The short version
- oyapilot uses a small number of cookies and browser storage items to keep you signed in, apply fair limits to free tools, remember a few preferences, and understand how the product is used.
- We do not use advertising cookies, and we do not let advertisers track you on our site. There are no ad pixels on oyapilot.
- We use one product analytics tool, PostHog, and one cookieless page analytics tool, Vercel Web Analytics.
- You can block or delete cookies in your browser. If you block the ones that keep you signed in, you will not be able to use your account.
- We honor Global Privacy Control.
This policy is part of our Privacy Policy, which explains how we handle personal information in general. Terms defined there have the same meaning here.
Contents
- What cookies and similar technologies are
- Who sets the cookies on oyapilot
- The categories we use
- Every cookie we set
- Browser storage we use
- Analytics in detail
- Payment pages
- Requests your browser makes to other companies
- What we do not use
- Your choices
- Global Privacy Control and Do Not Track
- Visitors in the EEA, UK and Switzerland
- Email and tracking pixels
- Cookies in the application engine's cloud browser
- Legal basis and consent, by region
- Questions people ask
- Change log
- Changes to this policy
- Contact
1. What cookies and similar technologies are
Cookies are small text files that a website asks your browser to store. Your browser sends them back to the website on later visits, which lets the website recognize your browser, keep you signed in, or remember a setting.
- First-party cookies are set by the website you are visiting (here, oyapilot.ai).
- Third-party cookies are set by a different company whose content or code runs on the page.
- Session cookies are deleted when you close your browser. Persistent cookies stay until they expire or you delete them.
Local storage and session storage are browser features that let a website keep information on your device. Local storage lasts until it is cleared. Session storage lasts until you close the browser tab. Unlike cookies, they are not sent to the website automatically with every request.
In this policy, "cookies" means cookies and these similar technologies together, unless we say otherwise.
2. Who sets the cookies on oyapilot
| Who | What they set | Where |
|---|---|---|
| oyapilot (Oyatco LLC) | Sign-in, security, limits, preference and promotion cookies; local and session storage | oyapilot.ai |
| Supabase (our authentication provider, acting for us) | The sign-in session cookie, which our own site sets on our own domain | oyapilot.ai |
| PostHog (our product analytics provider, acting for us) | An analytics cookie and local storage entry, set on our domain | oyapilot.ai |
| Stripe (our payment processor) | Security and fraud prevention cookies | Only on Stripe's own checkout and billing portal pages |
We do not allow any other company to set cookies on oyapilot.ai.
3. The categories we use
3.1 Strictly necessary
These make the Services work. They keep you signed in, keep your session secure, enforce the private beta invitation gate, apply daily limits to free tools, and carry the referral link or offer you arrived with through signup. The Services cannot work without them, so they are always on. Where the law requires consent for cookies, strictly necessary cookies are exempt from that requirement.
3.2 Preferences
These remember choices you make, such as your color theme, the navigation layout you prefer, whether the sidebar is open, and your recent searches. If you block them, oyapilot still works, but it will forget those choices.
3.3 Analytics
These help us understand how people use oyapilot, which features are useful, where people get stuck, and what is broken, so we can fix and improve the product. We use PostHog for this. Section 6 explains exactly what it records.
3.4 Advertising
None. We do not use advertising or targeting cookies.
4. Every cookie we set
| Cookie | Set by | Category | What it does | How long it lasts |
|---|---|---|---|---|
sb-<project>-auth-token (may be split into numbered parts such as .0 and .1) |
oyapilot, through Supabase authentication | Strictly necessary | Keeps you signed in and lets our servers confirm who you are on each request. It holds a signed, short-lived access token and a refresh token | Persists while you stay signed in; the access token inside it refreshes about every hour. Deleted when you sign out |
vp-anon-quota |
oyapilot | Strictly necessary | Counts how many times a visitor who is not signed in has used free tools such as the résumé score today. The contents are encrypted | 48 hours |
vp_ghostcheck |
oyapilot | Strictly necessary | Counts ghost-job checks today so the daily limit can be applied | 24 hours |
vp_invite |
oyapilot | Strictly necessary | Remembers that you entered a valid invitation code while you finish signing up, including through Google sign-in | 30 minutes |
vp_preview |
oyapilot | Strictly necessary | Remembers that you entered the password for a private preview of the site, when the site is in preview mode | 30 days |
vp_ref |
oyapilot | Strictly necessary | Remembers the referral code in the link you arrived from, so the person who referred you and you can receive referral rewards | 30 days |
vp_start |
oyapilot | Strictly necessary | Remembers that you came through our start wizard, so the first-month offer can be applied at checkout | 60 days |
op-nav |
oyapilot | Preferences | Remembers whether you chose the sidebar or the dock navigation layout | 1 year |
sidebar_state |
oyapilot | Preferences | Remembers whether the sidebar is expanded or collapsed | 7 days |
ph_<project key>_posthog |
PostHog, on our domain | Analytics | Holds a random identifier for your browser and the current analytics session, so events can be grouped. When you sign in, it is linked to your account (Section 6) | 1 year |
5. Browser storage we use
5.1 Local storage
| Key | Category | What it does | What it contains | How long it lasts |
|---|---|---|---|---|
vp-theme-v2 |
Preferences | Remembers light or dark theme | Your theme choice | Until you clear it |
oya_start_v1 |
Strictly necessary | Keeps your answers to the pre-signup start wizard on your device until you create an account and choose to import them. We do not receive these answers until you import them | Target roles, seniority, work arrangement, locations, salary floor, industries, search status and timeline | Until you import them, clear them, or clear site data |
oyapilot.search.recents |
Preferences | Shows your recent job searches | Your recent search terms | Until you clear it |
ph_<project key>_posthog and other ph_ keys |
Analytics | Stores PostHog's identifier and events waiting to be sent | Analytics identifiers and queued events | Up to 1 year |
5.2 Session storage
| Key | Category | What it does | How long it lasts |
|---|---|---|---|
vp-app-entered |
Preferences | Remembers that you already entered the app in this tab, so an introduction animation is not repeated | Until you close the tab |
oya_search_progress_dismissed |
Preferences | Remembers that you dismissed a search progress notice | Until you close the tab |
5.3 What we never store in your browser
Our free résumé score never saves your résumé in your browser's storage. We never store passwords in browser storage.
6. Analytics in detail
6.1 PostHog
We use PostHog, Inc. to understand how oyapilot is used. PostHog processes data for us on servers in the United States.
What it records:
- the pages you visit, including the full page address, and when you leave a page;
- clicks and other interactions that PostHog captures automatically, such as which button or link you clicked and its visible label;
- specific product events we send, such as starting a résumé score, running a ghost check, signing up, saving a job, starting a tailoring, sending an application, starting checkout, starting cancellation, reporting an interview or offer, and connecting an MCP client;
- technical information such as your browser, operating system, device type, screen size, approximate location derived from your IP address, and referring page.
How it is linked to you:
- If you are not signed in, PostHog uses a random identifier and does not create a personal profile for you.
- When you sign in, PostHog links your events to your oyapilot account ID and email address, so we can understand how the product works for real users and follow up on bugs.
- When you sign out, the link is reset for that browser.
What it does not record:
- the values you type into form fields, such as your résumé text, answers or passwords;
- screen recordings of your sessions; and
- anything on other websites.
[Engineering, required before publication: (1) PostHog
autocaptureis on and session recording is not disabled in code (lib/analytics/posthog-client.ts). Adddisable_session_recording: trueand confirm in the PostHog project settings that recording is off. (2) Autocapture does not collect input values by default, but it does collect element text; addmask_all_element_attributes/mask_all_textor restrict autocapture to buttons and links if element text can contain personal data (for example, job titles in a user's own tracker are fine, but résumé text rendered as buttons is not). (3) Stop sendingidentify()if it is not needed. If it stays, keep the sentence above. (4) Strip query strings from$current_urlfor pages whose query can contain personal data. (5) Add an "Analytics" toggle in Settings that callsposthog.opt_out_capturing(), and delete the PostHog person on account deletion.]
How long PostHog keeps it: up to 24 months, and we delete your PostHog person record when you delete your account.
6.2 Vercel Web Analytics
We use Vercel Web Analytics to count page views and measure page speed. It does not use cookies or browser storage, and it does not track you across websites. It uses information from each request (such as the page, referrer, browser, device type and country) to produce aggregate statistics.
7. Payment pages
When you start a paid plan or manage your billing, you are sent to pages run by Stripe (for example, Stripe Checkout and the Stripe customer billing portal). Stripe sets its own cookies on those pages to keep payments secure and prevent fraud. These cookies are set on Stripe's domains, not ours, and Stripe's cookie and privacy policies apply to them. We do not load Stripe's scripts on our other pages.
8. Requests your browser makes to other companies
Some oyapilot pages ask your browser to fetch small resources directly from other companies. These requests do not set cookies on our site, but, like any request on the internet, they tell the other company your IP address and the resource requested.
| Company | Why | What it receives |
|---|---|---|
| DuckDuckGo icon service | To show company logos in the job board and mail | Your IP address and the company's domain name |
| Google favicon service | To show company logos on some public pages | Your IP address and the company's domain name |
| Open-Meteo geocoding service | To suggest city names while you type in a location field | Your IP address and the letters you typed |
Our website fonts are served from our own domain, so loading them does not contact Google.
9. What we do not use
- advertising, retargeting or targeting cookies;
- social media pixels or tracking scripts (such as Meta, TikTok, LinkedIn or X pixels);
- cross-site tracking or fingerprinting;
- session replay or screen recording (see the note in Section 6.1); or
- third-party cookies from anyone other than Stripe, and Stripe's only on Stripe's pages.
If we ever change this, we will update this policy first and, where the law requires, ask for your consent.
10. Your choices
10.1 Browser settings
You can see, block and delete cookies and site data in your browser:
- Chrome: Settings, Privacy and security, Third-party cookies or Site settings, then "See all site data and permissions". Search for oyapilot.ai.
- Safari (Mac): Settings, Privacy, Manage Website Data. Search for oyapilot.ai.
- Safari (iPhone and iPad): Settings, Apps, Safari, Advanced, Website Data.
- Firefox: Settings, Privacy and Security, Cookies and Site Data, Manage Data.
- Edge: Settings, Cookies and site permissions, Manage and delete cookies and site data.
Browser menus change over time. Your browser's help pages have current instructions.
10.2 What happens if you block cookies
| If you block | What happens |
|---|---|
| Strictly necessary cookies | You cannot sign in or use your account, invitation codes and referral links may not work, and free tools may stop working |
| Preference cookies and storage | oyapilot works, but forgets your theme, layout, sidebar state and recent searches |
| Analytics cookies and storage | oyapilot works normally. We learn less about what to fix |
10.3 Turning off analytics
You can block PostHog by blocking cookies and site data for oyapilot.ai in your browser, by using a browser or extension that blocks analytics scripts, or by turning on Global Privacy Control (Section 11). [You can also turn off analytics for your account in Settings, under Privacy and data.]
10.4 Clearing start wizard answers
Your start wizard answers live only in your browser until you import them. Clearing site data for oyapilot.ai deletes them.
11. Global Privacy Control and Do Not Track
Global Privacy Control (GPC) is a signal your browser can send to tell websites you do not want your personal information sold or shared for targeted advertising. We honor GPC. Because we do not sell or share personal information and we do not use advertising cookies, GPC does not change how oyapilot works today, but we record your opt-out and, if you are signed in, apply it to your account.
[When your browser sends GPC, we also switch off PostHog analytics for that browser.]
Do Not Track is an older browser signal with no agreed standard. We do not respond to it, but we do not track you across other websites in any case.
12. Visitors in the EEA, UK and Switzerland
oyapilot's product and marketing are aimed at the United States. If you visit from the European Economic Area, the United Kingdom or Switzerland, the law requires your consent before non-essential cookies (preferences and analytics) are set. [For visitors from those regions, we show a cookie banner with equally prominent "Accept" and "Reject" buttons, and we do not set preference or analytics cookies until you accept. You can change your choice at any time from the "Cookie settings" link in the footer.]
[Counsel and Engineering: no consent banner exists today. Either build a region-aware banner that blocks PostHog and preference cookies until consent, or keep EU and UK signups closed and state that the Services are not offered there. Preference cookies such as theme may be arguable as "strictly necessary for a service the user asked for"; the conservative approach is to include them in the banner.]
13. Email and tracking pixels
Some companies put invisible images ("tracking pixels") or tracked links in their emails to learn when you open a message or click a link. [oyapilot's emails do not contain tracking pixels, and the links in them are not tracked.] Our emails contain ordinary links to oyapilot.ai.
Emails that Employers send to your oyapilot reply addresses may contain their own tracking pixels. When you open such a message in oyapilot's Mail tab, [we block remote images by default, so the sender cannot tell that you opened it until you choose to load images].
14. Cookies in the application engine's cloud browser
When oyapilot's application engine fills an application form for you, it opens the employer's website in a browser we run in the cloud. The employer's website may set its own cookies in that cloud browser, just as it would in yours. Those cookies belong to the employer's website and are governed by its own cookie policy.
We do not use those cookies for any purpose other than completing that one application. Each application attempt uses a fresh browser session, and the session, including any cookies the employer's website set, is discarded when the attempt ends. We never store your own browser's cookies, and we never sign in to any website as you.
15. Legal basis and consent, by region
| Where you are | Strictly necessary | Preferences | Analytics |
|---|---|---|---|
| United States | Always on, needed to provide the service | On by default; you can block them in your browser | On by default; you can opt out (Section 10.3), and Global Privacy Control is honored |
| European Economic Area, United Kingdom, Switzerland | Always on (exempt from consent) | Only with your consent | Only with your consent |
| Other countries | Always on | On by default unless local law requires consent | On by default unless local law requires consent |
For visitors in the EEA, UK and Switzerland, our legal basis for strictly necessary cookies is our legitimate interest in providing a secure service you asked for (and the exemption in the ePrivacy rules), and for preference and analytics cookies it is your consent, which you can withdraw at any time.
16. Questions people ask
Do you sell the data your cookies collect? No. We do not sell or share personal information, and none of our cookies are for advertising.
Can employers see my cookies or know I visited their job on oyapilot? No. Employers cannot see oyapilot's cookies. Viewing a job on oyapilot does not tell the employer anything. If you click through to the employer's own website, that website can set its own cookies, like any website you visit.
Does oyapilot track me on other websites? No. Our cookies work only on oyapilot.ai. We do not use cross-site tracking.
Why is there an analytics cookie at all? It tells us which features are used and where people get stuck, so we can fix the product. It is linked to your account only when you are signed in, and it never records what you type into forms.
If I delete all cookies, what happens? You will be signed out, your theme and layout choices reset, and any start wizard answers you had not imported are lost. Your account and its data are not affected.
Do you use cookies in emails or the browser extension? Our emails do not use tracking (Section 13). The browser extension is not yet released. When it is, its data practices will be explained in the Privacy Policy and inside the extension before it collects anything.
17. Change log
| Date | Change |
|---|---|
| [EFFECTIVE DATE] | Full rewrite. Added every cookie and storage item used by the product, PostHog analytics, third-party browser requests, the application engine's cloud browser, email tracking and regional consent |
| 11 June 2026 | First published version |
18. Changes to this policy
We will update this policy whenever we add, remove or change a cookie or storage item. The "Last updated" date shows the latest change. If we add a new category of cookie (for example, if we ever used advertising cookies), we will tell you in advance and, where the law requires, ask for your consent.
19. Contact
Questions about cookies or this policy: privacy@oyapilot.ai.
Oyatco LLC is an online business based in Texas, United States.