MarginPatrol | Version 1.0 | Prepared 08 August 2026
Publication date: 02.09.2026. Effective date: 02.09.2026. Canonical page: https://marginpatrol.com/cookies.
1. Scope and operator
This policy explains information stored on or accessed from your device when you use MarginPatrol's website, Shopify app and connected mobile experience. The operator is identified in the Legal Notice; contact support@marginpatrol.com. The Privacy Policy separately explains processing of personal data.
The rules concern more than browser cookies. Session storage, secure mobile storage, pixels, SDK identifiers and similar device-access techniques can be relevant even if they are not called cookies. Server-side records are covered by the Privacy Policy and Data Retention and Deletion Policy.
2. Current release
MarginPatrol uses device technologies needed to provide a function requested by the user, maintain authenticated access, protect security or deliver an authorised communication. The reviewed website and embedded app do not enable MarginPatrol advertising pixels, cross-site tracking, session replay or optional device-based behavioural analytics. Product analytics and error diagnostics are sent from the server under strict minimisation contracts; they do not place browser storage on MarginPatrol pages.
Because the reviewed release does not use optional device technologies, MarginPatrol does not show a cookie-consent banner. If an optional technology is introduced later, this policy and inventory must be updated before deployment and any required choice obtained before the technology operates. Accepting Terms, scrolling, using OAuth or enabling notifications is not cookie consent.
3. Device-storage inventory
| Function | Information and purpose | Provider/surface | Lifetime |
|---|---|---|---|
| Return from Shopify subscription approval | Limited store, plan and safe return-path context so the requested billing review can continue after Shopify approval | MarginPatrol embedded Shopify app; first-party sessionStorage at the app origin | marginpatrol.billing-recovery.v1; maximum two hours and removed after completed recovery or invalid/expired context |
| Embedded app authentication | Shopify App Bridge obtains a short-lived session token for the requested API call; MarginPatrol sends it as a bearer header and does not create its own browser authentication cookie | Shopify Admin and MarginPatrol embedded app | Controlled by Shopify's session-token lifecycle; MarginPatrol does not persist the token in localStorage or sessionStorage |
| Mobile session and device security | Access/refresh credentials and a linked-session snapshot restore the user's requested device access | iOS Keychain and UserDefaults; Android Keystore-encrypted SharedPreferences | Cleared through sign-out, revocation and environment-reset paths; server-side expiry and revocation also apply |
| Push notifications when requested | APNs/FCM delivery token and bounded local registration state allow authorised notifications | Apple Push Notification service; Firebase Cloud Messaging; MarginPatrol mobile app | Controlled by platform token lifecycle and removed or made unusable through notification/session revocation paths |
Unsaved product-cost values remain only in the current page until submitted; the reviewed release does not persist them in localStorage. Failed client-error reports use a bounded in-memory queue and are not restored from sessionStorage after a reload.
4. Shopify and third-party pages
Shopify Admin, Shopify billing approval, advertising-account authorisation pages and Merchant-selected workspaces are separately operated. Their operators explain their own technologies. Linking or redirecting to such a page does not mean MarginPatrol places that operator's cookies on its own site.
If a third-party component is later embedded into a MarginPatrol page and stores or accesses device information, it must be added to this inventory before release. Transactional messages generated by MarginPatrol disable SendGrid open, click and subscription tracking; necessary delivery records remain described in the Privacy Policy.
5. Managing device information
Browser controls can inspect or clear cookies and site storage. Clearing necessary workflow information can remove a pending billing return path, but it does not delete server-held financial data or cancel a Shopify subscription. Mobile notification permission can be changed in device settings. Store and device permissions are managed through the available account and revocation controls.
Where a future optional technology requires consent, refusal and withdrawal will be available without loss of an unrelated core service. A persistent settings control will be provided when needed for that release.
6. Changes and contact
Device-storage expiry does not determine retention of information already sent to MarginPatrol servers; that is addressed in the Data Retention and Deletion Policy. A change in provider, purpose, identifier or lifetime requires an updated inventory and any required control before deployment.
Questions and rights requests: support@marginpatrol.com. The Privacy Policy provides controller details and complaint rights.