UK GDPR Art. 32. Sentry is listed as sub-processor #7 on our sub-processor list; their cookie policy is at sentry.io/cookies.
OAuth identity providers (Google and LinkedIn)
If you sign in with Google or LinkedIn, your browser is redirected to the identity provider's domain. Any cookies set during that redirect are first-party cookies of the provider, set on their domain. Mentum only receives the resulting identity assertion when you return.
What we do not use
For the avoidance of doubt, Mentum does not use Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight Tag, Microsoft Clarity, Hotjar, FullStory, Mixpanel, Amplitude, PostHog, Plausible, Segment, Intercom, or any other analytics, advertising, or session-recording tag. If we add any of these in future we will update this policy and re-prompt for your consent before placing them on your device.
7. Server-Side Consent Record
When you are signed in, every consent grant or withdrawal is mirrored to our user_consent table with:
- the consent type (
cookie_essential,cookie_analytics,cookie_marketing), - the version of the policy in force at the time,
- your IP address (captured server-side from the request),
- your User-Agent string (captured server-side),
- the timestamp.
We retain consent records for 7 years from the time of the action, as required to evidence valid consent under UK GDPR Art. 7. Unauthenticated visitors' consent choices are stored only on the device; there is no server-side record because there is no user identity to attach them to.
8. How to Manage or Withdraw Consent
You can change your choices at any time. Withdrawing consent is as easy as giving it.
- Cookie Settings button: available in the footer of every public page and in the footer of the dashboard once you are signed in. Clicking it opens the cookie settings dialog, where you can review your current choices and change the product-analytics preference. You can dismiss it (Escape, the close button, or a click outside) without changing anything. Signed-in users' saved changes are also recorded server-side.
- Cookie consent banner: the banner reappears for every user whenever we bump our internal consent-version number, so that material changes always require a fresh choice.
- Browser settings: you can block or delete cookies and other storage through your browser. Note that blocking strictly-necessary storage will prevent Mentum from working — you will be logged out and the offline queue, beta-gate, and consent record will be reset.
Browser-specific instructions:
9. Updates to This Policy
When we make a material change to this policy — for example, adding a new analytics processor or changing a retention period — we will update the "Last updated" date at the top of this page, bump our internal consent version so the banner reappears for everyone, and (for signed-in users) notify you by email and in-app. Editorial changes that do not affect the inventory (typo fixes, link rewrites) update the date but do not re-prompt for consent.
10. Contact and Complaints
Questions about this policy or how we handle cookies and similar technologies:
- Email: privacy@mentumjobs.com (data protection); dpo@mentumjobs.com (DPO)
If you are not satisfied with our response, you have the right to complain to the UK supervisory authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
We ask that you contact us first at privacy@mentumjobs.com so we can try to resolve your concern directly.
Related: Privacy Policy | Terms of Service | Sub-processors