Cookie & Session Notice

Effective date: July 2, 2026. This notice supplements the Privacy Policy and explains how Monocrat uses cookies, local browser storage, OAuth state, and session records for the website, private beta waitlist, and product.

1. Scope

This notice applies to Monocrat websites, waitlist routes, Google sign-in and OAuth flows, approved private beta sessions, support and account controls, and product routes served by Monocrat. Connected providers, including Google, Stripe, Square, Shopify, Plaid, Moov, and subprocessors, may use their own cookies or similar technologies under their own terms when you visit their sites, portals, or authorization screens.

2. Required Cookies

Monocrat uses required cookies and related server-side session records to authenticate users, protect OAuth flows, bind the verified owner session to the correct tenant, maintain security, prevent cross-site request and replay risks, remember session state, and route approved users back to the product. These cookies are necessary for account, security, waitlist, and product functionality.

Required cookies may include waitlist OAuth state, product Google OAuth state, product session identifiers, and related short-lived state used to verify that the browser returning from an authorization flow is the same browser that started it.

3. Analytics, Diagnostics, And Observability

Monocrat may collect device, browser, route, event, performance, diagnostic, security, and observability information to operate, debug, secure, and improve the service. Where cookies or similar technologies are used for analytics or diagnostics, they are not used to sell personal information or for cross-context behavioral advertising.

4. Local Storage And Similar Technologies

Monocrat product surfaces may use browser storage or similar technologies for user-interface state, feature settings, route recovery, app-install prompts, notification preferences, or performance. Local browser state is not authority for tenant access, billing, source connection, payment approval, account deletion, or other high-stakes action. Server-side records and authenticated owner sessions remain authoritative.

5. Your Choices

Browser settings may let you block or delete cookies. Blocking required cookies may prevent sign-in, waitlist OAuth, source authorization, product sessions, support/account controls, billing access, or security checks from working. You can revoke connected-provider access through Monocrat settings where supported or directly through the provider.

6. Changes

Monocrat may update this notice as product routes, security controls, analytics, provider flows, or legal requirements change. Questions can be sent to privacy@monocrat.ai.