Cookie Policy
How Step AM uses cookies and similar technologies in Hong Kong
本文件目前只提供英文版本，一切以英文版本為準。
Table of Contents
1. What Are Cookies
Cookies are small text files that a website places on your computer or mobile device when you visit it. They are widely used to make websites work, work more efficiently, and to provide information to the operators of a website.
Step AM Limited ("Step AM", "we", "us", "our") operates the stepam.com job board and recruitment platform for Hong Kong. This Cookie Policy explains what cookies we use, why we use them, and how you can control them. It should be read together with our Privacy Policy, which explains more generally how we handle your personal data.
2. How We Use Cookies
We use cookies for a small number of specific, limited purposes:
- Keeping you signed in — so you don't have to log in again on every page.
- Protecting your account and our platform — verifying requests genuinely come from you and blocking cross-site request forgery attacks.
- Remembering your language preference — English or 繁體中文 (Traditional Chinese).
- Understanding how our site is used — through our own first-party, in-house analytics (page visits, referral sources), not a third-party ad network.
- Processing payments securely — when you make a payment (e.g. subscriptions, job credits), our payment processor, Stripe, sets its own cookies to detect fraud.
We currently keep this list intentionally short. Step AM does not use cookies for behavioural advertising, and we do not run Google Analytics, Facebook Pixel, or any third-party advertising or retargeting tags on the platform.
3. Cookies We Use
The table below lists every cookie our platform (stepam.com) sets, exactly as implemented in our systems.
| Cookie Name | Purpose | Type | Duration |
|---|---|---|---|
| accessToken | Keeps you signed in and authorises your requests while you actively use the platform. | 4 hours | |
| refreshToken | Lets your session be renewed without you having to log in again. | 7 days, or 30 days if you selected "Remember Me" at login | |
| connect.sid | Server-side session identifier that supports secure sign-in. | 7 days (renewed while you're active) | |
| psifi.x-csrf-token ( __Host-psifi.x-csrf-token in production) |
Cross-Site Request Forgery (CSRF) protection — confirms that actions like posting a job or submitting a form genuinely came from you. | Ends when you close your browser | |
| locale | Remembers whether you've chosen to view the site in English or 繁體中文. | 1 year | |
| pageVisitorId | An anonymous identifier we use for our own first-party analytics, so we can understand traffic patterns and improve the platform. It is not shared with, or readable by, any third-party advertiser. | 1 year |
HttpOnly flag, meaning they cannot be read by JavaScript running on any webpage — only our own server can read them. Where you're browsing over HTTPS (our production site), they are also marked Secure, so they're only ever sent over an encrypted connection.
4. Third-Party Cookies
We keep third-party cookies to a minimum. The only third-party service on our platform that sets its own cookies is our payment processor:
| Provider | Where It Runs | Purpose | Type |
|---|---|---|---|
| Stripe | Only loaded on our checkout / payment page, when you're paying for a subscription or job posting credits | Fraud prevention and secure processing of card payments. Step AM never receives or stores your full card details — these are handled entirely by Stripe. |
Stripe sets and controls these cookies directly; we do not control their names or exact duration. You can read more in Stripe's own Cookie Policy.
5. Cookies We Do Not Use
To be clear about what you will not encounter on stepam.com:
- No Google Analytics or Google Tag Manager cookies
- No Facebook Pixel or other social-media advertising cookies
- No third-party behavioural advertising or retargeting cookies
- No cookies that sell or share your data with data brokers
If this ever changes — for example, if we add an analytics or advertising partner in future — we will update this page and, where required by law, ask for your consent first.
6. Managing & Disabling Cookies
Most web browsers let you control cookies through their settings. You can typically choose to block all cookies, block only third-party cookies, or delete cookies that have already been set.
Browser Settings
- Google Chrome: Settings → Privacy and security → Cookies and other site data
- Safari: Preferences → Privacy → Manage Website Data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies
7. Other Similar Technologies
In addition to cookies, our platform uses your browser's local storage for a small number of non-tracking purposes, such as remembering your authentication token on some pages and temporarily caching form drafts (for example, an in-progress job posting or resume screening criteria) so you don't lose your work if you navigate away. This information stays on your device and is not a cookie in the technical sense, but we mention it here for completeness. You can clear it at any time via the same browser settings referenced in Section 6, or by clearing your browser's site data for stepam.com.
8. Changes to This Policy
We may update this Cookie Policy from time to time, for example if we introduce a new feature that uses cookies. We will update the "Last Updated" date at the top of this page whenever we make changes. We encourage you to review this page periodically.
9. Contact Us
If you have any questions about this Cookie Policy or how we handle your data, please get in touch:
Contact Us
Step AM Limited
Data Protection Officer
Email: [email protected]
Phone: +852 8482 9047
Office Hours: Monday to Friday, 9:00 AM - 6:00 PM HKT
For more detail on how we handle your personal data generally, please see our Privacy Policy.