Last updated 26 September 2026 · Version 2026-09c
In short
A cookie is a small file a website asks your browser to keep, so the site can recognise the same browser from one page to the next. Browser storage does the same job without being sent back to the website each time.
Almost all of them are ones the site needs to work: keeping you signed in, protecting sign-in and card payments, and remembering a setting you chose. The one thing that is not is counting visits, which tells us which pages are used so we can improve Staffroom24. We do not use advertising, and nothing here follows you to other websites.
Under the Privacy and Electronic Communications Regulations, cookies and storage that are strictly necessary for a service you asked for do not need your consent, so we do not ask about them. Counting visits does need it, so we ask first, No thanks is as easy as Allow, and nothing is stored or sent for it until you choose Allow.
Counting visits
If you choose Allow, PostHog counts visits for us: which pages are opened and left, and a handful of moments such as a candidate being added or a reference being sent. To find and fix faults it also records the visit, with everything on the screen hidden, and notes any error a page hits. It keeps all of it in the European Union, and it reaches PostHog through our own address.
- Each page is counted with names, references and the codes in our links taken out of its address, so a candidate’s record is counted as a candidate’s record and never by who it is.
- The recording shows where you click and scroll and which pages you move between. Every word on the screen is hidden in your browser before anything is sent, pictures, videos, documents and signatures are replaced by empty boxes, and nothing you type is recorded.
- Pages with your documents, your identity check, your photograph or a video call are never recorded at all.
- An error a page hits is sent with where in our code it happened, with names, email addresses and references taken out. Never what you typed.
- Recordings are kept for 30 days and counts for no longer than 12 months.
- If you are signed in to an agency account or our staff screens, the count knows your account’s reference, your role and your agency. Never your name, email address or telephone number.
- Candidates and referees are never told apart from any other visitor.
Your answer is kept in this browser, so on another browser or device you are asked again. You can change it here at any time. Choosing No thanks after Allow stops the count and the recording straight away and removes what PostHog stored.
We are not counting visits at the moment, so there is nothing to choose.
The cookies we use
Reading this website sets no cookies at all. The ones below are set when you sign in to the agency app, open your own pages as a candidate, or save a card.
| Name | Set by | What it is for | How long | Consent |
|---|---|---|---|---|
sb-…-auth-tokenCookie | Supabase | Signing in to the agency app and staff screensKeeps you signed in, so each page knows it is you. The middle of the name is our database's reference, and a long session is split across numbered cookies of the same name. | Until you sign out, and never more than 400 days | Not needed. Strictly necessary. |
sr24_view_asCookie | Us | The agency app, for Staffroom24 staff supporting an agencyRecords that a member of Staffroom24 staff is looking at an agency's app as the agency sees it, read only. It is signed, names the member of staff and the agency, and is honoured only while they are still staff. | 30 minutes, and it ends when they press Exit or sign out | Not needed. Strictly necessary for security. |
sr24_view_as_apiCookie | Us | The exports and Alex behind the agency app, for Staffroom24 staff supporting an agencyThe same record as sr24_view_as, sent to the exports and Alex so they answer for that agency and refuse any change. | 30 minutes, and it ends when they press Exit or sign out | Not needed. Strictly necessary for security. |
sr24_second_factorCookie | Us | Signing in to the agency app and staff screensRecords that this browser passed the emailed code at sign-in, so you are not asked for one on every page. It is signed and tied to your sign-in, so it is worthless anywhere else. | 30 days, and it ends when you sign out | Not needed. Strictly necessary for security. |
sr24_portalCookie | Us | A candidate's own pagesKeeps a candidate in their own pages after they open the link in an email from us, which signs them in once and within 24 hours of sending, or type the code from one. It is signed, holds nothing but a reference to their file, and no script on the page can read it. | 30 days | Not needed. Strictly necessary. |
sr24_staff_scopeCookie | Us | Staffroom24's own staff screensRemembers whether a member of our staff chose to see their own agencies or all of them. | One year from the last time the choice was made | Not needed. Strictly necessary to remember your choice. |
__stripe_midCookie | Stripe | The card step in the agency appSet by Stripe's own card fields to spot fraudulent card payments. It is only set on the page where an agency saves its card. | One year | Not needed. Strictly necessary for security. |
__stripe_sidCookie | Stripe | The card step in the agency appSet by Stripe's own card fields, alongside the one above, to spot fraud during one visit. | 30 minutes | Not needed. Strictly necessary for security. |
Where an agency has its own Staffroom24 address, the sign-in cookies are shared between that address and this site, so signing in once covers both.
Browser storage
A few settings are kept in your browser rather than in a cookie. They never leave your device and are never sent to us, apart from PostHog’s two, set only if you allow counting visits, which hold the random number a visit is counted and recorded under.
| Name | Set by | What it is for | How long | Consent |
|---|---|---|---|---|
staffroom24:bootedBrowser storage, this tab only | Us | This websiteNotes that the opening animation has already played in this tab, so it is not shown on every page. It holds nothing about you. | Until you close the tab | Not needed. Strictly necessary. |
staffroom24.alex-dockBrowser storage, this tab only | Us | The agency app and the staff screensRemembers which conversation Alex beside the page was showing, so it is still there as you move between pages in this tab. It holds none of the conversation and nothing about you. | Until you close the tab | Not needed. Strictly necessary to remember your choice. |
staffroom24.alex-layoutBrowser storage, kept | Us | The agency app and the staff screensRemembers how you left Alex beside the page: open or shut, pinned down the right or floating, how wide, and where you put the window, so it is the same on your next visit. It holds none of the conversation and nothing about you. | Until you clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.install-hintBrowser storage, kept | Us | The agency app and a candidate's own pages, on an iPhone or an iPadRemembers that you put away the note on adding Staffroom24 to your home screen, so it is not shown again. | Until you clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.mail-detailsBrowser storage, kept | Us | The staff mail screen, on a computerRemembers whether you keep the details column open beside a thread, so the next thread opens the same way. It holds nothing about you. | Until you change it or clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.railBrowser storage, kept | Us | The agency app and the staff screens, on a computerRemembers that you folded the menu down the left to its narrow strip of icons, so it stays folded on the next page. It holds nothing about you. | Until you unfold the menu or clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.chat-dockBrowser storage, kept | Us | The agency app, on a computerRemembers that you left the chat with us open down the right-hand side, so it stays open on the next page. It holds nothing about you and none of the conversation. | Until you close the chat panel or clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.script.wholeBrowser storage, kept | Us | Staffroom24's own interview screenRemembers whether an interviewer chose to see the whole interview script at once. | Until you clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.notifications.cardBrowser storage, kept | Us | A candidate's own pagesRemembers that you put away the offer of notifications on this phone, or turned them off, so the offer is not shown to you again. It holds nothing about you. | Until you clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.portal-linkBrowser storage, kept | Us | A candidate's own pages, after asking for a new linkRemembers the email address a new link was just asked for, so the box for the code from that email is still there if the phone reloads the page. It is removed once the code is used. | 10 minutes, the life of the code, and removed the next time the page opens after that | Not needed. Strictly necessary. |
staffroom24.unsent.…Browser storage, this tab only | Us | A conversation in a candidate's own pagesKeeps a message you were sending for one reload, when Staffroom24 has been updated since the page opened and the page has to load again before it can send. It is put back in the box and removed straight away. | One reload, and never past closing the tab | Not needed. Strictly necessary. |
staffroom24.register.first-name.…Browser storage, this tab only | Us | An agency's registration pageKeeps the first name you have just typed for the page that thanks you after you register, so it can greet you by it. The end of the name is the agency's short name. It never leaves your browser and is removed the next time the form opens. | Until the form opens again, and never past closing the tab | Not needed. Strictly necessary. |
staffroom24.item.…Browser storage, kept | Us | An item on What we still need, in a candidate's own pagesKeeps what you typed on one item and have not saved yet, so it is still there when you come back on this phone. It never leaves your browser and is removed as soon as you save the item. | Until you save the item, or clear your browser's site data | Not needed. Strictly necessary. |
staffroom24.palette.recentBrowser storage, kept | Us | The agency app and Staffroom24's own screensRemembers the last five candidate records you opened, so the search box you open with Ctrl K can offer them before you type. It holds the records' internal ids and nothing else, and never leaves your browser. | Until you clear your browser's site data | Not needed. Strictly necessary to remember your choice. |
staffroom24.analytics-consentBrowser storage, kept | Us | Every page, once you answer whether we can count visitsRemembers your answer to whether we can count visits, Allow or No thanks, so the question is not asked on every page. It holds your answer and nothing else, and never leaves your browser. | Until you clear your browser's site data, or change your answer on this page | Not needed. Strictly necessary to remember your choice. |
ph_…_posthogBrowser storage, kept | PostHog | Every page, only if you chose AllowCounts visits: a random number for this browser, so a return visit is counted as the same visitor, and when the current visit began, which also ties the masked recording of a visit together. For somebody signed in to the agency app or our staff screens it also holds their account's reference, never their name or email address. It is sent with each count. | Until you choose No thanks on this page, which removes it, or clear your browser's site data | Asked first. Only set if you choose Allow. |
ph_…_window_idBrowser storage, this tab only | PostHog | Every page, only if you chose AllowTells one open tab from another, so the pages of a visit are counted in the order they were read. The middle of the name is our PostHog project's public key, and a second key of the same kind notes that a tab is open. | Until you close the tab | Asked first. Only set if you choose Allow. |
On other services’ pages
Two things happen on pages that belong to the services we use, under their own cookie notices rather than ours.
- Stripe. A candidate paying for their own check, and an agency managing its payment details, do so on Stripe’s own pages, which set Stripe’s cookies to take the payment safely.
- Daily. An ID interview runs in a video frame served by Daily from its own address. Anything that frame stores is kept under Daily’s address, to run the call.
The fonts on this site are served from our own address, so reading it tells no font service that you visited.
Controlling cookies in your browser
Every browser lets you see and delete the cookies and storage a site has set, and block them. Look in your browser’s settings, usually under Privacy or Site data:
- Chrome and Edge: Settings, then Privacy and security, then Cookies and other site data
- Safari on a Mac: Settings, then Privacy, then Manage Website Data
- Safari on an iPhone or iPad: the Settings app, then Safari, then Advanced, then Website Data
- Firefox: Settings, then Privacy and Security, then Cookies and Site Data
To change your answer about counting visits, use the two buttons under Counting visits above rather than your browser’s settings.
The website itself reads perfectly well with cookies blocked. Signing in, a candidate’s own pages and saving a card will not work without them, because those are what the cookies are for. Clearing them signs you out.
Questions
Write to hello@staffroom24.com. How we handle personal data more widely is in our privacy notice.