1. What this notice is
This Cookie Notice explains how Aurea CV OÜ ("Aurea CV", "we", "us", "our") uses cookies and similar tracking technologies on the Ewance platform at ewance.com and app.ewance.com (the "Service").
It should be read together with our Privacy Policy and Terms of Service.
2. What are cookies
Cookies are small text files placed on your device (computer, phone, tablet) when you visit a website. They allow the site to remember information about your visit — for example, your login session or your language preference — to make the next visit more useful or efficient.
In this notice, "cookies" also covers similar technologies such as:
- Local storage and session storage (browser-based storage that works similarly to cookies);
- Pixel tags and web beacons (tiny invisible images that track interactions);
- Device identifiers (used in apps to recognise a returning device).
3. Our approach
Our approach to cookies is built around three principles:
- Strictly necessary cookies are always on. Without these, the Service simply cannot work — for example, you cannot stay logged in, or your shopping cart would empty between pages.
- Everything else is opt-in. We do not set non-essential cookies until you have told us it's OK. The default state on your first visit, before you make a choice, is that no non-essential cookies are set.
- No advertising cookies. We do not run third-party advertising on the Service, and we do not use cookies for ad-targeting or to share data with ad networks. (This is also a commitment in our Terms of Service.)
You can change your cookie preferences at any time via the Cookie Preferences link in the footer of any page.
4. Cookie categories we use
We organise cookies into four categories. The first is always on; the other three are off until you opt in.
4.1 Strictly necessary
These cookies are essential for the Service to function. They support core features like authentication, security, and basic preferences.
| What it does | Cookie name(s) | Provider | Duration |
|---|---|---|---|
| Keeps you logged in across pages | __session, __clerk_* |
Clerk (authentication provider) | Session and up to 7 days |
| Maintains your session and prevents cross-site request forgery | ewance_session, ewance_csrf |
Aurea CV (first-party) | Session |
| Remembers your cookie preferences | ewance_consent |
Aurea CV (first-party) | 12 months |
| Routes your requests to the correct server | __cf_* |
Cloudflare (security and routing) | Session and up to 24 hours |
Legal basis: these cookies are exempt from prior consent because they are strictly necessary for a service you have requested (ePrivacy Directive Art. 5(3) and recital 25; Article 6(1)(b) and 6(1)(f) GDPR).
You cannot disable strictly necessary cookies through this Service, but you can block all cookies in your browser — note that doing so will likely prevent the Service from working properly.
4.2 Functionality
These cookies remember choices you have made to give you a smoother experience. They are not essential, but the Service will feel less personalised without them.
| What it does | Cookie name(s) | Provider | Duration |
|---|---|---|---|
| Remembers your preferred language | ewance_lang |
Aurea CV (first-party) | 12 months |
| Remembers UI preferences (e.g. dark mode, dismissed banners) | ewance_prefs |
Aurea CV (first-party) | 12 months |
| Remembers your last selected challenge filters | ewance_filters |
Aurea CV (first-party) | 6 months |
Legal basis: consent (Article 6(1)(a) GDPR), given via the cookie banner.
4.3 Analytics
These cookies help us understand how the Service is used so we can improve it. We only use analytics that respect privacy — no cross-site tracking, no personal data sold to third parties.
| What it does | Cookie name(s) | Provider | Duration |
|---|---|---|---|
| Aggregate visit counts, page performance, and traffic-source measurement | _ga, _gid, _gat |
Google Analytics 4 (loaded via Google Tag Manager) | Up to 2 years (_ga); 24 hours (_gid); 1 minute (_gat) |
| Product analytics (which features get used, friction points), with anonymous session replay on conversion-relevant pages | ph_*, phtoken |
PostHog (EU region — eu.i.posthog.com) |
Up to 1 year |
We configure these providers to:
- Anonymise IP addresses where the provider supports this;
- Not share data with the provider's other customers;
- Honour Do Not Track signals where applicable.
Legal basis: consent (Article 6(1)(a) GDPR).
4.4 Marketing
We do not currently set any Marketing cookies. We do not use third-party advertising networks (Google Ads, Meta, LinkedIn Insight Tag, etc.) for retargeting, behavioural advertising, or data sharing.
If this changes, we will update this notice in advance and request your consent before setting any Marketing cookies.
Legal basis: consent (Article 6(1)(a) GDPR) — not currently relied upon as no cookies in this category are set.
5. Third-party cookies and embedded content
Some pages of the Service may embed content from third parties — for example, YouTube videos, social media posts, or external code samples. When you interact with this content, the third party may set their own cookies, which are governed by their privacy policies, not ours.
We try to minimise third-party embedding. Where it exists, we either:
- Use privacy-respecting alternatives (for example,
youtube-nocookie.cominstead of standard YouTube embeds); - Show a placeholder and load the third-party content only after you click on it (so no third-party cookies are set unless you actively engage).
6. How to manage cookies
Through Ewance
- Cookie banner: when you first visit the Service, you'll see a cookie banner with three options — Accept all, Reject all, or Customize. Customize lets you toggle each category individually.
- Cookie Preferences link: in the footer of every page. Clicking it reopens the customise modal at any time. Your choices update immediately.
Through your browser
You can also manage cookies through your browser settings. Each browser handles this differently:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions → Cookies and site data
Note that blocking strictly necessary cookies in your browser will likely break parts of the Service.
Do Not Track
When our consent infrastructure supports it, we plan to honour the "Global Privacy Control" (GPC) signal where your browser sends one — and treat it as a signal to refuse non-essential cookies. The older "Do Not Track" (DNT) signal is not consistently defined; we are following the GPC standard as it matures.
7. Changes to this notice
We may update this Cookie Notice from time to time, for example if we change which cookies we use or introduce new categories. The "Last Updated" date at the top will reflect the most recent change. Material changes will be notified through the Service or by email (where relevant).
8. Contact
For questions about this Cookie Notice, contact: [email protected]
Version history
- 2026-05-14 — Initial version published.