Cookies and Local Storage Notice

In short

• Our code sets no cookies. Takehome's pages and API responses do not set cookies, and our scripts do not use local storage, session storage or IndexedDB.
• One thing is stored on your device on purpose: a service worker and its cache, so the calculators keep working offline. It holds copies of our own pages and files.
• Cloudflare, which hosts the site, may set its own security cookies in some situations and asks your browser to report network errors.
• No analytics, advertising or tracking. Scripts from other domains are blocked by our Content Security Policy, except Cloudflare Turnstile on the signup form, which loads only when you start filling it in (section 5).
• Questions: Gautam Khosla, developwith.gt@gmail.com.

This notice explains exactly what takehome.gautamkhosla.com stores on your device and why. It is part of our Privacy Policy.

1. Cookies

• Takehome's own code sets no cookies. No page, script or API response from Takehome includes a Set-Cookie header, and no script reads or writes document.cookie.
• Cloudflare security cookies. Cloudflare protects the site from attacks and automated abuse. If Cloudflare decides to check whether a visitor is a bot, or shows a challenge page, it may set a strictly necessary security cookie on our domain, such as __cf_bm (expires after 30 minutes of inactivity) or cf_clearance (records that a challenge was passed). These cookies are set by Cloudflare for security, are not used by us, and do not track you across other websites. Cloudflare describes them at developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/.
• No advertising, analytics or social media cookies, and our code sets no third-party cookies. What Cloudflare Turnstile may store in your browser on the signup page is described in Cloudflare's Turnstile privacy addendum; we do not read it.

2. Local storage, session storage and IndexedDB

None. Takehome's scripts do not use localStorage, sessionStorage or IndexedDB. The figures you type into a calculator are kept only in the open page and disappear when you close it. They are not saved on your device or sent to us.

3. Service worker and offline cache

What it is. The home page and the calculator pages register a small script called a service worker (/sw.js). Once registered, it runs for every page of takehome.gautamkhosla.com in that browser.

What it stores. It keeps one cache, named takehome-shell-v4, in your browser's Cache Storage:

• the calculator script and the calculation engine (/engine/calculator.js, /engine/takehome_wasm.js, and /engine/takehome_wasm_bg.wasm, about 0.5 MB), downloaded when the service worker installs; and
• a copy of the site pages (addresses without a query string) and static files (styles, scripts, fonts, images and the engine) you load from our site afterwards.

It never stores responses from the API (/v1/), the signup and email verification pages, or any response marked not to be stored, so the API keys shown on the verification page are never kept in this cache.

Why. It loads each page from the network first and uses the cache only when you are offline, so the calculators still work without a connection.

How long. Until you clear the site's data, or until a new version of the service worker replaces the cache (it deletes older caches when it activates).

What it does not do. It does not store anything you type, does not track you, does not send anything anywhere, and does not run on other websites.

How to remove it. In your browser's settings, clear site data (cookies and site data) for takehome.gautamkhosla.com. In Chrome or Edge you can also open developer tools, then Application, then Storage, and choose "Clear site data".

4. Other things your browser may remember

• Ordinary HTTP cache. Your browser caches our files according to standard caching headers. Engine files are marked to be revalidated on every use. Font files have names derived from their content and are marked as unchanging for one year. The versioned embed script (/embed/v0.1.0/embed.js) is marked as unchanging for one year.
• HTTPS-only rule. Our pages send a Strict-Transport-Security header, so your browser remembers for one year to connect to our domain and its subdomains only over HTTPS.
• Network error reporting. Cloudflare adds NEL and Report-To headers that ask your browser to report connection failures to Cloudflare for 7 days. Reports contain the page address, error type and timing. Cloudflare states that it uses the reporting IP address only to work out the network, country and city area and does not log it.
• Clipboard. When you press a Copy button, the text (for example a code sample or, on the verification page, your API key) is written to your clipboard. Nothing is copied unless you press the button.

5. Scripts from other domains

Our Content Security Policy only allows scripts from takehome.gautamkhosla.com and, for the bot check on the signup form, Cloudflare Turnstile from challenges.cloudflare.com (a script and a frame). The signup page loads Turnstile only when you start filling in the form; no other page loads it. Cloudflare can insert its own scripts into pages it serves (its Web Analytics beacon and a bot-detection script); your browser blocks them and they do not run on our pages. Apart from Turnstile on the signup form, we do not load fonts, images, styles or scripts from any other domain.

6. The embed widget on other websites

When another website embeds Takehome's widget, your browser downloads embed.js and the calculation engine from takehome.gautamkhosla.com. The widget sets no cookies, uses no local storage, does not register a service worker, and sends nothing back to us. The embedding website may use its own cookies; its own policy applies.

7. Changes and contact

If what we store changes, we will update this notice and its date. Questions: Gautam Khosla, developwith.gt@gmail.com.