CloudHR sets two cookies, both of them strictly necessary. We use no analytics, advertising or tracking cookies.
Last updated: 13 September 2026
We set two cookies. Both are first-party, both are required for the platform to work, and neither is used to profile you or to advertise. We run no analytics, no advertising pixels and no session-recording tools.
Because we only set strictly necessary cookies, there is no consent banner — under the ePrivacy rules cookies essential to delivering a service you asked for do not require consent. If that ever changes, we will ask first and update this page.
A cookie is a small file a website stores in your browser so it can recognise your browser on the next request. Without one, a website cannot tell that the person loading a page is the same person who just signed in.
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
cloudhr_session |
Holds your session so you stay signed in as you move between pages, and records which workspace you signed into. Without it you would be signed out on every click. | 2 hours of inactivity | HttpOnly, SameSite=Lax, encrypted |
XSRF-TOKEN |
A per-session token that proves a form submission came from our own pages. It is what stops a malicious site from making requests as you. It is deliberately readable by JavaScript, because the page has to send it back with each request. | 2 hours | SameSite=Lax, encrypted |
Both cookie values are encrypted and signed. Altering one invalidates it and signs you out rather than granting access.
For the avoidance of doubt, the platform contains no Google Analytics, no Google Tag Manager, no Meta/Facebook pixel, no LinkedIn Insight tag, no Hotjar, Clarity, Segment or Mixpanel, and no advertising or cross-site tracking cookies of any kind.
Our public pages load styling, scripts and fonts from content delivery networks rather than serving every asset ourselves. These do not set cookies on our pages, but your browser does connect to them, which necessarily discloses your IP address and browser details to the provider.
| Host | What it serves |
|---|---|
fonts.googleapis.com, fonts.gstatic.com | Web fonts (Google Fonts) |
cdn.tailwindcss.com | Stylesheet framework |
cdnjs.cloudflare.com | Icon fonts and JavaScript libraries |
code.jquery.com | JavaScript library |
unpkg.com | JavaScript library |
Signed-in areas of the platform are not used for advertising and are not shared with any advertising network.
Every major browser lets you view, delete and block cookies, either generally or for a specific site. The relevant setting is usually under Privacy or Site Settings.
Note that blocking our two cookies will prevent you signing in at all — they are what a session is made of, so there is nothing to switch off without also switching off the product.
We will revise this page and the date above whenever the cookies we set change. Adding any non-essential cookie would also mean asking for your consent before setting it.
Our Privacy Policy explains how we handle personal data generally, including data held on an employer’s behalf.
