What are cookies?
Cookies are small text files placed on your device when you visit a website. They are used to recognise your browser and remember preferences. Websites can also store information in your browser in other ways, such as localStorage and sessionStorage. This policy covers all of these.
What has changed in this version
- Your access token is now kept in an HttpOnly cookie (
a4m_access) that scripts on the page cannot read. It replaces theauth_tokencookie and is no longer stored in your browser's local or session storage. - Support staff who view the platform as a user now use a separate HttpOnly cookie (
a4m_impersonation). - The free demo on our website no longer uses the
playtest_tokencookie. - If you do not choose "remember me", your sign-in cookies end when you close your browser.
How we use cookies
We only use necessary and functional cookies and browser storage: they are needed for sign-in, security and remembering choices you make. We do not use analytics or marketing cookies. Because necessary cookies do not require consent, we do not show a cookie banner.
If we ever want to use cookies that are not necessary, we will update this policy first and only place them with your consent.
1. Necessary and functional cookies (always active)
These cookies are essential for the website and platform to work. Without them, signing in, keeping your session, and switching between organisations do not work.
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
refresh_token | Keeps you signed in and renews your session (HttpOnly, Secure) | 30 days, or until you close your browser if you did not choose "remember me" | Assess4Me |
a4m_access | Short-term access token that authenticates your requests (HttpOnly, Secure) | 15 minutes, or until you close your browser if you did not choose "remember me" | Assess4Me |
a4m_impersonation | Used only by Assess4Me support staff while viewing the platform as a user (HttpOnly, Secure) | Session (at most 15 minutes) | Assess4Me |
active_org_id | Remembers which organisation you are working in (HttpOnly) | Session | Assess4Me |
google_oauth_state | CSRF protection for Google sign-in | 10 minutes | Assess4Me |
google_oauth_code_verifier | PKCE verification for Google sign-in | 10 minutes | Assess4Me |
google_oauth_flow | Distinguishes login from registration during Google sign-in | 10 minutes | Assess4Me |
google_oauth_next | Redirect destination after Google sign-in | 10 minutes | Assess4Me |
google_oauth_origin | Original domain during Google sign-in | 10 minutes | Assess4Me |
sidebar_state | Remembers whether you collapsed the dashboard sidebar | 7 days | Assess4Me |
The refresh_token cookie may be set on .assess4me.com so that you stay signed in when moving between our website and the platform. The a4m_access cookie is only sent to the site that set it.
2. Analytics and marketing cookies
We do not use analytics or marketing cookies. The choices you make on the platform (language, theme, layout) are stored as described under "Local and session storage" below.
3. Third-party content
Some pages load content directly from another provider. When that happens, your browser connects to that provider, which receives your IP address. These providers do not set cookies through our pages.
| Content | Where | Provider |
|---|---|---|
| Fonts | Some assessment games | Google Fonts |
| Profile pictures | Users who signed in with Google | |
| Images on our website | Marketing pages and blog | Sanity |
| Uploaded images and game files | Platform | Amazon Web Services (CloudFront) |
Payments are handled on Stripe's own pages and sign-in with Google happens on Google's pages; their own cookie policies apply there.
Managing cookies
You can view and delete cookies through your browser settings. Please note that blocking necessary cookies may prevent the platform from working correctly.
Local and session storage
In addition to cookies we store the following information in your browser. This data stays on your device and is not shared with third parties.
Local storage (kept until removed):
| Key | Purpose |
|---|---|
auth_user | Your user ID, email address, name and company name, so the platform can show them straight away, when you choose "remember me". It does not contain your access token. |
auth_impersonation | Used only by Assess4Me support staff, to show in every tab that they are viewing the platform as a user |
active_org_id, active_dashboard_context | Which organisation or personal view you are working in |
dashboard-locale, marketing-locale | Your language |
theme | Light or dark mode |
assess4me:view:* | Your preferred list or grid view on some pages |
recruiter_dashboard_tour_v1_* | Whether you completed or restarted the product tour |
Session storage (deleted when you close the tab):
| Key | Purpose |
|---|---|
auth_user | Your user ID, email address, name and company name when you did not choose "remember me" (no access token) |
auth_refresh_suppressed | Prevents an automatic session renewal right after you sign out |
onboarding_checkout_state | Keeps your progress while you complete payment during sign-up |
vacancy_plan_* | Keeps a vacancy you are setting up during sign-up |
vacancy-builder:v1:* | Keeps your draft while you build a vacancy |
When you sign out of the platform, your session information and organisation selection are removed. Your language and product tour status are kept on the device. When you delete your account, your data is deleted from our systems; information stored in your browser can be removed via your browser settings.
Changes
We may update this cookie policy when we add new cookies or tracking tools. The version date at the top will be updated accordingly, and previous versions remain available on this page.
Contact
For questions about cookies or this policy:
- Assess4Me bv
- E-mail: support@assess4me.com