Cookie policy
The cookies and local storage this site uses, which ones ask for your consent, and the third-party services your browser contacts.
Updated on October 26, 2026
1. What this site sets
A cookie is a small file stored on your device when you visit a site. This one sets three cookies it needs to work (session, signed-in hint, language), two audience-measurement cookies exempt from consent, and two more only if you accept full audience measurement in the banner. It also uses your browser's local storage to remember your choices.
| Name | Purpose | Duration | Category |
|---|---|---|---|
| __Secure-better-auth.session_token | Keeps you signed in between pages. Set by the server, unreadable by the page's scripts (HttpOnly), sent over HTTPS only | 7 days, extended when you use the service; deleted when you sign out | Strictly necessary |
| plume_signed_in | A hint the page can read, mirroring whether the session cookie is there: it only serves to show the right buttons (“My resumes” rather than “Sign in”) on the public pages. It holds nothing but the value 1 | Until the browser is closed; deleted by the server as soon as the session no longer exists, in particular after signing out | Strictly necessary |
| NEXT_LOCALE | Remembers the language you chose (French or English). Set by the server or by the language switch, sent over HTTPS only, SameSite=Lax | Until the browser is closed | Strictly necessary |
| moka_aid | Audience measurement: pseudonymous browser identifier | 13 months from when it is first set, not extended | Audience measurement exempt from consent |
| moka_session_id | Audience measurement: groups the pages viewed in one visit | 30 minutes, extended with each page viewed | Audience measurement exempt from consent |
| moka_visitor_id | Full audience measurement: follows your journey on the site and links it to any purchase | 13 months from when it is first set, not extended | Subject to your consent |
| moka_consent | Full audience measurement: records your consent | 13 months from when it is first set, not extended | Subject to your consent |
The site also uses your browser's local storage, which is never sent to the server:
| Key | Purpose | Duration | Category |
|---|---|---|---|
| plume_consent | Remembers your answer to the audience-measurement banner (accept or refuse), its date and the version of the banner's wording | 6 months, after which you are asked again | Strictly necessary (record and memory of your choice) |
| moka_optout | Remembers that you object to any audience measurement | Until you clear the site's data in your browser | Strictly necessary (memory of your choice) |
All these cookies and keys are set on the site's own domain, never by a third party. The session cookie holds an opaque identifier, no personal data in clear text: without it, staying signed in from one page to the next is impossible. The audience-measurement cookies are set by the script of Moka, the publisher's own audience-measurement tool; they hold only a random identifier. The privacy policy (section 6) details what is measured.
2. What asks for your consent
Article 82 of the French Data Protection Act requires consent before any tracker is stored, but exempts those whose sole purpose is to enable or facilitate communication, or which are strictly necessary to deliver a service the user has expressly requested.
The session cookie, the plume_signed_in hint, the language cookie and the plume_consent and moka_optout keys fall within that exemption: they only keep you signed in, show the site in your language and remember your choices.
The moka_aid and moka_session_id cookies fall within the exemption the CNIL allows for audience measurement: they only produce visit statistics on the publisher's behalf, their lifetime is capped at 13 months, and you can object at any time. The data they produce is neither passed to third parties nor combined with other processing, with a single exception, described below, that applies only if you accept: the visit under way when you give your consent.
The moka_visitor_id and moka_consent cookies go further: they link your journey to any purchase. They are set only if you click “Accept” in the banner. “Refuse” is as easy as accepting, and changes nothing about how you use the site.
If you accept, the visit under way when you give your consent (30 minutes at most) is linked to your full-measurement identifier. Your earlier visits stay in the exempt measurement: they are not linked to that identifier.
Your answer, accept or refuse, is kept for 6 months in this browser's local storage (key plume_consent), together with the version of the banner wording you answered. When it expires, or if that wording changes, you are asked again; Moka first receives a withdrawal, which deletes the moka_visitor_id, moka_consent and moka_session_id cookies. You can change your answer at any time from the “Cookie settings” link at the bottom of the page: refusing after accepting triggers the same withdrawal.
3. What this site does not do
- No audience measurement beyond what is described above, and no link to your purchases without your consent.
- No advertising cookie, no retargeting.
- No social share buttons, no social pixels.
- No sale or transmission of browsing data to third parties.
- No local storage of your content in the browser: your résumés are saved on the server, tied to your account.
4. Third-party services your browser contacts
Your browser contacts two third-party services, each on specific pages. Any connection passes your IP address and technical characteristics of your browser to the server contacted. For transparency:
- Cloudflare Turnstile, the bot check, loads from challenges.cloudflare.com as soon as the sign-up and sign-in pages are displayed, without waiting for you to request a code. It receives your IP address and technical signals from your browser (browser, fingerprint of the encrypted connection). According to Cloudflare's documentation, it sets no tracking cookie on the site. Cloudflare also uses these signals, as a separate controller, to improve its bot detection.
- Stripe provides the Pro plan payment page and the subscription management area, on its own domains (checkout.stripe.com, billing.stripe.com), to which you are redirected. Stripe applies its own security and fraud-prevention trackers there, described in its cookie policy.
The audience-measurement script loads from moka.koumastudio.com, which then receives the pages viewed: it is the publisher's own tool, not a third party, and the IP address is not kept there. Typefaces, including those of the résumé templates, are served by the site itself: none loads from a third-party service.
5. Managing cookies
You can delete stored cookies or block them at any time from your browser settings. Deleting the session cookie signs you out immediately; blocking it makes signing in impossible, but does not prevent you from reading the public pages.
Signing out from the application removes the session cookie with no further steps; the plume_signed_in hint is removed on the next page.
To stop being measured, use the opt-out link in the privacy policy (section 6). Your choice is stored in this browser's local storage (key moka_optout) and the audience-measurement cookies are deleted.
6. Changes
Should a new tracker ever be introduced, this page would be updated before anything is stored, and your consent asked if it requires it. Questions: hello@koumastudio.com.