Cookie Policy
Last updated: August 8, 2026
Xylento sets a small number of strictly necessary cookies to run the service, and — only if you accept the cookie banner — cookies that let us measure how well our ads perform. Nothing else: no third-party analytics, no cross-site tracking, no ad personalization beyond what Google's own advertising cookies do.
Strictly necessary (always on)
xy_sess — keeps you signed in
Up to 30 days (founders), 2hr idle timeout (staff)
xy_mfa — tracks an in-progress two-factor login
5 minutes
Both are set with HttpOnly (inaccessible to page JavaScript), Secure (HTTPS only), and SameSite=Lax. Neither is used for advertising, tracking, or shared with any third party. Under GDPR and the ePrivacy Directive, cookies strictly necessary for a service you've requested don't require consent, so these are never gated by the banner below.
Advertising measurement (only with your consent)
Xylento runs Google Ads campaigns and uses Google's gtag.js tag to measure them — mainly whether someone who clicked an ad went on to submit an application. This can set Google cookies such as _gcl_au (typically retained around 90 days) on your device. We don't see or store the raw cookie values ourselves; Google processes this data under its own privacy policy.
These cookies are off by default. The tag loads with Google's Consent Mode set to "denied" for every visitor until you actively choose "Accept" on the cookie banner. If you choose "Decline," or close the banner without choosing, no advertising cookie is set and none of your activity is shared with Google Ads.
Your choice
A banner asks first-time visitors to accept or decline advertising cookies; your choice is remembered on this device so you won't be asked again. To change your mind, clear this site's data in your browser (or clear localStorage for xylento.com) and reload — the banner will reappear.
Browser controls
You can also block or delete cookies through your browser's settings at any time. Blocking the necessary cookies will sign you out and prevent you from staying logged in to your dashboard; blocking the advertising cookies has no effect on using the site.
Contact
Questions about this policy: team@xylento.com.