Cookie & Local Storage Policy

This policy is written in plain language for transparency. It does not reduce rights or obligations that applicable law does not permit the parties to change.

1. Current position

RestoreCheck IQ currently uses cookies and browser storage that are necessary for authentication, security, integration hand-offs, preferences, installation, offline operation, and reliable delivery. We do not currently use third-party advertising cookies or behavioural advertising trackers.

If non-essential analytics or marketing technology is introduced, we will update this Policy and provide a consent choice before using it where required.

2. Technologies we use

Session cookie: an HttpOnly, secure production cookie used to keep an authenticated user signed in. It is not available to ordinary page scripts.
Two-factor and activation state: short-lived server-side records and request state used to complete secure account access.
Integration state cookies: short-lived, same-site values used to verify an OAuth connection response and prevent request forgery.
Authorized “view as” state: a short-lived, privileged cookie used to identify an explicitly selected organization during an audited platform-owner diagnostic session.
Local storage: preferences such as dismissed notices or interface state. It must not contain reusable passwords, API secrets, or unencrypted customer evidence.
IndexedDB/offline queue: customer-selected field evidence may be encrypted locally before later upload. Entries are scoped to the authenticated user and organization and expire under the offline retention rules.
Service worker and cache storage: application shell assets used for installation, performance, and limited offline operation. Protected API responses and customer documents must not be persistently cached as public assets.

3. Control and consequences

Browsers and devices allow you to clear or block cookies and stored data. Blocking strictly necessary storage may prevent sign-in, integration connections, offline sync, or other core functions. Signing out clears the server session cookie; users should also remove local app data before transferring or disposing of a device.

Questions may be sent to privacy@restorecheckiq.ca.