1. Introduction
This Cookie Policy explains how Worqen OÜ ("Worqen", "we", "us") uses cookies and similar technologies on the Worqen Service. It supplements our Privacy Policy.
You can review and change your preferences at any time:
2. What are cookies?
Cookies are small text files placed on your device when you visit a website. We also use other browser-storage technologies — including localStorage and sessionStorage — and refer to all of these collectively as "cookies" in this Policy.
3. Categories of cookies we use
3.1 Strictly necessary
These cookies are required for the Service to function and cannot be turned off. They are usually set in response to actions you take, such as logging in or changing language. They do not store information that identifies you for marketing.
| Name | Purpose | Duration |
|---|---|---|
refresh_token | Keeps you signed in across sessions (HttpOnly, Secure) | 7 days |
worqen_session | Tells our servers that this browser has a signed-in session, so we can take you straight to your dashboard. It holds no token or account details. We also use it to switch off the acquisition measurement described in section 3.3 while you are signed in. | 30 days, or until you sign out |
__worqen_at | Holds the access token for your signed-in session (sessionStorage) | Until you sign out or close the browser tab |
locale | Stores your language, detected from your browser on your first visit or chosen by you | 1 year |
worqen_role | Remembers whether you last used Worqen for hiring or for working, so we open the matching home page. A copy is kept in localStorage as worqen-user-role. | 30 days; both are removed when you sign out |
worqen:auth-next, worqen:hat-next | Remember the page you were heading to while you sign in with Google, GitHub or LinkedIn, or while you choose between hiring and working, so we can take you back there (sessionStorage) | Until you reach that page or close the browser tab |
worqen_ref | Holds the invite code from a referral link (/r/…) you opened, so the invite can be applied to your account after you sign up and sign in (localStorage) | No set expiry; removed once the invite is applied or rejected |
worqen_device_id | A device identifier computed from your browser and device characteristics when you register or sign in, used for fraud prevention and account security as described in section 8 of our Privacy Policy. A companion entry, worqen_device_reported_at, limits device reports to one a day (localStorage) | No set expiry |
worqen_cookie_consent_v1 | Records your cookie preferences (localStorage) | No set expiry; we ask again when this Policy changes materially |
3.2 Functional
Functional cookies remember choices you make to enhance your experience — for example, the last theme (light/dark) or whether the sidebar is collapsed. Disabling functional cookies will not prevent the Service from working but may degrade certain features.
3.3 Analytics
Analytics help us understand how people find and use the Service so we can improve it. We use three separate kinds of measurement, described below.
Google Analytics and Microsoft Clarity (only with your consent). We use Google Analytics 4, provided by Google, and Microsoft Clarity, provided by Microsoft. Their scripts load only after you accept analytics cookies in the cookie banner or in your cookie preferences; until you decide, or if you refuse, they are not loaded. Google Analytics receives the pages you view, the address you arrived from, campaign parameters in the page address, your approximate location, device and browser details, and a few product events — sign-up, sign-in, posting a job or a service, funding an escrow and releasing a payment — with details such as the payment type, currency, amounts and an internal escrow record number. Microsoft Clarity records how pages are used, such as clicks, scrolling and mouse movement, to produce heatmaps and session replays. We do not send your name, email address or account ID to either provider. If you withdraw consent, they are no longer loaded from the next time you open or reload a page; cookies they have already set stay in your browser until they expire or you delete them.
First-party acquisition attribution. To learn which channels bring new users — for example TikTok, a Google search, ChatGPT, a Telegram post, a referral invite or one of our tracked links — our own code notes how you arrived when you enter the Service from another website or through a tagged link: the referring site's address without its query string, the page you landed on, the campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the name — never the value — of a click-identifier parameter that platforms such as Google or Facebook add to links (for example gclid or fbclid), the name of a Worqen tracked link, and whether you came through a referral invite link. It keeps the first and the most recent such arrival. Nothing is recorded while you are signed in, and none of it is ever sent to advertising platforms.
- Without analytics consent — including before you decide, or when your browser sends the Global Privacy Control (GPC) signal — these details are kept only in the memory of the open page. Nothing is written to your device, and they are lost when you close or reload the page or leave the Service. If you create an account during that visit, they are sent with your sign-up request.
- With analytics consent (and no GPC signal), they are also saved in your browser as
worqen_attribution_v1for 30 days, so an account you create on a later visit is still attributed. We delete it as soon as you withdraw analytics consent, and once you are signed in.
When you create an account, we store the resulting source with your account. Our Privacy Policy explains what we keep and for how long. We rely on our legitimate interest in understanding which channels bring new users.
Anonymous arrival counting. To compare how many visitors each channel brings with how many of them sign up, each time you enter the Service from another website or through a tagged link while you are not signed in, your browser sends one request to our server with the arrival details above. Using those details, your browser's user agent and the country of your connection, our server works out a set of categories — channel, source, medium, campaign, referring site, landing page, click-identifier type, tracked link, type of in-app browser (for example TikTok's or Instagram's), device type (mobile, tablet or desktop) and country — and stores only those. We store no IP address, browser user agent, cookie or other identifier with this count, it writes nothing to your device, and it is not linked to you or to any account. Because it stores nothing on your device, it does not depend on the cookie banner: we rely on our legitimate interest in understanding which channels bring visitors, and we keep these counts for 13 months. As with any request, our servers and our network provider, Cloudflare, process your IP address to deliver it, as described in our Privacy Policy.
| Name | Purpose | Duration |
|---|---|---|
worqen_attribution_v1 | Worqen: your first and most recent arrival details, so a later sign-up is attributed (localStorage; only with analytics consent and no GPC signal) | 30 days |
_ga, _ga_<ID> | Google Analytics: distinguishes visitors and sessions | Up to 2 years |
_clck, _clsk | Microsoft Clarity: keeps a Clarity visitor ID and groups page views into one session | 1 year and 1 day |
3.4 Marketing
Marketing cookies are used to show you advertisements and to measure advertising across other websites and apps, for example through advertising pixels. We do not load any marketing or advertising cookies, and we do not send data about you to advertising platforms. The acquisition measurement in section 3.3 is used only by Worqen. We will only use marketing cookies with your consent and with transparent disclosure here.
3A. Your consent and its legal basis
Two EU frameworks apply. Storing cookies on, or reading them from, your device is governed by the ePrivacy Directive (2002/58/EC), Article 5(3), as implemented in Estonian law; any resulting processing of personal data is governed by the GDPR. Where we ask for your consent, the lawful basis for that processing is Article 6(1)(a) GDPR (consent). Our full lawful-basis mapping is set out in our Privacy Policy.
Strictly necessary cookies (section 3.1) are exempt from the consent requirement under Article 5(3), because they are strictly necessary to provide a service you have explicitly requested. We therefore set them without asking, but we still list them above so you know what they do.
For the remaining categories — functional, analytics and marketing — we ask for your consent before any cookie that requires it is set. Google Analytics, Microsoft Clarity and the stored acquisition record (worqen_attribution_v1) are used only after you accept analytics cookies (section 3.3). We do not load any marketing cookies (section 3.4).
Two parts of our acquisition measurement store nothing on your device and do not depend on the cookie banner: the arrival details kept in the memory of the open page and sent with your sign-up, and the anonymous arrival count (both described in section 3.3). For these we rely on our legitimate interest in understanding which channels bring visitors and new users (Article 6(1)(f) GDPR). You can object to processing based on legitimate interest as described in our Privacy Policy.
Your consent is granular. You can accept or refuse each optional category independently, and refusing is as easy as accepting: the cookie banner presents an equally prominent "Reject non-essential" choice alongside "Accept all", and dismissing the banner refuses all non-essential cookies.
You can withdraw or change your consent at any time using the "Manage cookie preferences" button at the top of this page. Withdrawing is as easy as giving consent and does not affect the lawfulness of any processing carried out before you withdrew. We keep a record of your choice in your browser (see section 3.1) and ask you again whenever this Policy changes materially (see section 6).
4. Third-party cookies
Some pages embed services that may set their own cookies under their own privacy notices. These include:
- Google Analytics and Microsoft Clarity — only after you accept analytics cookies (section 3.3). Microsoft Clarity may also set cookies on Microsoft's own domains.
- Cloudflare — delivers and protects the Service and runs the Turnstile security check on the sign-up form; it may set short-lived security cookies.
- Persona — used during identity verification flows.
- Solana wallet adapters (Phantom, Solflare and others) — may use browser storage to remember your wallet selection.
We do not control these third-party cookies. Please consult the cookie notices of the relevant providers.
5. How to manage cookies
You can:
- open the in-app cookie preferences using the button at the top of this page;
- change your browser settings to refuse cookies, delete cookies, or alert you when cookies are being set. See your browser's help pages (Chrome, Safari, Firefox, Edge);
- turn on the Global Privacy Control (GPC) setting in your browser. When your browser sends GPC, we do not save the acquisition record (
worqen_attribution_v1) on your device, even if you accept analytics cookies. GPC does not currently turn off Google Analytics or Microsoft Clarity; to refuse them, use the cookie preferences.
Disabling strictly necessary cookies will prevent core features such as authentication from working.
6. Changes to this Policy
We may update this Cookie Policy from time to time. The "effective date" at the top of this page indicates when the Policy was last updated. Material changes will be announced via the cookie banner so you can re-consent.
7. Contact
Questions about this Cookie Policy: [email protected].