Cookie disclosure · §25 TDDDG
Cookies
HackTalents sets two cookies. Both are needed to keep you signed in. There is no analytics, no advertising, no tag manager and no third-party script anywhere in the product — which is why you are reading a disclosure rather than clicking through a consent banner.
Why there is no banner
§25(1) TDDDG requires prior consent before storing anything on your device. §25(2) no. 2 exempts storage that is strictly necessary to provide a service you explicitly requested. A session cookie that keeps you logged in is the textbook example. We have deliberately not added a banner for it: a consent dialog that only ever asks about cookies you cannot decline teaches people to dismiss dialogs without reading them, and buys no protection.
This holds only as long as the list below stays this short. The first analytics pixel, embedded video or marketing tag flips the analysis: prior opt-in becomes mandatory, the reject control has to be as prominent as accept, and nothing non-essential may be set before a choice is made.
Paying for credits is the case where that would normally happen, and we have deliberately built it so it does not. Card details are never collected here: buying credits sends you to our payment provider's own page, on the provider's own address, and returns you afterwards. No payment script runs on this site and no payment cookie is set under our domain. Whatever the provider stores while you are on its page is disclosed by the provider there; the provider is named in our privacy notice.
What we set
| Name | Purpose | Duration | Party |
|---|---|---|---|
sb-luxcrpgxjffwatkyvlyw-auth-token | Holds the signed-in session (access and refresh token). Without it you cannot stay logged in. Split across -auth-token.0 / .1 when the value exceeds the browser's per-cookie size limit. | Until the session is revoked or you log out; refreshed on use | First-party |
sb-luxcrpgxjffwatkyvlyw-auth-token-code-verifier | Short-lived PKCE verifier that completes an email-confirmation or password-reset link. Deleted as soon as the code is exchanged. | Minutes — deleted on completion of the sign-in exchange | First-party |
Flags
Both cookies are first-party, scoped to /, and set with SameSite=Lax — they are not sent on cross-site requests, which blocks the usual CSRF path. In every deployed environment they carry Secure, so they are never transmitted over plain HTTP. Locally, over http://localhost, Secure is omitted because the browser would otherwise discard the cookie.
They are deliberately not HttpOnly. The sign-in, sign-out and session-refresh code runs in your browser and has to read the session out of the cookie; making it HttpOnly would break authentication without hardening anything. Script injection is defended against instead by a strict Content-Security-Policy that refuses to load scripts from any origin but our own, along with X-Frame-Options: DENY and a no-referrer policy.
Turning them off
You can clear or block them in your browser settings at any time. Blocking them means you cannot sign in — there is no way to hold a session without one. Nothing else in the product depends on cookies, so the public pages, including this one and the imprint, work with cookies blocked entirely.
Questions about this disclosure: contact@hacktalents.ai. The wider picture is in the privacy policy.