01 The short version #
- We do not sell, rent or trade your personal information — to anyone, ever.
- We run no advertising networks, no analytics and no cross-site tracking on this website. There is no Google Analytics, no advertising pixel and no behavioural profiling.
- When you sign in, your profile is held in a signed cookie in your own browser. We do not create an account record for you in our database.
- We ask for the minimum sign-in permissions that exist: your identifier, name, email address and profile picture. Nothing else.
- We do not keep the access tokens issued when you sign in. They are used once and then discarded or revoked.
- You can sign out and remove our access at any time — see Your choices and rights.
02 Who we are #
GOCOSYS Technologies (“GOCOSYS”, “we”, “us”) is an information technology services and products company. We operate the website at gocosys.com and are the data controller for the information described in this policy.
You can reach us about anything in this policy at:
- Email — info@gocosys.com
- Phone / WhatsApp — +91 63793 58673
The identity service at account.gocosys.com (GOCOSYS Account) is operated by the same company. Signing in to this website with a GOCOSYS Account is described in the next section.
03 Signing in — GOCOSYS Account and Google #
This website has no password form of its own. Signing in is delegated entirely to an identity provider you already use, so we never see, receive or store your password.
What we receive
We request only the three standard OpenID Connect permissions — openid, profile and email. From those we receive:
| Information | Why we need it |
|---|---|
A stable account identifier (sub) | To recognise you as the same person on your next visit. This is the only field we treat as your identity. |
| Your name and username | To greet you by name in the site navigation. |
| Your email address, and whether it is verified | To show you which account you are signed in as. |
| Your profile picture | To display your avatar in the site navigation. |
We do not request, and cannot see, your contacts, calendar, files, messages, phone number, date of birth, address or any other data held in your Google or GOCOSYS account.
Where it is stored
This is the part most worth understanding: we do not create a user record for you in our database. The profile above is placed in a cryptographically signed, HttpOnly cookie that stays in your own browser. Our server reads and verifies that cookie on each request in order to draw the signed-in state, and writes nothing about you to disk.
The practical consequence is that signing out removes your profile from this website completely. There is no leftover row for us to forget about.
Access tokens
The tokens issued during sign-in never reach your browser and are never stored by us. For a GOCOSYS Account sign-in we hand the token straight back to the identity service to be revoked as soon as sign-in completes. For a Google sign-in we simply discard the token; it expires on its own shortly afterwards. We hold no long-lived permission to act on your behalf, and we cannot access your account when you are not actively using this site.
Your profile picture
Your avatar is fetched by our server and served from gocosys.com, rather than loaded directly by your browser from your provider. This means your identity provider is not told which pages you view on this site. We do not store a copy of the image.
04 Google user data and Limited Use #
This section applies specifically to information obtained through Google APIs when you choose Continue with Google.
- Scopes requested:
openid,email,profile— the minimum needed to sign you in. - Data received: your Google account identifier, name, email address, email-verified status and profile picture URL.
- How it is used: solely to authenticate you and display your signed-in state on this website. It is not used for advertising, profiling, marketing, credit assessment, resale, or training machine-learning or AI models.
- How it is stored: in a signed,
HttpOnlycookie in your browser, as described above. It is not written to our database. - Who it is shared with: nobody. It is not transferred to any third party, except where we are legally required to do so.
- How it is deleted: sign out, and it is gone. You may additionally revoke our access from your Google account at any time.
Limited Use commitment. GOCOSYS’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
05 Information you give us directly #
Everything below is optional. You can browse the whole website without submitting any of it.
Contact enquiries
When you submit the contact form we collect your name, email address, phone number, company name, the service you are interested in and your message. We use it to answer you and to keep a record of the enquiry. It is stored in our database and also emailed to our enquiries desk.
Career applications
When you apply for an internship or a job we collect your name, email address, phone number, the role applied for, a portfolio or resume link, your message, and — depending on the application type — your college or university and internship duration, or your experience level and years of experience.
If you attach a resume, the file is checked and then sent onward as an email attachment to our hiring inbox. The file itself is never written to our servers’ storage. Our database keeps only its filename, file type and size.
Newsletter
If you subscribe to product updates we store your email address and which page you subscribed from. You can unsubscribe at any time by replying to any email we send, or by writing to info@gocosys.com.
06 Information collected automatically #
We deliberately collect very little. There is no analytics package on this site.
- With each form submission we record the IP address and browser user-agent string alongside the submission. This exists to investigate abuse and spam, and to satisfy ourselves that a submission was genuine.
- For abuse protection we count recent requests per visitor. The IP address is hashed before it is used as a key, the counters hold no other personal data, and they delete themselves automatically within hours.
- Server logs are produced by our web server and reverse proxy in the ordinary course of operating the site. They rotate and are overwritten on a rolling basis.
We do not use device fingerprinting, and we do not track you across other websites.
07 Cookies and browser storage #
This site sets no advertising or analytics cookies. Every cookie below is strictly necessary for a feature you have actively used.
| Name | Purpose | Lifetime |
|---|---|---|
goc_oauth | Holds the one-time security values that protect a sign-in attempt in progress. Set only when you start signing in. | 10 minutes, then deleted the moment sign-in completes |
__Host-goc_session | Your signed sign-in session and profile. Set only after you sign in. | 7 days, or 24 hours of inactivity |
gocosys-theme(browser local storage, not a cookie) | Remembers whether you chose the light or dark theme. | Until you clear your browser storage |
Both cookies are HttpOnly — page scripts cannot read them — and are marked Secure and SameSite=Lax. The theme preference stays in your browser and is never sent to us.
Our anti-spam checkbox and our web fonts are loaded from Google, and our icon font from a public code CDN. Those providers may set their own cookies; see Who we share information with.
08 Why we are allowed to process it #
Where data-protection law requires us to name a basis for processing, we rely on the following:
- Your consent — for the newsletter, which you may withdraw at any time.
- Steps taken at your request before entering a contract — for contact enquiries and career applications.
- Our legitimate interests — for keeping the site secure, preventing spam and abuse, and operating sign-in. We have considered your interests and kept the data involved to a minimum.
- Legal obligation — where we must retain or disclose information to comply with the law.
09 How long we keep it #
| Information | Kept for |
|---|---|
| Sign-in profile | Only while your session cookie lives — a maximum of 7 days, or 24 hours of inactivity. Signing out removes it immediately. |
| OAuth access tokens | Not retained. Revoked or discarded as sign-in completes. |
| Contact enquiries | Up to 24 months after our last correspondence with you, so we can pick up an earlier conversation. |
| Career applications | Up to 12 months after a decision, so we can consider you for a later opening. Tell us and we will delete it sooner. |
| Newsletter subscription | Until you unsubscribe. |
| Abuse-protection counters | Hours. They expire automatically. |
| Server logs | Rotated on a rolling basis in the ordinary course of operations. |
Emails we have sent or received remain in our mailboxes under our ordinary mail retention practices.
10 Who we share information with #
We do not sell, rent or trade your personal information. We share it only with the service providers below, only to the extent needed to run this website.
| Provider | What it handles |
|---|---|
| Google — Sign-In, reCAPTCHA, Fonts | Authenticates you if you choose Google sign-in; protects our forms from bots; serves the site’s typefaces. Google Privacy Policy |
| GOCOSYS Account | Authenticates you if you choose GOCOSYS sign-in. Operated by us. |
| Our email provider | Delivers enquiry, application and newsletter email. |
| Public content delivery networks | Serve the icon font and a background graphics library. They receive your IP address as a normal part of delivering a file. |
We may also disclose information where we are required to by law, or where it is necessary to establish or defend a legal claim, or to protect the safety of any person.
Our website and database run on our own infrastructure. If we ever transfer information outside your country, we will do so only with appropriate safeguards in place.
11 How we protect it #
Security is engineered into this site rather than bolted on. Among other measures:
- All traffic is served over HTTPS, with HSTS instructing browsers never to connect insecurely.
- Sign-in uses the authorization code flow with PKCE, and every identity token’s signature is cryptographically verified before we trust a single claim in it.
- Session cookies are signed,
HttpOnly,Secureand carry the__Host-prefix, so they cannot be read by scripts or overwritten by another site. - A strict Content Security Policy, generated fresh for every response, blocks injected scripts.
- Uploaded resumes are validated and passed straight into an email attachment; they are never written to our servers’ storage.
- The application runs as an unprivileged user in an isolated container with a read-only filesystem.
- Rate limiting protects the forms and the sign-in routes from automated abuse.
No system is perfectly secure, and we cannot guarantee absolute security. If you believe you have found a vulnerability, please tell us at info@gocosys.com — we welcome the report and will not pursue action against good-faith research.
12 Your choices and rights #
You can ask us to give you a copy of the information we hold about you, correct it if it is wrong, delete it, restrict or object to how we use it, or withdraw a consent you previously gave. Exercising any of these rights is free, and we will respond within 30 days.
Write to info@gocosys.com from the address you gave us, or tell us enough to identify your record. We will never charge you or make you justify the request.
Removing your sign-in data yourself
- Sign out using the account menu. Your profile is removed from this website at that moment.
- Revoke Google access at myaccount.google.com/permissions.
- Revoke GOCOSYS Account access from the Connected apps page of account.gocosys.com.
If you are unhappy with how we have handled your information, please raise it with us first — we would like the chance to put it right. You also have the right to complain to your local data protection authority.
13 Children #
This website is intended for businesses and for adults seeking employment. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us personal information, contact info@gocosys.com and we will delete it.
14 Changes to this policy #
If we change how we handle your information, we will update this page and move the effective date at the top. Where a change is significant, we will make it obvious rather than relying on you to notice. Continuing to use the site after a change means you accept the updated policy.
15 Contact us #
Questions, requests or complaints about this policy are all welcome:
- Email — info@gocosys.com
- Phone / WhatsApp — +91 63793 58673
- Or use the contact form on our home page.