Cookie Policy
Last updated: September 2026
النسخة العربية قادمة قريبًا. Arabic version coming soon.
What are cookies?
Cookies are small text files stored on your device when you visit a website. Cheghel uses a small number of cookies and some storage in your browser, both listed below, and no third-party advertising trackers.
Cookies we use
| Cookie | Type | Purpose | Duration |
|---|---|---|---|
Supabase auth sessionsb-…-auth-token (may be split into .0, .1) | Essential | Keeps you signed in. It holds your sign-in tokens and your basic account details — your email address, name and phone number — on this device. Deleted when you sign out. | Up to 400 days, renewed while you use Cheghel |
sb-…-auth-token-code-verifier | Essential | A one-time security code used while you sign up, sign in with Google or an emailed code, or reset your password. Deleted as soon as you are signed in. | Until you finish signing in (at most 400 days if you never do) |
| cheghel-locale | Essential | Remembers your language choice (Arabic or English). | 1 year |
| cheghel_cookie_consent | Essential | Stores your cookie-banner choice. | 1 year |
| cheghel-active-role | Essential | Remembers whether you are using Cheghel as a job seeker, an employer or a freelancer on this device, so you are not asked on every visit. It only counts for the account that chose it, holds no name or email, and is deleted when you sign out. | 1 year |
PostHog analyticsph_…_posthog | Optional | Only if you accept analytics. Pseudonymous, not anonymous: it holds a random ID for this browser, which we never link to your account, and an ID for your current visit. PostHog keeps the same IDs in this browser's local storage, together with the address of the first page of each visit (which can include what follows the “?”), the page that sent you there, and a note that you said yes. Choosing Essential only stops analytics straight away and deletes all of it. When someone signs out, the IDs are replaced with new random ones, so the next person on this browser is not recorded under the same ID. | The cookie: 1 year after your last visit. The copy in local storage has no expiry; it stays until you choose Essential only or clear this site's data. |
Set by other companies
Some steps take your browser to, or load something from, another company. Those companies set their own cookies under their own policies; Cheghel cannot read or remove them.
| Company | Where you meet it | What it sets | Duration |
|---|---|---|---|
| Cloudflare, in front of Supabase (our database, sign-in and file-storage provider) | When you sign in with Google, when an employer opens an applicant's CV, and when company logos or your profile photo load | __cf_bm, Cloudflare's bot-protection cookie, on supabase.co — Supabase's domain, not ours. It is HttpOnly, Secure and SameSite=None; some browsers block it when it comes with an image. | 30 minutes |
| Only if you choose to sign up or sign in with Google | Google's own cookies, on Google's domain, under Google's policy | Set by Google | |
| Tap Payments, and your card's bank | Only when you pay: Tap's payment page, and your bank's security check if it asks for one | Their own cookies, and whatever their payment and fraud screening checks collect on their pages | Set by them |
| Cloudflare Turnstile | Sign-up, sign-in and password reset, in a small frame from challenges.cloudflare.com | Whatever Cloudflare keeps in its own frame while it checks that you are a person. We have found nothing it stores on cheghel.com. | Set by Cloudflare |
Links that take you off Cheghel — WhatsApp, or an employer's own application page — lead to sites that set their own cookies.
Storage on your device
Some features keep working data in your browser's storage instead of a cookie. Our servers do not read Cheghel's own entries below: keeping something there does not send it to us; it reaches us only through the actions that send it, such as uploading a CV, using an AI helper or saving. PostHog's entries, in the last row, are different: they go to PostHog with its events.
| Name | What it holds | Removed when |
|---|---|---|
cheghel_onboarding_v1:… | Your place in the welcome steps: the first name you entered, your choices, the name and storage location of a CV you uploaded, and a freelancer's rate and portfolio link. Its name includes your account ID. | When you finish or restart them, and whenever someone signs in or out on this browser |
cheghel-jobdraft-… (employers) | A job post you are still writing, every field of it | When you save it as a draft, and whenever someone signs in or out on this browser |
d25-viewed | Jobs you previewed in search results and then moved on from, up to 200, so they show as Viewed | Whenever someone signs in or out on this browser; while no one is signed in it belongs to the browser, not an account |
cheghel.ranking-info-dismissed.… (employers) | That you closed the note on how applicants are ranked, for each job | Whenever someone signs in or out on this browser |
sw-coached | That you have seen the Swipe introduction | Whenever someone signs in or out on this browser |
d25-density | Whether job results show as cards or compact rows; nothing about you | Kept after sign-out, like your language |
cheghel-device-owner | Whether someone is signed in on this browser, as a one-way code — never your account ID — so the rows above can be cleared when that changes | Replaced whenever someone signs in or out |
PostHog, only if you accept analytics: ph_…_posthog (local and session storage), ph_…_window_id, ph_…_primary_window_exists, __ph_opt_in_out_… | The same random IDs as its cookie, the address of the first page of each visit (which can include what follows the “?”), the page that sent you there, and a note that you said yes. The IDs, and that first address and the page before it with anything after the “?” removed, are sent to PostHog with every analytics event | Replaced with new random identifiers when you sign out, and removed if you withdraw analytics consent; the session-storage items also end when you close the tab |
If your session ends without you signing out — it expires, or you sign out on another device — the same happens the next time Cheghel loads a page in this browser. Deleting your account does it too. On a shared computer, sign out when you finish.
What we don't use
- No third-party advertising cookies.
- No Meta / Facebook pixels.
- No cross-site tracking.
- No fingerprinting for advertising or identity. Cloudflare Turnstile, on the sign-up, sign-in and password-reset screens, inspects browser signals to tell a person from a bot; see the Privacy Policy.
Your choice
You control optional cookies. You can reopen the consent banner and change your choice at any time.
Switching to Essential only stops analytics straight away, in every Cheghel tab you have open, and deletes the cookie and the browser storage PostHog kept here — you do not need to reload the page. It cannot recall what was already sent: anything PostHog received before you switched stays with PostHog, and events from the moments just before you chose may still arrive.
More information
See our Privacy Policy for the full picture on data we collect and how we use it.