1. Overview

This Cookie & Session Notice explains the cookies, session storage, and related browser technologies used by the MyWork platform. We believe in transparency about how we use these technologies and have designed our approach to be as minimal and privacy-respecting as possible.

Key facts:

We use only first-party cookies and storage — no third-party tracking cookies.
We do not use Google Analytics, Facebook Pixel, or any third-party analytics service.
We do not serve advertising or use advertising cookies.
All analytics are processed and stored on our own servers.

2. Cookies We Use

Cookie	Category	Purpose	Duration	Set On
`PHPSESSID`	Essential	Maintains your authenticated session after login. Contains a random session identifier — no personal data is stored in the cookie itself.	Browser session (deleted when you close your browser)	Admin dashboard, Owner portal
`mw_rv`	Analytics	Records whether you are a returning visitor. Contains only the value "1". Used to calculate new vs. returning visitor metrics.	365 days	All pages
`mw_lang`	Preference	Stores your preferred language selection when you use the language switcher. Contains a language code such as "es" or "fr".	365 days	All pages with language switcher
`mw_notrack`	Opt-Out	If present, disables all analytics data collection for your browser. Set only when you explicitly opt out via our self-exclusion page. Contains only "1".	2 years	All pages (prevents tracking)

3. Browser Storage (Not Cookies)

In addition to cookies, we use browser session storage for analytics purposes:

Key	Type	Purpose	Duration	Used On
`mw_sid`	Session Storage	An anonymous, randomly-generated session identifier that groups your page views within a single browsing session. This is not a cookie — it is stored in your browser tab's session storage and cannot be accessed by other websites or tabs.	Automatically deleted when you close the tab	All pages

Session storage differs from cookies in that it is isolated to a single browser tab, is not sent to the server with every request, and is automatically cleared when the tab is closed.

4. Session Security Technologies

For the admin dashboard and owner portal, we use additional session security measures:

Session Fingerprinting

When you log in, we create a hash of your browser's user agent string combined with a portion of your IP address (subnet). This fingerprint is checked on each request to detect potential session hijacking. Specifically:

We hash the combination of your browser's user agent and your IP subnet (not the full IP address).
If the fingerprint changes mid-session (suggesting someone else may be using your session token), the session is invalidated for security.
This fingerprint is not used for tracking, advertising, or analytics. It exists solely for security.

Session Idle Timeout

Authenticated sessions automatically expire after 30 minutes of inactivity. You will be required to log in again after a timeout. This protects your account if you forget to log out on a shared device.

CSRF Tokens

Forms in the Platform include hidden CSRF (Cross-Site Request Forgery) tokens that are tied to your session. These prevent malicious websites from submitting forms on your behalf. The tokens are generated per-session and are not stored persistently.

5. What We Track

Our first-party analytics system collects data across all pages on our domains, including the public website, owner portal, and all related portals (mywork.makeitnice.world, mwadmin.makeitnice.world, and associated domains). We collect:

Pages visited, time spent on each page, and scroll depth
Clicks on buttons, links, and calls-to-action
Form interactions (start, field focus, submission/abandonment)
Page load performance (to optimize site speed)
Navigation patterns (entry page, exit page, page flow)
Device type, browser, screen size, and operating system
Approximate location via IP geolocation (city/region/country)
Your browser's timezone (e.g. "America/New_York") for display and analysis purposes
Browser language and selected site language

All of this data is stored in our own database on our own server. It is never shared with third-party analytics or advertising services.

Analytics Opt-Out

You can opt out of all analytics tracking by visiting our self-exclusion page. This sets the mw_notrack cookie, which instructs our system to skip all data collection for your browser. You can reverse this opt-out at any time by visiting the same page and clicking "Clear opt-out."

6. Third-Party Cookies

We do not set any third-party cookies.

Our third-party integrations (Stripe for payments, Resend for email) operate server-side and do not set cookies in your browser through our Platform. If you visit Stripe's checkout page directly, Stripe may set its own cookies subject to Stripe's Cookie Policy.

7. Managing Cookies

You can control cookies through your browser settings:

Block all cookies: You can configure your browser to block all cookies. However, this will prevent you from logging into the Platform (the PHPSESSID cookie is required for authentication).
Delete existing cookies: You can clear cookies at any time through your browser settings. This will log you out of any active sessions.
Block specific cookies: Most browsers allow you to block cookies on a per-site basis. Blocking mw_rv will not affect Platform functionality.

Cookie Consent Banner

On your first visit, we show a small banner at the bottom of the screen with three choices:

Accept all — enables necessary, analytics, and preferences cookies.
Necessary only — enables only the cookies required to log in and use the site. No analytics, no preferences.
Customize — pick analytics and preferences individually.

Your choice is stored in a cookie named mw_consent (365-day expiry) so you don't see the banner again. You can change your mind at any time by clicking Cookie Preferences in the footer of any page, or opening the preference panel now.

Each consent decision is recorded in our internal audit log (timestamp, action taken, salted-hash IP, user-agent) — never the raw IP or any third-party tracker. This is for our compliance evidence; it never leaves the platform.

8. Related Documents

9. Contact

Questions about our use of cookies and session technologies? Contact us:

Email: [email protected]
Phone: (719) 654-1610
Address: 2316 N Wahsatch Ave, #253, Colorado Springs, CO

Cookie & Session Notice