Cookie Policy
Effective date: [EFFECTIVE DATE]. This policy explains the cookies and similar storage used by the Meritwave Digital Inc website and by our Operations web app.
1. What they are. Cookies are small files a site saves in your browser. Browser storage (local storage and session storage) is similar and also saves small pieces of data.
2. Website (meritwavedigital). We set one cookie, called "meritwave" (on secure connections "__Host-meritwave"). It keeps you signed in and protects your session against forged requests. It is set only when you start to sign in or register, it is not readable by scripts on the page, it is sent only to our site, and it expires when your session ends. [DEVELOPER TO CONFIRM LIFETIME; the code sets a short life for a not-yet-signed-in session.] The site's registration pages do not use local or session storage. Fonts are served from our own site. We found no analytics, advertising or tracking tools on the website. [DEVELOPER TO CONFIRM BEFORE LAUNCH.]
3. Operations web app (staff and merchant portal). After you sign in, the app saves your sign-in token and basic profile in your browser's local storage under the name "auth", and a two-step-verification session record in session storage (name "twoFASession") that is cleared when you close the tab. It saves your light or dark theme choice. If you turn on browser notifications, it saves a marker in local storage (named "webpush:lastSyncedEndpoint" and your account number) that tells it your browser is already registered, and your browser keeps a push subscription. Our server sets an anti-forgery cookie called "XSRF-TOKEN" that the app reads to open its live-updates connection. [DEVELOPER TO CONFIRM: other cookies set by the server, and their lifetimes.] The app loads fonts and icons from Google Fonts, so Google can see your IP address and browser when a page loads. [COUNSEL / DEVELOPER: consider hosting these ourselves.] We found no analytics or advertising tools in the app.
4. What we do not do. We do not use cookies to show you ads, to sell your data or to follow you across other sites.
5. Your choices. You can block or delete cookies and storage in your browser settings. Blocking the sign-in cookie or storage will stop sign-in from working. Signing out removes the sign-in data. [COUNSEL: Do Not Track and Global Privacy Control wording.]
6. Changes and contact. We will update this page if we add anything. Questions: [email protected]. See also the Privacy Policy. Nothing in this section limits rights that the law of your state says cannot be waived by contract, including rights under the Illinois Biometric Information Privacy Act.