Cookies

This page lists everything merchantcure.com stores in your browser. It is short, because there is not much.

What is active right now

• Google Ads conversion measurement — loaded only if you accept it.

The four things that can exist

1. The session cookie, when you sign in

Name mc_session. Set by the customer application at app.merchantcure.com, only at the moment you sign in — never by browsing the marketing site, and never before you have a login link in your hand.

It is a strictly necessary cookie: without it, being signed in is not a thing a browser can remember, and there is no consent to ask for because there is no alternative that still delivers what you asked for.

It is signed, and it carries your user id and an expiry — nothing else. There is no server-side session record, which has one consequence we would rather write down than leave you to discover: it cannot be revoked before it expires. Signing out stops your browser sending it, but a copy of the string would keep working until it lapses. The counterweight is a short life: 14 days, after which it stops working on its own.

The same limitation is stated on the privacy page and in your account.

2. Your consent choice

Stored twice, and both hold the same single word — granted or denied. Nothing else: no identifier, no timestamp, nothing that points at you.

• A cookie named mc-consent on .merchantcure.com, valid for a year. It is set on this domain so that the customer application at app.merchantcure.com reads the same answer. Without it the app cannot tell whether you said yes, and would have to ask again on the page where you have just paid.
• The same word in your browser's local storage, which is what we used before the app needed to know.

It is strictly necessary in the same sense as the session cookie: without somewhere to keep the answer, the answer cannot be honoured. It is sent to our server with each request, as cookies are, and we do nothing with it there.

To change your answer, clear site data for merchantcure.com in your browser and the question comes back.

3. Cloudflare Web Analytics

Counts page views. It sets no cookie and stores no identifier, which is why it needs no consent and why we chose it over the alternatives. It cannot follow you to another site.

It runs on this site and on the first screen of app.merchantcure.com, so that we can see how many people reach the scan. It is not on the pages that show your results: those addresses contain a scan reference, and we do not hand that to anyone, including a counter that would have no use for it.

4. Google Ads conversion measurement

This one does set cookies, and it is the only reason a consent banner exists. It tells us whether someone who clicked an ad went on to send a scan request. It is never loaded until you actively accept it.

Before you answer, Google Consent Mode is set to denied for every category on this site — advertising storage, user data, ad personalisation and analytics storage. That is the starting state, not something applied after you decline.

Paying happens on Stripe's own page

When you buy, you are sent to Stripe’s payment page and come back afterwards. We do not embed Stripe’s scripts, so no Stripe cookies are set on our domain — and no card details reach us at any point.

What happens while you are on Stripe’s page is covered by Stripe’s own cookie and privacy policies, not by this one. We cannot speak for them and do not try to.

What we do not use

• No third-party trackers or advertising pixels other than the one above.
• No social media embeds, and no share buttons that phone home.
• No session recording, no heatmaps, no scroll tracking.
• No external fonts or scripts from a CDN. This site’s content security policy names the permitted hosts explicitly, so a tag added by accident fails instead of quietly collecting data. It lists no payment hosts, which is correct: the checkout is not on this site.

Which hosts we may contact

Two content security policies name them — one for this site, one for the customer application at app.merchantcure.com — and the two name the same hosts. This is the whole list. Nothing else can be reached, so a tag pasted in by accident fails rather than quietly collecting data.

www.googletagmanager.com

Delivers the tag itself, and only after you accept.

www.google.com

www.googleadservices.com

googleads.g.doubleclick.net

Receive the conversion measurement. Without them the tag would load and record nothing, which would mean advertising money spent on numbers we could not see.

www.google-analytics.com

Permitted but not used. We run no Analytics property. The host has been in the policy since it was written, and it is listed here because a permission we do not exercise is still a permission.

static.cloudflareinsights.com, cloudflareinsights.com

Cookieless page counting. The first serves the script, the second receives the count. Not in use — no request is made to either.

The application enforces its policy with a per-request nonce rather than by allowing inline scripts. The practical difference: a script we did not put there does not run, even on a page that legitimately contains several.

Declining costs you nothing

Every page, the Quick Scan form and everything you can read work identically whether you accept or decline. The two buttons on the banner are the same size and the same weight, on purpose. A consent you were nudged into is not a consent.

Questions

Email hello@merchantcure.com. See also Privacy.