Cookie policy

1. What this page covers

A cookie is a small piece of text a website asks your browser to store and send back on the next request. It is how a site recognises that two requests came from the same person — which is the only reason CreateCVOnline uses one at all.

This page lists everything createcvonline.com stores in your browser: the cookies we set, the cookies a third party may set, and the browser storage that is not a cookie but is worth being straight about anyway. It sits alongside the privacy policy, which covers personal data more broadly.

There is no advertising network here, no re-targeting pixel, no social embed and no third-party tag manager. If you block everything optional, the product still works in full.

2. The one cookie we always set

Signing in mints exactly one cookie, named __session. It holds a Firebase session token — not your password, not your e-mail address and not anything from your CV. Without it there is no way to stay signed in between page loads, so it is strictly necessary and it is not something you can opt out of while using an account.

Its properties, which you can verify in your browser's developer tools:

• httpOnly — JavaScript on the page cannot read it, which is what stops a script injection from stealing your session.
• Secure in production, so it is only ever sent over HTTPS.
• SameSite=Lax, so it is not attached to cross-site requests made by other websites.
• First-party. It is set on createcvonline.com and sent nowhere else.

Its lifetime is set by the operator of this deployment through the SESSION_COOKIE_DAYS environment variable, which defaults to 5 days and cannot exceed 14 days — that ceiling is Firebase's, not ours. Signing out deletes the cookie immediately and revokes the session on the server, so a copy of the cookie taken beforehand is useless afterwards.

The name is not decorative: Firebase Hosting only forwards a cookie called __session to server-rendered routes, so it is the one name this architecture can use.

3. Analytics cookies (optional, off unless configured)

Analytics is not switched on by default. A fresh installation of this software makes no analytics request at all and sets no analytics cookie. It only starts when the operator of a deployment sets a Google Analytics measurement id in NEXT_PUBLIC_GA_MEASUREMENT_ID — until then, the tag is never loaded and there is nothing on the page to block.

Where it is enabled, Google Analytics 4 sets two first-party cookies: _ga, which holds a random identifier for a browser, and _ga_<measurement-id>, which keeps session state. Both are set by Google's script and their duration is Google's default of roughly two years unless the operator shortens it in the Analytics property.

We configure the tag with anonymize_ip enabled and with automatic page views switched off, so page paths are reported deliberately rather than swept up. The events recorded are product events with low-cardinality properties — a plan name, a template category. No CV content, no e-mail address and no free text you have typed is ever sent to analytics.

The same GA4 cookies appear if the operator has instead configured Firebase Analytics through NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID, because Firebase Analytics is Google Analytics underneath.

This software does not ship a consent banner, and where local law requires prior consent for analytics cookies the operator must add one before enabling analytics. That is a deployment decision, not something this template can make for you.

4. PayPal cookies during checkout

Buying a plan sends you to PayPal. We do not embed PayPal's checkout in our own pages and we do not load PayPal's JavaScript SDK on createcvonline.com, so PayPal sets nothing in your browser until you are actually on PayPal's site.

Once you are there, PayPal sets its own cookies on its own domains for its own purposes — keeping you signed in to PayPal, remembering your progress through checkout, and its fraud and risk checks. Those cookies are governed by PayPal's own cookie statement, not by this one. We cannot read them, delete them or turn them off.

When PayPal sends you back to us, the only thing that travels with you is an order reference in the URL. Our server then confirms the order with PayPal directly before any plan is unlocked.

5. Browser storage that is not a cookie

Your dashboard preferences are kept in localStorage, not in a cookie. The distinction matters: localStorage is never attached to a network request, so this data is only ever read by the page you are looking at and is never transmitted to us or to anyone else.

One key is used, createcvonline:preferences, and it holds two things: the paper size (A4 or US Letter) and the template you want pre-selected when you start a new CV. It is scoped to the browser and the device that set it, which is why those choices do not follow you to another computer.

It has no expiry date, because there is no mechanism to give it one — it stays until you clear site data for createcvonline.com in your browser, at which point the settings simply return to their defaults. Nothing breaks.

6. The complete list

Everything the site can store in your browser, in one table. Nothing else is set by createcvonline.com.

Fonts are a related detail that is not a cookie: the interface and the CV templates request typefaces from Google Fonts, so your browser contacts Google when a page loads. That request sets no cookie on our domain, but it is a third-party connection and it is listed in the privacy policy for the sake of completeness.

7. How to control them

Every browser lets you view, block and delete cookies for a specific site, usually under a “Privacy”, “Site settings” or “Cookies and site data” heading. Clearing site data for createcvonline.com removes both the session cookie and the localStorage entry above.

• Blocking the session cookie means you cannot stay signed in. The public site — templates, examples, guides, pricing — still works in full, but the editor and the dashboard will bounce you back to the sign-in page, because there is genuinely no other way for the server to know it is you.
• Blocking analytics costs you nothing. No feature depends on it. A browser tracking-protection setting, an extension, or the browser's “Do Not Track” signal will all stop it, and where analytics has not been configured there is nothing to block in the first place.
• Signing out is the cleanest way to remove the session cookie: it deletes it and revokes the session server-side in one step.

You can also opt out of Google Analytics across every site you visit with Google's browser add-on.

8. Changes to this policy

If we add a cookie, this page changes before the cookie ships, and the “last updated” date at the top changes with it. We have no plans to add advertising or re-targeting cookies; if that ever changed it would be a material change and we would say so plainly rather than quietly editing a table.

Questions, or something here that does not match what you see in your browser? Tell us at support@createcvonline.com — a policy that disagrees with the software is a bug in one of the two.