Cookie and Tracking Policy

Cookie Categories

• Essential cookies: authentication, CSRF, session security, logout markers, locale, and service integrity.
• Preference storage: theme, playback, local drafts, offline cache state, and product preferences.
• Analytics and performance: Google Analytics/Firebase Analytics, Vercel Analytics, first-party analytics events, traffic attribution, and reliability telemetry where enabled.
• Security and bot-prevention storage: Turnstile tokens, abuse-prevention signals, rate-limit metadata, and session integrity checks where enabled.
• Integration storage: temporary OAuth state, import status, and provider connection data needed to connect services such as Google Drive or Dropbox.

Consent and Changing Choices

Essential cookies, security storage, anti-abuse checks, OAuth state, payment-session routing, and account-access storage are required for Mojo White to work and cannot be disabled through a cookie preference request.

Where consent is required, Mojo White should keep non-essential analytics off unless the user chooses to allow them through the cookie banner or privacy settings. Outside those regions, Mojo White may use analytics unless a user opts out or local law requires a different choice path.

To opt out of non-essential analytics, email help@mojowhite.com with the subject line Cookie Opt-Out and include the account email or browser/device context needed to process the request.

Email-based opt-out requests may not disable cookies that are required for account access, security, fraud prevention, legal compliance, payments, imports, or features you request.

Opt-out handling may be browser, device, account, or provider specific. If you use Mojo White from another browser, clear cookies, use private browsing, reinstall the app, or use the service before an opt-out is processed, analytics or telemetry may still be collected.

Vendor Purposes

• WorkOS and Mojo White session storage: account access, authentication state, logout state, and session security.
• Cloudflare Turnstile: bot prevention, challenge verification, abuse control, and service integrity.
• Upstash and rate-limit storage: usage counters, abuse-prevention metadata, and request throttling.
• Google Analytics and Firebase Analytics, including GA4 property G-7M0BC21NEQ: traffic attribution, product analytics, conversion measurement, and feature reliability where enabled.
• Vercel Analytics: traffic, performance, and reliability measurement where enabled.
• Google Drive and Dropbox OAuth state: temporary connection state and import security when a user chooses an import integration.

Retention

Cookie and analytics retention depends on the specific browser, device, provider, account setting, and configured retention period. Some cookies expire at session end, while other preference or analytics identifiers may persist for a longer configured period.

Mojo White does not intentionally place document text, prompts, generated audio, or private filenames into analytics cookies or analytics event payloads.

The Subprocessors page lists provider purposes, personal-data categories, and relevant safeguards.

Do Not Track and Global Privacy Controls

Browsers may send Do Not Track, Global Privacy Control, or similar signals. Mojo White's email path remains available at help@mojowhite.com while browser-signal handling is implemented or expanded.

Where legally required and technically supported, Mojo White will treat Global Privacy Control or a comparable recognized signal as an opt-out signal for sale/share or non-essential tracking choices.

Analytics Boundaries

Mojo White analytics is designed to measure product events, reliability, conversion, and aggregate behavior without storing document text, prompt content, generated audio, private filenames, or other user content in analytics payloads.

First-party interaction analytics uses stable element identifiers and redaction controls rather than raw text from user content or private UI surfaces where instrumentation is under Mojo White's control.