Cookie and tracking notice

CHiiRO reaches you through two things, and only one of them is a browser.

Conflating the two is the usual error in a notice like this, and it is usually made in the direction that flatters the operator: a site with no cookies is described alongside an app full of analytics identifiers, under one heading, so that "we don't use cookies" appears to cover both. It does not. The app is where most third-party identifiers exist, and clause 4 states exactly which ones and what they do. The website's one measurement service, Google Analytics, is in clause 2.

Every entry in clause 4 was read from the shipping application source — the dependency manifests, both Android manifests, the Android network security configuration, the Firebase configuration and the app's privacy manifest. The website entries in clause 2 were read from this site's source and its build output.

The limit, stated honestly: a static read of the source proves what is linked and initialised. It does not prove every network request a running application makes. The only thing that proves that is a traffic capture from a real device, and one has not been run. If a capture ever contradicts clause 4, clause 4 is wrong and will be corrected rather than defended.

This website uses Google Analytics 4 (the Google tag, measurement ID G-9Q6JV3V68B), loaded from www.googletagmanager.com on the pages of chiiro.co. It measures page views and how visitors arrive — from search, from AI assistants, from links. It is not on app.chiiro.co and it is not in the mobile app.

How it is configured: Google Signals is off; no advertising features, advertising link or ad personalisation; no user ID is sent; data is kept for 14 months; visits from the operator's own network are filtered out. RooTree Analytic Inc. sees the results only as aggregate reports.

What the Google tag sends to Google on each page: the page address and title, the referring page, your browser, device type, screen size and language, and your IP address, which Google uses to derive an approximate location.

• In the European Economic Area, the United Kingdom, Switzerland and Quebec: analytics and advertising storage are off by default and this site has no control that turns them on. Google Analytics sets no cookies. The Google tag still sends the measurement requests described in 2.1, without a cookie identifier (Google's "consent mode").
• Everywhere else: analytics storage is on by default. Google Analytics sets two first-party cookies on chiiro.co: _ga and _ga_9Q6JV3V68B. They hold a random identifier that tells a returning browser from a new one, and they expire after two years.

To refuse them: block cookies for chiiro.co in your browser, turn on your browser's tracking protection, or install Google's opt-out add-on (tools.google.com/dlpage/gaoptout). The site works normally either way.

If you use the light/dark toggle, your choice is written to your browser's local storage under the key chiiro-theme, with the value light or dark. It exists so the page does not flash the wrong theme the next time you open it. It is written only when you operate the toggle, it is never sent anywhere, and it is not an identifier. Clearing your browser's site data removes it.

The typeface files are self-hosted — served from this site, not requested from a font network, so loading a page does not send your IP address to one. No video player, map, social feed, chat widget or comment system is embedded.

There is no consent banner on this website today. Visitors in the regions named in 2.2 get the default without cookies; visitors elsewhere get the analytics cookies by default and can refuse them as 2.2 describes.

This notice is revisited — before the change goes live, not after — if the website gains any further measurement tool, a form that stores anything, an embedded third-party widget, a font, script, stylesheet or image loaded from another domain, a login or remembered personalisation, or a hosting feature that sets its own cookie. The live response headers are re-checked after any hosting change.

Versions up to 1.0.15 also included Firebase Analytics and Mixpanel, which started at launch. They were removed in version 1.0.16 (Privacy policy clause 2.4).

Each line was checked against the dependency manifests rather than assumed.

Firebase Crashlytics (Google). Only if you allow analytics & diagnostics (clause 6). When the app crashes, it sends Google the crash stack trace, your device model and operating-system version and, when you are signed in, a pseudonymous key for your account (never your name or email), so we can tell whether a crash keeps happening to the same person.

Firebase Performance Monitoring (Google). From version 1.0.25, and only if you allow analytics & diagnostics. It measures how long screens take to show their content and, on Android, how smoothly they draw, with the device model, operating-system version and app version. The measurements contain no content you write and no account identifier.

Firebase Authentication and Google Sign-In (Google). Only if you choose to sign in with Google. Stores a sign-in token on your device, and carries the authentication exchange itself; Google tells us your Google account's email address and name, which is the point of the feature. If you sign in with an email address and password, or with LinkedIn, neither is used.

OneSignal (older app versions only). Stores a push subscription ID. Sends OneSignal that subscription ID, your device model and operating-system version, your permission state, and — once you are signed in — your CHiiRO account identifier. On those versions that collection is real and it starts at app launch, which is why it is disclosed here.

What it does with that identifier. CHiiRO uses the subscription to send you push notifications. This applies to devices on older app versions. Newer versions use Firebase Cloud Messaging instead (clause 4.5). The notifications are about replies and activity that involve you and, as it rolls out to members, at most one daily suggestion, sent only when there is something real to say. You can turn the daily suggestion off in the app (Settings → Notification preferences), and you can stop all push notifications with the notification permission in your device settings. Disclosures clause 4.4 says how the identifier is reset.

Google and OneSignal process this data in the United States and other countries.

The one thing worth understanding: these identifiers are per-device and per-install until you sign in. When you sign in, your push token is linked to your account so notifications reach you and, if you allow analytics, crash reports carry a pseudonymous key for your account, so we can tell whether a crash keeps happening to the same person. Neither is your name or email.

A push token is not a cookie. It is a device identifier. The app asks your phone for it, stores it, and sends it to our servers so we can deliver notifications to that phone. It is used for nothing else, and it is not an advertising identifier.

On newer app versions the token comes from Google Firebase Cloud Messaging, which delivers the notification to Android directly and, on iPhone, passes it to Apple's push notification service. Devices on older app versions use OneSignal instead. Signing out of the app stops notifications being sent to that phone.

The app also tells us when a push notification was delivered and when you opened it. That receipt holds a message ID, the event, your platform and whether the app was open, in the background or closed. It holds no notification content. The Privacy policy says how long records are kept.

To turn push notifications off, open your phone's settings, choose the CHiiRO app, then Notifications, and switch them off. On iPhone this is Settings, then Notifications, then CHiiRO. Uninstalling the app also stops them.

The app stores the following in its own private storage area on your phone. None of it is a cookie, none of it is readable by other apps, and none of it is sent anywhere except as described in clause 4: your sign-in session and basic account details, so you are not asked to sign in every time; your theme and language choices; your messaging session details, so your conversations load; your résumé display preference; your privacy choice (clause 6); and the identifiers in clause 4.4.

All of it is removed when you uninstall the app or clear the app's data.

1. When you open a link or view a document from inside CHiiRO, the app hands it to your device's own browser in an in-app window. Anything stored by that page — including cookies — belongs to the site you visited and to your browser. It is not ours, we cannot read it, and your browser's settings control it.
2. If you sign in with LinkedIn, the app opens LinkedIn's own sign-in page in a private browsing window, so no LinkedIn session cookie is kept on your device afterwards. That was verified in the source. It is a deliberate choice and a good one.

• Notifications: Settings → Apps → CHiiRO → Notifications stops push notifications on this device (on iPhone, Settings → Notifications → CHiiRO). In the app, Settings → Notification preferences turns the daily suggestion off on its own. Neither removes the push identifier described in clauses 4.3 and 4.5 — clause 4.4 says how it is reset.
• Contacts: the same screens. Revoking the permission stops any further access to your address book immediately.
• Reset the identifiers: clear the app's data, or uninstall and reinstall. New identifiers are generated.

Delete your account in Settings → Delete Account, or by the other routes in clause 8 of the Privacy policy. You then have 30 days to restore it by signing in again. Clause 8 sets out what happens after that, and what is kept.

Turn analytics & diagnostics off at any time in Settings → Privacy — clause 6.