Cookie Policy
Every cookie Policy Monster sets is strictly necessary, which is why you were not asked to accept any. This page lists each one, what it does and how long it lasts.
What this covers
This policy covers cookies and similar browser storage on policy.monster — our marketing site and the product you sign in to. It is part of our Privacy Policy.
A cookie is a small file a site stores in your browser. Some are needed for the site to work at all; others are used to measure or to advertise. Which kind matters legally: the first can be set without consent, the rest cannot.
Every cookie we set is strictly necessary. We set no advertising cookies, we run no advertising, and our analytics work without cookies. That is why policy.monster does not show you a consent banner — asking for consent we do not need would be theatre.
Analytics without cookies
We use Umami, self-hosted on our own infrastructure. It records a page view and a referrer. It sets no cookie, assigns no persistent identifier, does not follow you between sites, and its data is not shared with anyone. Nothing about it requires consent under the ePrivacy Directive or the UK PECR, because it neither stores nor accesses information on your device.
Errors are reported to Bugsink, also self-hosted. It sets no cookie. Credentials, cookies and tokens are stripped from a report before it is stored, and your email and IP address are excluded by default.
Hosted policy pages set nothing
Documents we host for customers at policies.policy.monster set no cookies and load no analytics, no fonts from third parties, and no third-party scripts of any kind. Those pages are our customers’ own legal documents, served under their policy URL. A tracker there would load a script that the customer’s own disclosure does not mention, on their behalf, without their visitor’s consent — a compliance defect we would be creating for them. So there is nothing there to consent to.
The consent banner on our customers' sites
If you arrived here from a cookie banner on someone else’s website, these are the cookies that banner sets. They are set on that website’s domain, as first-party cookies, and we cannot read them from ours.
| Name | Purpose | Lifetime |
|---|---|---|
pm_consent | Records which categories the visitor agreed to, so the banner is not shown again on every page. | As configured by the site, up to 365 days |
pm_subject | A random first-party identifier that ties a consent record to the browser that gave it. It is not linked to any account, is not shared between sites, and is not used to track anyone. | 365 days |
Both are strictly necessary: they exist to record and honour a consent decision, which is a thing you cannot do without storing the decision. Neither is used for analytics or advertising. The site operator, not Policy Monster, is the controller of the resulting consent record — their privacy policy is the one that governs it.
How to control cookies
In your browser
Every major browser lets you see, block and delete cookies in its settings. Blocking ours will sign you out and stop you from signing back in, because the session cookie is how the product knows who you are — but nothing you lose by blocking them is a measurement or advertising feature, because there are none.
Global Privacy Control and Do Not Track
We honour the Global Privacy Control signal. There is no sale or sharing of personal information for it to opt you out of, so in practice it changes nothing about what we do — but the signal is respected rather than ignored, and the consent banner we serve to customers honours it by default.
We do not act on the older Do Not Track header, which was never given an agreed meaning. We do not track you either way.
Changes
If we add a cookie, this table changes in the same release. If we ever add one that is not strictly necessary, we will ask for your consent before setting it, and this page will say so first. Questions go to privacy@policy.monster.