Cookie policy

What is a cookie?

A cookie is a small file stored on your device by a website and sent back to the site on each visit — for example, to keep you logged in. We also use browser local storage (localStorage), which serves a similar purpose. This policy covers both cookies and audience measurement trackers.

The COLLABme mobile app does not use cookies: it keeps the same information in your device's secure storage, and embeds the measurement tool as a software component rather than a script. This policy covers all three forms — cookies, browser local storage, device secure storage — because they serve the same purpose.

Our approach

COLLABme never sells any data. Non-essential trackers — audience measurement and campaign tracking — are disabled by default on the website and in web and mobile apps, and are only activated after your explicit consent, category by category. Declining does not affect your use of the platform in any way.

We should be precise on one point, however: our heatmap tool, Microsoft Clarity, sets cookies on Microsoft domains when it is active, one of which (MUID) also serves advertising and cross-site recognition purposes at Microsoft. We do not use them and have no access to them, but we cannot prevent them from being set as long as you consent to audience measurement. Refusing is enough for them never to be set.

Strictly necessary cookies

These cookies are essential for the service to function and do not require consent:

• Session cookies (prefix __Secure-authjs) — maintain your login across pages and COLLABme applications; duration approximately 30 sliding days.
• Anti-CSRF cookie (prefix __Secure-authjs) — protects forms against forged requests; session duration.
• External login cookies (state, PKCE, nonce) — secure the login process via Google or LinkedIn; expire after 15 minutes.
• NEXT_LOCALE — stores your interface language (French, Dutch, English); approximately 1 year.

Storage on your device

Your browser's local storage keeps preferences that only leave your device when necessary for the service:

• collabme_consent_v1 — your consent choice for trackers; kept until you modify it.
• cm_anon_id — anonymous analytics ID, created only after your consent and deleted if you withdraw it.
• Interface preferences — active organisation, theme, display settings, unsent message drafts.
• collabme_consent_v1 (mobile app) — your measurement consent choice, kept in the device's secure storage. It is specific to the app: accepting or refusing on the site does not carry over to the app, and vice versa.

Analytics (requires consent)

If you accept, these tools help us understand how the platform is used. They are active on the showcase site, web apps, and mobile app, as specified below.

• PostHog (hosted in the European Union) — usage statistics on the public site: pages viewed, journeys, features used.
• Microsoft Clarity, on the site and the web applications — heatmaps and anonymised replay of journeys (clicks, scrolling, cursor movement) to spot friction points in the interface. The content of input fields is masked and never recorded.
• Microsoft Clarity, in the mobile app — recording of the screens displayed and of gestures (taps, scrolls), for the same purposes. Input fields, conversations and message previews are masked before any recording. The mobile app's measurement project is separate from the web one.
• Google Analytics, on the showcase site and business space — page views, user journeys, and clicks on registration buttons, linked to a pseudonymous identifier. Our servers also send key steps in your journey (sign-up, end of onboarding, application, listing publication, interview, etc.), whether they occur on the site, in web apps, or in the mobile app — without your name, email address, or content.
• Our own first-party product events — collected on our servers: pages and screens viewed, actions taken (applying, publishing, searching, sharing, switching roles), without storing your IP address, search terms, or message content — full page URLs are stripped of identifiers before sending. Linked to the anonymous identifier cm_anon_id and purged after 13 months.

Advertising measurement (consent required)

If you accept — by clicking « Accept all » or ticking « Advertising measurement » — we track the effectiveness of our campaigns on Google and Meta (Facebook, Instagram): which ads lead to sign-ups, internship listings, or applications, and adjust their delivery. Without this consent, none of the following applies.

• Meta Pixel, on the showcase site and business space — page views and key steps seen by the browser (clicking a registration button, viewing a listing, starting an application).
• Meta Conversions API, from our servers — key steps taken on the platform (sign-up, application, listing publication, interview, internship accepted, etc.), along with your hashed email address, hashed phone number, and hashed internal user ID (made unreadable before sending), the Meta advertising cookie ID, and your browser description so Meta can link the step to an ad. No conversation content, health data, or IP address is transmitted.
• Google Analytics in advertising mode — your consent is passed to Google (Consent mode v2); without it, Google counts the step but does not use it for advertising.
• In the mobile app, the Meta SDK and Firebase Analytics (Google) follow the same choices: nothing starts without your consent. On iPhone, Meta receives nothing until you also "Allow Tracking" in Apple’s window; on Android, consent to advertising measurement in the app is sufficient. Details are in the privacy policy.
• The « Founding companies » form never sends the contact details you enter to ad platforms.

Measurement does not apply to minor accounts

COLLABme welcomes students, some of whom are minors. Tools for tracking user journeys and heatmaps — Microsoft Clarity, on web and mobile — are never activated for accounts identified as minors, regardless of the choice made in the consent banner. This exclusion is enforced by the platform itself: it is not configurable and cannot be overridden.

Advertising measurement — Google and Meta tags, and server-side transmissions to these platforms — is never activated for accounts identified as minors. For these transmissions, we go further: nothing is sent until the account’s date of birth is provided.

It relies on the date of birth declared in the profile. Until it is provided, we cannot know if an account belongs to a minor: we prefer to say this rather than imply absolute certainty. Aggregated usage statistics for these accounts remain subject to your consent — and to that of the legal guardian when required.

Manage your consent

On your first visit, a banner lets you accept, decline, or customize audience and advertising measurement. Until you respond, no measurement trackers are set and no events are sent.

You can change your mind at any time, and withdrawing must be as easy as giving consent. On the website, the « Manage my cookie preferences » button at the bottom of this page clears your choice and shows the banner again. In web apps, the same option is in your settings under « Privacy ». In the mobile app, it’s in Settings → Privacy.

Withdrawing anywhere removes the anonymous measurement ID, stops ongoing recording, and halts event sending; Microsoft Clarity cookies already set on our domain are deleted, and Google and Meta are notified of the withdrawal. Our servers stop sending your steps to ad platforms, including any queued for transmission. A choice applies to the surface where it’s made: the website, web apps, and mobile app each keep their own — but for server-side transmissions, a refusal on one overrides the others. You can also clear cookies in your browser settings or uninstall the mobile app.

Third-party cookies

Some cookies are not set by us but by services the platform uses:

• Microsoft Clarity, if you consent to audience measurement — _clck (measurement ID, kept for up to one year) and _clsk (links pages in the same visit, for one day), set on our domain; plus CLID, MUID, ANONCHK, MR, and SM, set by Microsoft on its own domains. None are set until you accept, and declining removes them.
• Google Analytics, if you consent to audience measurement — _ga (measurement ID, kept for 13 months) and _ga_EM2FEE3QZL (links pages in the same visit), set on our domain; and, if you consent to advertising measurement, _gcl_au and _gcl_aw (links a sign-up to a Google ad, 90 days).
• Meta, if you consent to advertising measurement — _fbp (browser ID, 90 days) and _fbc (last click on a Meta ad, 90 days), set on our domain; Meta may also read its own cookies on its domains (Facebook, Instagram) under its own policy.
• Google and LinkedIn, if you sign in via them; Stripe, if you pay for a subscription. These services operate on their own domains, set their own cookies, and are governed by their own policies.

Questions

For any questions about this policy: info@collabme.be. To understand how we process your personal data beyond cookies, see our privacy policy.