CloudHR sets two strictly necessary cookies. With your consent, we also use Google Analytics to understand how our public site is used — nothing analytics-related runs until you accept.
Last updated: 10 October 2026
We set two strictly necessary cookies. Both are first-party and both are required for the platform to work. In addition, on our public marketing site we use Google Analytics (GA4) to understand how the site is used.
Analytics only runs with your consent. Until you choose Accept in the
cookie banner, Google Consent Mode keeps analytics in a cookieless “denied” state — no
_ga cookie is set and no analytics data is collected. Choose Essential only
and it never runs. We run no advertising pixels or session-recording tools.
A cookie is a small file a website stores in your browser so it can recognise your browser on the next request. Without one, a website cannot tell that the person loading a page is the same person who just signed in.
| Name | Purpose | Lifetime | Flags |
|---|---|---|---|
cloudhr_session |
Holds your session so you stay signed in as you move between pages, and records which workspace you signed into. Without it you would be signed out on every click. | 2 hours of inactivity | HttpOnly, SameSite=Lax, encrypted |
XSRF-TOKEN |
A per-session token that proves a form submission came from our own pages. It is what stops a malicious site from making requests as you. It is deliberately readable by JavaScript, because the page has to send it back with each request. | 2 hours | SameSite=Lax, encrypted |
Both cookie values are encrypted and signed. Altering one invalidates it and signs you out rather than granting access.
On our public marketing site we use Google Analytics 4 to see which pages are visited and how people move through the site, so we can improve it. It loads with Google Consent Mode v2: before you accept, it runs in a cookieless state that sets no cookies and collects no identifying data. When you choose Accept, it is allowed to set the following cookies:
| Name | Purpose | Lifetime |
|---|---|---|
_ga | Google Analytics — distinguishes one visitor from another | Up to 2 years |
_ga_<id> | Google Analytics — keeps analytics session state | Up to 2 years |
We do not use these for advertising. The platform runs no advertising or remarketing pixels and no session-recording tools — no Meta/Facebook pixel, LinkedIn Insight tag, Hotjar, Clarity, Segment or Mixpanel. Analytics applies to the public marketing site only; signed-in workspaces carry no analytics tags at all.
Our public pages load styling, scripts and fonts from content delivery networks rather than serving every asset ourselves. These do not set cookies on our pages, but your browser does connect to them, which necessarily discloses your IP address and browser details to the provider.
| Host | What it serves |
|---|---|
www.googletagmanager.com, www.google-analytics.com | Google Analytics (only after you accept) |
fonts.googleapis.com, fonts.gstatic.com | Web fonts (Google Fonts) |
cdn.tailwindcss.com | Stylesheet framework |
cdnjs.cloudflare.com | Icon fonts and JavaScript libraries |
code.jquery.com | JavaScript library |
unpkg.com | JavaScript library |
Signed-in areas of the platform are not used for advertising and are not shared with any advertising network.
Every major browser lets you view, delete and block cookies, either generally or for a specific site. The relevant setting is usually under Privacy or Site Settings.
Note that blocking our two cookies will prevent you signing in at all — they are what a session is made of, so there is nothing to switch off without also switching off the product.
We will revise this page and the date above whenever the cookies we set change. Adding any non-essential cookie would also mean asking for your consent before setting it.
Our Privacy Policy explains how we handle personal data generally, including data held on an employer’s behalf.
