Cookie and Browser Storage Policy

1. Scope

Cookies are small values a website asks a browser to store and send with later requests. Local storage is browser storage scoped to an origin; unlike a cookie, it is not automatically sent with every HTTP request.

This policy covers the current MonoDuty marketing origin and application origin. Third-party features may use their own cookies or storage under their own notices.

2. Current Uses

The marketing site uses local storage to remember whether a visitor accepted optional analytics. It loads Google Tag Manager only after acceptance. Authentication pages do not load marketing analytics.

The API uses necessary cookies for a server-side browser session, CSRF protection, and the short cross-origin sign-in handoff. The application uses local storage only for active-workspace selection, display theme, and a temporary return path used during email verification. The current marketing site does not use advertising cookies.

3. Categories

3.1 Necessary storage

Storage needed for sign-in, security, navigation continuity, and a visitor’s privacy choice. Blocking application storage can prevent sign-in or remove saved settings.

3.2 Optional analytics

Google Tag Manager and analytics tags are optional on the marketing site and are not loaded until the visitor accepts analytics.

3.3 User-invoked third-party features

Google sign-in and reCAPTCHA may use Google-controlled storage when their scripts load. Google sign-in can be avoided by using email/password. The contact form requires reCAPTCHA; an alternative support channel is available by email.

4. MonoDuty Storage Keys

The CSRF synchronizer value is kept only in page memory and is not a reusable authentication credential. These are current first-party keys, not a promise that no technical key will ever change.

5. Third-Party Storage

After analytics acceptance, Google Tag Manager may load configured analytics tags that set Google-controlled identifiers. Exact Google names and lifetimes can change under Google’s configuration and notices.

Google Identity Services and reCAPTCHA may also set or read Google-controlled cookies or browser storage when those features load. Stripe’s hosted Checkout and billing portal may use Stripe-controlled storage when you open those services. MonoDuty does not claim that its first-party settings erase storage controlled on another domain.

6. Application Local Storage

The application does not persist its browser authentication credential in local storage. Authentication uses an API-origin cookie that application scripts cannot read. Local storage holds display and navigation preferences only.

The active workspace, theme, and verification return path do not replace server-side authorization; the API independently validates the session, role, membership, and resource scope.

7. Controls

Use “Cookie settings” in the site footer to accept analytics or choose only necessary storage. Choosing only necessary storage prevents analytics scripts from loading on the next page load. Browser settings can inspect or delete first-party storage and block third-party cookies.

Using the application’s logout control invalidates the server-side session. Deleting or blocking the necessary API cookie signs the browser out; blocking local storage removes saved workspace and display preferences but does not expose a credential. Blocking reCAPTCHA can prevent contact-form submission; email support remains available.

8. Analytics Choice

On a first visit, optional analytics remain off until “Accept analytics” is selected. “Only necessary” records a refusal without loading Google Tag Manager. The saved choice can be reopened through the footer.

Withdrawing analytics takes effect for new page loads and future collection. MonoDuty also requests denial from any already loaded analytics code and removes known first-party Google Analytics cookies where the browser permits it, but cannot erase provider-side data already collected.

9. Changes

This policy and the stored policy version are updated when first-party storage or analytics behavior materially changes. A new choice may be requested after such a change.

10. Contact

Questions about cookies or browser storage can be sent to [email protected] or through the contact form.