Last updated August 20, 2026

Cookies and browser storage notice

This notice explains the limited device storage used by the private 4h4 Workspace. The workspace does not currently use advertising cookies, analytics cookies, or cross-site behavioral tracking.

1. Why there is no “accept all” banner

The workspace currently uses only storage needed to provide requested sign-in, security, anti-spam, and session-history functions. These technologies are not optional marketing or analytics tools. A consent banner that offered an “accept” choice for technologies users cannot meaningfully refuse would be misleading.

2. Strictly necessary authentication storage

The Supabase authentication service uses first-party session cookies to keep an approved user signed in, refresh the secure session, and protect authenticated requests. The cookies contain session identifiers or authentication tokens rather than candidate or opportunity records. Their duration follows the configured authentication session and they are removed or replaced when the session ends, expires, or the user signs out.

3. Security and anti-spam technology

Cloudflare protects the website at the network edge, and Cloudflare Turnstile is used on sign-in and account-request forms to distinguish legitimate requests from automated abuse. Cloudflare may process technical request, browser, device, and network information for security and fraud prevention—not advertising.

• __cf_bm supports Cloudflare bot detection and expires after approximately 30 minutes of inactivity. Cloudflare generates it separately for this website and states that it does not track a visitor from site to site or session to session.
• cf_clearance may be set after a Cloudflare security challenge so the browser can show that the challenge was passed.
• Other short-lived Cloudflare challenge storage may be used only when the service needs to diagnose or complete a security check.

4. Workspace AI session history

After a user submits a question to Workspace AI, the question text is kept in that browser’s session storage so the requested “Previous questions” list can work during the session. This is not sent to advertising or analytics services. The browser clears session storage when the session ends; users can also clear it through their browser controls.

5. What we do not use

• No advertising, retargeting, or social-media tracking pixels.
• No web-analytics cookies or cross-site user profiles.
• No sale or sharing of cookie identifiers for targeted advertising.

6. Future changes and choices

Before optional analytics, advertising, fingerprinting, or similar nonessential storage is introduced, 4h4 must update this notice and implement a prior consent choice where required. Rejecting must be as easy as accepting, optional technologies must remain off before consent, and users must be able to change or withdraw their choice.

7. Questions

Questions about workspace storage can be directed to the 4h4 representative or workspace administrator. The controller’s finalized privacy contact details should also be published in the candidate and employee privacy notices.