Cookie policy.
How College Match uses cookies and similar technologies.
Your choices
Necessary cookies are used without consent because the website cannot operate securely without them. Analytics, marketing, external media and live chat are disabled by default and run only after you choose to allow them. You can withdraw your consent at any time using the “Cookie settings” button.
Cookies and services we use
| Category | Purpose | Examples | Retention |
|---|---|---|---|
| Necessary | Authentication, CSRF protection, payment flow security and remembering your cookie choices. | Session cookie, XSRF-TOKEN, collegematch_consent | Session to 180 days |
| Analytics | Usage measurement through Google Analytics 4 and PostHog, including page visits and selected product actions. | _ga, _ga_*, ph_* cookies and local storage | Google: up to 2 years. PostHog browser storage: until consent withdrawal or expiry. |
| Marketing | Advertising-related Google consent signals if linked advertising services are enabled. | _gcl_*, _gac_* | Depends on the connected service |
| Live chat | Support conversations through Tawk.to, enabled only with live chat consent. | tawkUUID, twk_idm_key, TawkConnectionTime and Tawk_* browser storage | Determined by Tawk.to; accessible storage is removed when consent is withdrawn. |
| External media | Displaying embedded athlete videos. | YouTube or Vimeo cookies and local storage | Set by the media provider |
Google Consent Mode v2
Google storage signals are denied by default. The Google Analytics tag is not downloaded until analytics consent is granted. Marketing consent separately controls advertising storage, user-data and personalisation signals.
GA4 page information uses route templates without query strings, fragments or personal profile titles. Google signals and advertising personalisation are disabled. When analytics consent is withdrawn, GA4 data collection is disabled immediately and accessible analytics cookies are removed.
PostHog product analytics
PostHog loads only after analytics consent. It measures page visits, selected navigation and referral actions, and eligible product events. URLs sent to PostHog omit query strings and fragments; profile and event identifiers in page URLs are replaced by route templates. Signed-in members use a pseudonymous account identifier with account type and package information. Form values, messages, passwords and authentication tokens are not included. Session recording, automatic form capture and heatmaps are disabled. Activation, password-reset, email-verification, payment and administrator pages are excluded.
PostHog requests use its European endpoint. When you withdraw analytics consent, future capture stops and accessible PostHog cookies and browser storage are removed. Your consent preference is also recorded on your member account when you are signed in.
Tawk.to live chat
The support widget is downloaded only when you allow the Live chat category. Tawk.to may receive your IP address, browser information and page URL, as well as any messages or contact details you enter in the chat. Your account name and email address are not sent automatically. Administrator pages, article previews and pages containing activation, verification or password-reset tokens do not load the widget.
When you withdraw live chat consent, the widget is hidden and disconnected, accessible Tawk.to cookies and browser storage are removed, and the page reloads to stop the loaded widget. Third-party cookies cannot be removed by this website. Withdrawing consent does not delete conversations already sent to support.
Third-party services
When you allow external media, the selected video provider may receive your IP address and information about your browser. Stripe may set strictly necessary cookies when you start a subscription checkout on Stripe’s hosted payment pages.
Changing your mind
Open cookie settings from the button on this page or the persistent button at the bottom of any page. Rejecting a previously allowed category stops future optional processing and removes accessible first-party Google and PostHog storage.