Cookie Notice

Last updated September 03, 2026

This notice explains which cookies Origami CV sets, what our analytics provider receives, and how to change your choice. It supplements our Privacy Policy.

The short version: we use one analytics provider, PostHog, hosted in the EU. We do not run advertising cookies, we do not sell your data, and we do not share it with ad networks or data brokers. If you decline analytics, no analytics cookies are set and no product events leave your browser.

Strictly necessary cookies

These are required for the site to work — signing in, staying signed in, remembering your language, and carrying a guest purchase through checkout. They are set regardless of your analytics choice, and cannot be switched off without breaking the service.

Cookie	Purpose	Duration
`cvc_consent`	Stores your cookie choice on this page so we don't ask again and so analytics stays off if you declined.	6 months
`next-auth.session-token`	Keeps you signed in. Set as __Secure-next-auth.session-token over HTTPS.	Session / 30 days
`next-auth.csrf-token`	Protects sign-in and account forms against cross-site request forgery.	Session
`next-auth.callback-url`	Returns you to the right page after signing in.	Session
`NEXT_LOCALE`	Remembers whether you chose English or German.	1 year
`cvc_guest_access, cvc_guest_workspace_access`	Lets you build and pay for a CV before creating an account, and gives you access to that CV afterwards.	Session / 30 days
`cvc_guest_checkout_complete, cvc_guest_checkout_email`	Carries your purchase back from Stripe so your CV unlocks and you can claim the account with the email you paid with.	Session

Analytics cookies

Only set if you accept analytics. We use PostHog (PostHog, Inc.), on their EU Cloud region, so this data is stored in the European Union. PostHog acts as our processor under a data processing agreement.

What PostHog receives

Page views — which pages you visit, the referring site, and rough device/browser information.
Product events — named milestones such as starting the wizard, finishing the interview, generating a CV, and reaching checkout. These record that a step happened, not the content of your CV.
Error reports — when something crashes, the error message, stack trace and the page it happened on, so we can fix it.
Session replays — a reconstruction of your navigation and clicks, used to find where the builder is confusing or broken. All form inputs are masked, and the text of your CV, your uploaded resume and your interview answers are masked before anything is sent. Network request and response bodies are never recorded.
Your email address — once you are signed in, so we can connect the events above to your account and give you support when you report a problem.

What PostHog never receives

The contents of your CV, your uploaded resume file, your interview answers, your password, or your payment details. Payment information goes directly to Stripe and is never held by us.

How long we keep analytics data

Analytics data is deleted automatically once it reaches the ages below. These limits apply to data collected from the date this notice was last updated onwards.

Session replays — 90 days.
Diagnostic logs — 30 days.
Product events and error reports — up to 12 months, in line with our current PostHog plan.

The cookies themselves expire on the schedules listed in the tables above, independently of this.

Changing your mind

You can withdraw or change your consent at any time — it is exactly as easy as giving it. Your new choice takes effect immediately: declining stops any further collection and clears the analytics identifier from this browser.

You can also block or delete cookies in your browser settings, and we honour your browser's Global Privacy Control (GPC) signal where it is sent. Note that blocking strictly necessary cookies will stop you from signing in.

Declining here stops analytics for this browser only. If you use Origami CV on another device or browser, set your preference there too.

Questions

Email us at info@origamicv.com.