Cookie policy
Which cookies CoreSkill uses: strictly necessary cookies that keep the service working, preference cookies, and, only when enabled and allowed by your choices, analytics and advertising cookies from Google, Meta and TikTok. You can change your choice at any time in Cookie settings.
Effective 22/9/2026
This policy explains which cookies and similar technologies Core Skill uses on CoreSkill. A cookie is a small piece of data a website asks your browser to hold and send back on later requests. Most cookies CoreSkill sets are strictly necessary: they keep you signed in, protect sign-in and registration, and carry a freshly created secret to the page that shows it once. A few remember your preferences. In addition, and only if the relevant integration has been switched on and your choices allow it, analytics and advertising cookies from Google, Meta and TikTok are used to measure visits and the effectiveness of our advertising. The companies that set those cookies can link them to your activity on other websites.
1. Strictly necessary cookies that CoreSkill sets
| Name | What it is for | Lifetime |
|---|---|---|
authjs.session-token | Keeps you signed in. HttpOnly, so scripts on the page cannot read it. It holds a signed, encrypted token, never your password. | Up to 30 days, renewed while you are active; removed when you sign out |
authjs.csrf-token | Protects the sign-in forms against cross-site request forgery. | Browser session |
authjs.callback-url | Remembers the page you were trying to reach, so you land there after signing in. | Browser session |
authjs.state, authjs.pkce.code_verifier, authjs.nonce | Set only when you sign in with Google or Facebook. Single-use values that stop an attacker from hijacking the sign-in flow. | 15 minutes |
reg_otp | Set while you register. Ties the pending registration to the browser in which you entered your password, so a code sent to your email cannot complete someone else's sign-up. HttpOnly. | 10 minutes |
mfa_setup, mfa_codes | Carry the state of two-factor setup and your new recovery codes to the page that shows them once. HttpOnly, and deleted as soon as they have been used. | 2 minutes |
gmail_oauth_state | Only for system administrators connecting a mailbox. A single-use anti-forgery value for that flow. | 10 minutes |
Over HTTPS the session cookies carry a __Secure- or __Host- prefix, which tells the browser never to send them over an unencrypted connection.
2. Cookies that show a secret once
When you have just issued a key or created an invitation, the system puts that value in a very short-lived HttpOnly cookie so that the next page can display it, then deletes the cookie as soon as it has been shown. Only a hash of the key is stored, so afterwards nobody can read it back to you.
| Name | Set when | Lifetime |
|---|---|---|
new_key, new_keys | You issue one or several service keys on a skill server. | 2 minutes |
new_member_key, new_member_keys | You issue one or several staff keys. | 2 minutes |
new_agent_key | You issue a management MCP key. | 2 minutes |
new_invite | You create an invitation and the link is shown for copying. | 2 minutes |
Why a secret never goes in the address bar
A value in a URL ends up in browser history, in server and proxy logs, and in every link someone pastes to a colleague. An HttpOnly cookie that lives for two minutes does none of that, which is why a new key appears on the next page rather than in the address bar.
3. Security cookies from our network provider
CoreSkill is delivered through a network and security provider that filters attacks and automated traffic before it reaches the application. Where that protection is active, the provider may set the strictly necessary security cookies below. They describe traffic, not people, are not used for advertising, and Core Skill cannot use them to identify you.
| Name | What it is for | Lifetime |
|---|---|---|
__cf_bm | Distinguishes automated traffic from human traffic so that attacks are filtered out. | 30 minutes |
_cfuvid | Groups the requests of one visitor so that rate limits apply fairly. | Browser session |
4. Preference cookies
| Name | What it is for | Lifetime |
|---|---|---|
cs_consent | Remembers your choice about analytics and advertising cookies, including a refusal, and when you made it, so that you are not asked on every page and both your browser and our server respect the same choice. It holds no identifier. | 12 months, after which you are asked again |
locale | Remembers whether you chose English or Tieng Viet. Set only when you pick a language yourself. | 365 days |
org | Remembers the business you last opened, so you land straight back in it. | 365 days |
5. Stored on your device, but not cookies
- Light or dark theme and whether the sidebar is collapsed are kept in your browser's local storage. They are never sent to the server and are remembered per device.
- The width, open state and last section of the help panel are stored the same way.
- Whether you have finished the onboarding tour for a business is stored the same way, so the tour is not shown again.
- These are display conveniences only. Clearing them returns the interface to its defaults and loses nothing else.
6. Analytics cookies (optional)
If Google Tag Manager with a Google Analytics tag is switched on, Google Analytics uses the cookies below to count visits and understand how people find and use CoreSkill. They are set on the CoreSkill domain but are read by Google, which processes the data under its own terms.
| Name | Provider and purpose | Lifetime |
|---|---|---|
_ga | Google Analytics. Distinguishes one browser from another so that visits can be counted. | Up to 2 years; many browsers shorten this |
_ga_<container-id> | Google Analytics. Keeps the state of the current visit. | Up to 2 years; many browsers shorten this |
7. Advertising cookies (optional)
If the Google Ads, Meta or TikTok integration is switched on, the cookies below are used to measure whether our advertising leads to visits and sign-ups, to count each sign-up once, and to let these companies show our ads to people who may be interested. The companies can combine these identifiers with what they know from other websites and from your accounts with them. Lifetimes described as typical are set by the provider and may change; the provider's own policy is authoritative.
| Name | Provider and purpose | Lifetime |
|---|---|---|
_gcl_au | Google Ads. Links an ad click to a later visit or sign-up. | Typically 90 days, as set by Google |
_fbp | Meta. Identifies the browser for ad delivery and measurement. | Typically 90 days, as set by Meta |
_fbc | Meta. Stores the click identifier (fbclid) when you arrive from a Meta ad. | 90 days |
_ttp, ttcsid, ttcsid_<pixel-id> | TikTok. Identify the browser and the visit for ad delivery and measurement. | 13 months from when last set or used |
ttclid | TikTok. Stores the click identifier when you arrive from a TikTok ad. | 13 months from when last set or used |
_tt_enable_cookie | TikTok. Records whether TikTok cookies may be used in this browser. | Up to 13 months, as set by TikTok |
cs_track_evt | CoreSkill. Set once, right after you complete registration, and only when advertising cookies are allowed. Holds a random event ID so that the sign-up reported by your browser and by our server is counted once. | 10 minutes |
| Cookies on the providers' own domains | TikTok (for example _ttp on its own domain, and _pangle), and Google and Meta cookies that their tags may read or set on their own domains, including when you are signed in to their services. | Under each provider's policy (TikTok: 13 months) |
8. When optional cookies are used
- Only if switched on. Each integration is optional and is configured by the operator of CoreSkill. If an integration is off, its script is not loaded and none of its cookies are set.
- Not everywhere. These tools run on the public pages and, only if enabled, in the signed-in app. They are never loaded on administrative pages, on the API and MCP endpoints, or on invitation, password-reset and email-verification pages. In the signed-in app, page addresses are reduced to a generic pattern without business, server or skill identifiers.
- European Economic Area, United Kingdom, Switzerland, and anywhere your location cannot be determined: analytics and advertising cookies are off until you accept them in the cookie banner. You can accept or refuse each category, and refusing is as easy as accepting.
- Everywhere else: they are on by default, and the banner lets you refuse them. Your choice applies from then on.
- Google consent mode. Until you allow analytics or advertising, Google tags do not read or write analytics or advertising cookies, although Google may still receive limited signals without a cookie identifier, such as that a page was viewed.
- Meta and TikTok pixels are only activated once advertising cookies are allowed. The sign-up event our server sends to Meta and TikTok follows the same choice; see the Privacy policy.
- If you sign in with Google or Facebook, or pay through a payment provider, those companies also set their own cookies on their own pages, under their own policies.
9. Your choices and how to change them
- Use Cookie settings, linked at the foot of the public pages and, where these tools also run in the signed-in app, in your account settings, to accept, refuse or withdraw consent for analytics and advertising at any time. Withdrawing is as easy as giving consent.
- Withdrawing stops these tools from being used from then on. It does not undo data already sent to a provider; cookies already set can be removed in your browser.
- Every browser lets you view and delete a site's cookies. Deleting the CoreSkill cookies signs you out, resets the language to the default and brings the cookie banner back.
- If you block this site's cookies entirely, you cannot sign in, because the session is a cookie. Blocking only third-party cookies does not affect signing in.
- Google, Meta and TikTok also offer ad settings in your accounts with them, where you can limit personalized advertising.
- On a shared computer, use Sign out when you finish rather than just closing the tab. Clearing local storage resets the theme, the sidebar and the help panel, and affects nothing else.
10. Changes and contact
When the list above changes, this policy changes with it and the effective date is updated. If a new provider or a new purpose is added to the optional categories, you will be asked for your choice again where consent is required. Questions about cookies and personal data go to [email protected], anything else to [email protected], or by post to Core Skill, coreskill.app. This policy takes effect on 22/9/2026.