Cookie Policy

This policy explains how RaetOS uses cookies and browser storage for login, security, preferences, and the browser extension.

Effective: October 4, 2026RaetOSprivacy@raetos.com

Plain-English Summary

  • RaetOS uses essential cookies for login, session refresh, CSRF protection, and bot protection.
  • Browser storage can hold sign-in tokens, preferences, and cached Master Resume conversations. Extension storage holds connection details and local capture history.
  • Google and Microsoft may set their own cookies during sign-in. RaetOS does not control those provider cookies.
  • RaetOS does not currently use third-party advertising cookies or cross-site ad tracking.
  • Clearing the extension sent board only clears local browser state. It does not delete jobs already sent to My Queue.
  • Signing out removes local sign-in tokens, but does not clear every preference or cached conversation. Clear site data on a shared device.

1. Overview

Cookies are small values stored by your browser. Browser storage, such as local storage and Chrome extension storage, stores application state on your device. RaetOS uses these technologies to keep the app signed in, protect auth flows, remember preferences, and support extension workflows.

Sign-in and security cookies support authenticated features. Preference storage remembers choices you make. RaetOS does not currently provide a cookie preference banner or optional advertising-cookie controls. Browser settings let you manage site data.

2. Cookies We Use

Name
Purpose
token
Access token cookie used to authenticate protected requests. It is configured as HttpOnly, Secure where enabled, and SameSite according to the deployed auth configuration.Stored in: Browser cookie
refresh_token
Refresh token used to keep your session active. The server stores a hashed version so the raw refresh token is not stored directly in the database.Stored in: Browser cookie
csrf_token
CSRF protection token used to help confirm state-changing requests come from the RaetOS app flow.Stored in: Browser cookie
mfa_trust
Remembers a browser you explicitly trust during multi-factor authentication. HttpOnly cookie with a 30-day lifetime; trust can expire or be revoked earlier.Stored in: Browser cookie

These are the default RaetOS cookie names; deployment configuration can rename them. With Remember me, the access cookie has a 15-minute lifetime and refresh/CSRF cookie lifetimes follow the configured refresh period. Without Remember me, access and refresh cookies are session cookies. Browser session restoration can preserve session cookies. Refreshing a session can renew cookie lifetimes; a stored cookie does not guarantee that a server session is still valid.

3. Browser Storage

RaetOS also uses local browser storage. Unlike cookies, local storage is not sent with every web request by default.

Name
Purpose
access_token / refresh_token
Sign-in tokens used as an API fallback in supported authentication flows, including remembered sign-in. Local storage is readable by app JavaScript, unlike HttpOnly cookies. Tokens can remain stored after their server validity expires.Stored in: localStorage
raetos-theme
Stores your selected theme preference, including system-default behavior where supported by the app.Stored in: localStorage
raetos_sidebar_collapsed / dismissed_announcements
Remembers sidebar layout and announcements you dismissed.Stored in: localStorage
raetos_timezone_synced
Stores the last timezone sent to RaetOS so a normal page load does not send it again.Stored in: localStorage
raetai-chat-[role ID]
Caches Master Resume conversation messages for a selected work experience. Can contain career details you typed or AI responses. Signing out does not automatically erase this cache.Stored in: localStorage
active_tenant_id / raetos-space-memberships
Remembers the selected personal or organization space and membership state for navigation. These values do not grant access; the server checks permissions.Stored in: localStorage
raetos-ext-target / raetos-ext-banner-dismissed
Remembers extension-related setup choices or a dismissed extension prompt where used.Stored in: localStorage

Local storage has no automatic expiry unless the app removes an entry. It can remain until you clear site data or your browser removes it. Removing a local cache does not delete saved career records on the server. Closing a tab alone does not clear local storage.

4. Browser Extension Storage

The RaetOS browser extension uses Chrome extension storage to stay connected and track local capture state.

Name
Purpose
accessToken
Extension access token used to send selected job postings to the RaetOS API.Stored in: chrome.storage.local
refreshToken
Extension refresh token used to keep the extension connected until the session expires or is revoked.Stored in: chrome.storage.local
user
Basic signed-in user context displayed inside the extension.Stored in: chrome.storage.local
sentBoard
Local list of postings sent from this browser, used for week/session/sent counts and the popup sent board.Stored in: chrome.storage.local
dismissedJobKeys
Local list of job pages dismissed or marked not interested so the floating panel does not keep reappearing for that posting.Stored in: chrome.storage.local
apiEnvironment
Extension environment selection used to point the extension at the correct RaetOS API.Stored in: chrome.storage.local
extensionTheme / isFirstInstall
Remembers the extension theme and whether first-install setup is needed.Stored in: chrome.storage.local

Clearing the local sent board resets this browser's local counts and board view. It does not remove postings already saved to your RaetOS account. This action also clears locally dismissed job keys. Extension storage has no automatic expiry; some entries are cleared when you sign out or change accounts. Browser site-data controls and extension storage controls are separate.

5. Third-Party Cookies

Google and Microsoft may set cookies on their own domains when you use social sign-in. Those cookies support their authentication flow and are governed by their own privacy policies.

  • Google sign-in may use Google cookies during OAuth authentication.
  • Microsoft sign-in may use Microsoft cookies during OAuth authentication.
  • Cloudflare processes browser and network signals for bot checks on protected forms, including Contact. Cookie behavior depends on the deployed Cloudflare configuration.
  • RaetOS does not request Gmail or Outlook mailbox access through these sign-in flows.

Cloudflare documents a cf_clearance cookie for challenges and Turnstile pre-clearance when enabled. We have not confirmed pre-clearance is enabled for RaetOS, so this is not a confirmed inventory of cookies on your device. See Cloudflare's pre-clearance documentation and its Turnstile privacy policy.

Provider sign-in cookies follow the Google privacy policy or Microsoft privacy statement. Clearing RaetOS site data does not clear cookies on those providers' domains.

An older standalone public page also includes PostHog analytics. When that page is opened, the script can collect page and interaction events and use cookies and local storage for visitor or session identifiers. It is not loaded by the main app layout. Its current live collection settings have not been verified. See PostHog's browser storage documentation.

6. Your Controls

  • You can clear RaetOS cookies and site data from your browser settings.
  • You can clear extension local state from the extension popup where supported, including the local sent board.
  • If you block essential cookies, login and authenticated app features may stop working.
  • Sign out of the web app or extension to remove local sign-in tokens. Preferences and cached content can remain; clear site or extension data separately on a shared device.
  • Review or revoke sessions and forget trusted browsers from Settings. Revocation stops server access but does not remotely erase browser caches.
  • Clearing cookies or local storage does not delete your account or records already saved to RaetOS. Account deletion is a separate Settings action described in the Privacy Policy.

7. Changes to This Policy

RaetOS may update this Cookie Policy as the app, auth flow, or extension changes. When material changes are made, we will update this page and the effective date.

8. Contact

For questions about cookies, browser storage, or privacy controls, contact privacy@raetos.com.

Related pages: Privacy Policy, Terms of Service, and Security and Trust.