Cookie Policy

Cookies are small values stored by a browser. Local storage and session storage are similar browser technologies. UK privacy rules apply to storing or reading them even when the value is not personal information.

Monocrawl uses essential storage to authenticate and secure accounts and complete requested workflows. Referral attribution, account-linked product analytics and advertising measurement are separate optional choices, off until you agree. Google Ads and Reddit Ads measurement links ad interactions to signup and first subscription payment; Reddit also receives a page-visit event. Google enhanced conversions are off. We do not create remarketing audiences or send customer contact details for enhanced matching. Session replay is off.

• `better-auth.session_token` (or the secure production-prefixed equivalent): signed, HTTP-only authentication cookie used to maintain the account session. The configured session lifetime is seven days and revocation can end it earlier.
• `better-auth.two_factor` / secure-prefixed equivalent: short-lived authentication state used only while completing a two-factor challenge.
• `mn_consent`: a first-party, signed, HTTP-only cookie remembering your choices, their version and the time you made them. It expires after 180 days. It is essential to respecting your privacy preferences and is not an advertising identifier.
• `mn_device`: a first-party, HTTP-only security cookie used when an anonymous visitor runs a supported free tool. It gives that browser a signed identity for abuse prevention and usage limits, expires after one year, and is not used for analytics or advertising.
• `sidebar_state`: first-party interface preference recording whether the dashboard sidebar is open. Maximum age seven days.
• `mn_ref` in local storage: optional referral attribution, saved only after you allow referrals. It contains a referral code and an expiry time, lasts at most 30 days, and is cleared after a successful referral claim or when you withdraw permission. Expired values are discarded the next time the site checks them. Old values saved without the new consent choice are discarded.
• Google Ads first-party `_gcl_*` cookies and related `_gcl_ls` browser storage: optional advertising measurement, only after Advertising measurement permission. They retain ad-click and measurement identifiers, normally for up to 90 days. Google can also receive cookies previously set on its own domains, subject to your browser settings and Google choices.
• Reddit Ads first-party `_rdt_uuid` and `_rdt_cid` cookies: optional advertising measurement, only after Advertising measurement permission. They retain a browser identifier and ad-click identifier, normally for up to 90 days. `_rdt_cfg` session storage caches the pixel configuration until the tab closes. Accessible `_rdt_*` cookies and this cache are cleared on withdrawal. We do not supply email or phone match keys.
• `mn_ads_sent_v1` in local storage: optional advertising measurement. It records pseudonymous signup IDs, first-subscription invoice IDs and dispatch times to reduce repeat signup or first-subscription events. Entries expire after 90 days and are removed on withdrawal or the next consented check; at most 100 are retained. A dispatch record is not proof that Google accepted or attributed the event.
• `monocrawl.monitor-data-view` and `monocrawl:integration-hint:*` local storage: the requested monitor reading view and whether a one-time account welcome hint has appeared. They remain until browser storage is cleared; they are not used to track browsing.
• Monitor and scraper session storage, including `monocrawl:scraper-monitor`, carries inputs between steps you request and protects against duplicate submissions. It is removed when consumed or when the tab closes.
• Legacy `mn_explorer_recent` local storage may contain old Explorer runs. The Playground no longer reads or writes it; it can be removed in browser settings. Playground history now reads the signed-in account’s request log.
• Legacy `sf_new_key` session storage may contain a key created before recoverable keys were introduced. The overview consumes and clears it. Newly created keys are not saved in browser storage; reveal and copy retrieve them through your signed-in session.

Authentication, security and privacy-choice storage remains available when you choose Only necessary. Interface and workflow storage supports features you request. You can change the view or sidebar using its control, and clear saved browser preferences in your browser.

Optional product analytics uses a first-party, HttpOnly `mn_journey` cookie for up to 30 days and `mn_journey_session` in session storage to group visits (renewed after 30 minutes of inactivity). These identifiers are created only after analytics permission. If you enable it, we record page categories, selected actions and bounded campaign labels. Your sign-in session can connect visits to your account, confirmed signup, API success, subscription payment and repeat use. We also count dashboard tools once per UTC day. Optional records contain pseudonymous visit identifiers, page categories, actions, timestamps, attribution and consent evidence; they exclude full URLs, form contents, credentials, search terms and results. Journey records and reporting snapshots expire after 90 days. Voluntarily submitted page feedback is kept for up to 180 days. The signed-in product analytics route checks your privacy choice before reading the session or writing a visit.

Referral and product analytics information is processed by Monocrawl using our hosting and database providers listed in the Privacy Notice. We do not send these events to an advertising network or third-party analytics service. When optional data is collected, its record includes evidence of the permission that applied.

Our internal marketing report uses these consented journey records to preserve the first recorded source and latest non-direct source before signup, including campaign names and campaign IDs, and compare them with campaign spending and account outcomes. If both Product analytics and Advertising measurement are enabled, supported Google, Microsoft, Meta and Reddit click identifiers from the arrival URL are also encrypted in the first-party journey store for up to 90 days. Withdrawal clears those stored identifiers. This reporting store adds no browser cookie and does not itself export events. Microsoft and Meta advertising tags are not enabled.

Advertising measurement is different: when configured and you opt in, we load the Google tag for account AW-18478136497. Google receives ad-click identifiers (gclid, gbraid or wbraid when present), cookie identifiers, consent signals, network/device information such as IP address and user agent, a signup or first-paid-subscription event, and a pseudonymous signup ID or first-subscription Stripe invoice ID. The first subscription value is the actual initial positive subscription payment including any tax, with its currency; it is not lifetime value or monthly recurring revenue. We send a fixed homepage URL with only those ad-click parameters, not dashboard URLs, search queries, checkout session references, API activity, email, name or payment-card data.

We use basic consent mode. Before permission, after a decline, and after withdrawal, no Google advertising tag or cookieless conversion ping runs. Ad identifiers are not saved or passed between pages before consent. Withdrawal removes the advertising runtime and clears accessible first-party advertising storage; it cannot erase information Google already received or cookies held on Google’s own domains. See Google’s explanation of partner-site data and Google’s cookie information. Microsoft advertising tracking is not enabled.

When configured and you opt in, the Reddit Pixel for account a2_jr8etqlx4tfy loads in a separate, empty measurement document. It receives page-visit, signup and first-paid-subscription events, network/device information, ad-click and cookie identifiers, a pseudonymous signup ID or first-subscription Stripe invoice ID, and the actual payment amount including tax with its currency. Its document URL contains only the provider name and a validated rdt_cid click identifier, never dashboard URLs or private query parameters. The runtime has no signup, payment or API form contents to inspect. We do not supply email, phone, raw account IDs, search terms, API data or card details. Dispatch markers reduce duplicates but do not prove Reddit accepted or attributed an event. With the same advertising permission, our server retains encrypted Reddit click or browser identifiers, linked to your signed-in account and consent, for up to 30 days. It can send your first genuine subscription payment through Reddit’s Conversions API even if you do not return from Checkout, using the same invoice conversion ID to prevent double counting. No past unconsented payments are uploaded. Withdrawal suppresses future queued sends, clears stored match identifiers and destroys the browser runtime; it does not erase data Reddit already received or cookies on Reddit’s own domains. A send already in progress may finish before a withdrawal is confirmed. See Reddit’s Privacy Policy.

Stripe-hosted Checkout and billing pages may set Stripe cookies or similar storage for payment security, fraud prevention, session continuity and regulatory requirements. Those values are controlled by Stripe on its domain; see Stripe’s own privacy and cookie information.

If you choose Google or GitHub sign-in, that provider may use its own cookies on its domain to authenticate you and return the authorised result. Monocrawl does not make those optional providers load merely because you visit a public page.

You can clear local or session storage and block cookies in browser settings. Blocking authentication cookies prevents sign-in; clearing legacy Explorer or referral storage removes that local history or attribution. Clearing browser storage does not delete your account’s request log.

The banner offers Accept all, Only necessary and Settings. Optional choices are off until you actively allow them. Closing settings, continuing to browse or ignoring the banner does not count as consent. Your choices apply to this browser; make them separately on another browser or device.

Use Cookie settings in the website footer, dashboard or below to change or withdraw permission. Withdrawal stops future optional collection in this browser and clears saved referral and accessible advertising attribution. It does not undo completed referral rewards, payments or records required to operate your account. See the Privacy Notice for retention and requests to erase past personal information.

Cookie settings

We ask again when the preference expires or when the purpose or version changes. If your browser blocks saving the preference cookie, optional tracking stays off and we explain that the choice could not be remembered.

We audit this inventory when authentication, analytics, checkout or browser workflows change. The version and effective date above identify the current inventory.

Questions or objections can be recorded using the privacy category at Contact. See the Privacy Notice for personal-information rights.