Legal
Cookie policy
What HireOSS stores in your browser. Everything listed is needed for a feature you use or a setting you chose, so we do not ask for consent.
Last updated: 28 October 2026
| Name | Purpose | Lifetime |
|---|---|---|
| authjs.session-token | Keeps you signed in | Until you sign out, or after a period of inactivity |
| authjs.csrf-token | Protects the sign-in form against forged requests | Until you close the browser |
| authjs.callback-url | Returns you to the page you were on after sign-in | Until you close the browser |
| hireoss_locale | Remembers the language you chose | 1 year |
| hireoss_locale_bridge | Keeps your language choice while you sign in | 2 minutes |
| hireoss_tz | Remembers your time zone so dates and times are shown correctly | 1 year |
| hireoss_welcome_seen | Remembers that you have seen the welcome screen | 1 year |
| hireos_params_* | Remembers the list filters and sort order you chose | 1 year |
| theme (local storage) | Remembers whether you chose light or dark mode | Until you clear it |
| hireos:tours-* (local storage) | Remembers which product tours you have seen or switched off | Until you clear it |
| Form drafts (session or local storage) | Keeps text you have typed into a form so it is not lost if the page reloads | Until the form is sent. Drafts that contain candidate data are deleted when the tab closes. |
01What we store
- The table above lists every cookie and every item of browser storage that HireOSS sets, with its purpose and how long it lasts.
- Some only appear after you sign in, or after you use the feature they support.
- On a secure connection, the sign-in cookie names start with “__Secure-” or “__Host-”.
02Why no consent is asked for
- Norwegian law (ekomloven § 3-15) allows a site to store information in your browser without consent only when it is strictly necessary for a service you have asked for.
- Everything we store meets that test. It either keeps you signed in and secure, or remembers a choice you made.
- If we ever add something that does not meet the test, we will ask for your consent first, with an option to refuse that is as easy to use as the option to accept.
03Error monitoring
- When something breaks, technical details of the error are sent to our error monitoring service, PostHog, hosted in the EU.
- It stores nothing in your browser and does not follow you between visits.
- We do not run product analytics or record sessions.
04Third parties
- No advertising or cross-site tracking cookies are set.
- The sign-up and sign-in forms use Cloudflare Turnstile to keep out bots. It does not set tracking cookies.
- Payment pages are run by our payment provider, Stripe, on its own site. The cookies there are covered by Stripe’s own policy.
Other documents
Terms of service
The agreement between Kermit Tech AS and the organisations using HireOSS.
Privacy policy
How we handle data about the people who use HireOSS.
Sub-processors
The third parties that process customer data on our behalf.
Data processing agreement
Our obligations as a processor of candidate data.
Candidate privacy notice
For applicants whose CV or interview has been assessed in HireOSS.