Cookie Policy

Effective Date: August 19, 2026

This Cookie Policy explains how Pro Nova Technologies Inc. ("we," "us," or "our") uses cookies and similar tracking technologies when you visit our website at https://rmms.pronovatech.com (the "Site") and use our related services. By using our Site, you consent to the use of cookies as described in this policy.

1

What Are Cookies?

Cookies are small text files that are stored on your device (computer, tablet, or mobile) when you visit a website. They help websites remember your preferences, login information, and other settings to improve your browsing experience.

Cookies can be "persistent" (stored until they expire or you delete them) or "session" cookies (deleted when you close your browser).

2

Types of Cookies We Use

Essential

Essential Cookies

These cookies are required for the portal to function. You cannot opt out of them — the portal will not load correctly without them.

What we set:
  • PNT.RMMS.Auth — your sign-in cookie. HttpOnly, Secure, SameSite=Lax, 24-hour sliding expiration. Removed when you sign out. Lax rather than Strict so that returning to the portal from our payment processor keeps you signed in; it still withholds the cookie from cross-site POST and subresource requests, and every state-changing form additionally carries an anti-forgery token.
  • ASP.NET Core anti-forgery tokens — protect form submissions against cross-site request forgery (CSRF). Issued automatically when you load any form.
  • Two-factor authentication challenge cookies — short-lived; used only between password entry and TOTP entry during sign-in.
Functional

Other Browser Storage

Two values are kept in your browser's own storage rather than as cookies. We do not store UI preferences such as themes or layouts there, and we place nothing else.

What we store in your browser:
  • pnt.pendingCheckout (localStorage) — written just before we send you to our payment processor, so that if you come back and the subscription has not appeared yet we can tell you a payment may still be settling instead of inviting you to pay twice. It holds the company the checkout was for, that company's name, and the time you started. It stays on your device and is not sent to our servers. We stop acting on it after one hour; it is deleted from your browser once your subscription is confirmed, or when you tell us the earlier attempt was abandoned, and clearing your browser's site data removes it at any time.
  • pnt-tz-synced (sessionStorage) — a single flag recording that your time zone has been accepted, so the report is not repeated on every page you open. It is cleared when you close the tab. The time zone itself is sent to us. On any page of the portal your browser reads the IANA time-zone name it is set to (for example America/Toronto) and posts it to us. If you are signed in we store it on your account, so that dates and times are shown in your local time rather than in UTC; if you are not signed in the request is refused and nothing is kept, and because the flag is only set on success your browser will try again on the next page.
What we don't use

No advertising, no third-party analytics, no tracking pixels

We do not run Google Analytics, Meta Pixel, TikTok Pixel, ad-network beacons, or any third-party tracking script. We do not place advertising cookies, build cross-site profiles, or sell data to advertisers. The portal also does not use cookies to authenticate the PNT-RMMS Agent — Agent-to-portal traffic uses an X-Device-Token HTTP header instead.

3

Third-Party Cookies

The only third party that may set a cookie on a page hosted by us is Stripe, and only on the pages where you actually start or manage a subscription:

Stripe

When you enter payment details on the Stripe-hosted checkout flow, Stripe sets its own cookies for fraud prevention and checkout session continuity. These cookies are governed by Stripe's privacy policy. We never see your card data.

No other third-party service places a cookie through our portal.

Third parties that receive your IP address without setting a cookie

Cookies are not the only way information reaches a third party. Our portal pages load two resources from external networks, and because your browser must connect to those networks to fetch them, each connection discloses your IP address and your browser and operating-system version to the provider. We ask your browser not to tell them which page of the portal you were on, and neither of them sets a cookie or sends us anything back, but we disclose them here because a statement limited to cookies alone would give an incomplete picture:

Google Fonts

Web fonts used for the portal's typography, served by Google. Governed by Google's privacy policy.

jsDelivr

A content delivery network serving an open-source icon set used in the portal interface. Governed by jsDelivr's privacy policy.

These are presentational resources only. They are not analytics, advertising or tracking services, and we do not send them any information about your account, your devices or your activity in the portal.

4

Service Worker & Browser Notifications

If — and only if — you turn on browser notifications from Notification Settings in the portal, two further things happen on your device. Neither is enabled by default, and neither happens for a visitor who never switches them on.

Service worker

A small script installed in your browser

Your browser installs /sw.js, a script that stays registered after you close the tab. It exists so a notification can be shown when the portal is not open. It does exactly three things: display a notification we send, open the portal at the right page when you click one, and re-register your subscription if your browser rotates it. It does not cache pages, does not track you, and does not run when there is nothing to show.

It is removed when you turn browser notifications off in the portal, and you can remove it yourself at any time from your browser's site-settings or storage panel.

Third-party recipients

Your browser's push service receives the message

Web push does not travel from us to you directly. Every browser delegates delivery to a push service run by its maker, and your browser chooses which one — we cannot. When you subscribe, your browser gives us an address at one of these services, and we send each notification to that address:

Google (Firebase Cloud Messaging)

Chrome, Chromium and Microsoft Edge. Governed by Google's privacy policy.

Mozilla

Firefox. Governed by Mozilla's privacy notice.

Microsoft (Windows Notification Service)

Older Edge builds and Windows notification delivery. Governed by Microsoft's privacy statement.

Apple

Safari. Governed by Apple's privacy policy.

What the push service can see, stated precisely: the address it issued for your browser, the fact that we sent something to it and when, how long we asked it to hold the message, and a contact address for us (support@pronovatech.com) that identifies Pro Nova rather than you. It cannot read the notification. What we hand it is the notification — its heading and text, which for a device alert names the device concerned — sealed before it leaves us with keys your browser generated and never shared with the push service, so it passes through as unreadable bytes and can be opened only by the browser that subscribed. Nothing else is attached to it: not your name, not your email address, and no account or device record beyond whatever the notification itself says.

Turning browser notifications off in the portal unsubscribes your browser and deletes the stored address. If instead you block notifications for this site in your browser, nothing further is displayed to you; the stored address is then removed the next time your browser's push service tells us it is no longer in use.

5

Managing Cookies

You have several options for managing cookies:

Browser Settings

Most browsers allow you to control cookies through their settings. You can:

  • View and delete cookies stored on your device
  • Block all or certain types of cookies
  • Set preferences for specific websites
  • Enable "Do Not Track" signals

Browser-Specific Instructions

Chrome Firefox Safari Edge
Note: Disabling cookies may affect the functionality of our Site. Some features may not work properly without essential cookies.
6

Cookie Retention

How long each cookie sticks around:

PNT.RMMS.Auth 24-hour sliding expiration; cleared on sign-out.
Anti-forgery tokens Per-session; cleared when you close the browser.
2FA challenge cookies A few minutes between password and TOTP entry.
pnt.pendingCheckout (localStorage) Ignored after one hour; deleted when your subscription is confirmed or when you dismiss the notice; otherwise until you clear site data.
pnt-tz-synced (sessionStorage) Until you close the browser tab.
Service worker (/sw.js) Only if you enable browser notifications; until you disable them or remove it in your browser.
Push subscription address Held by us until you disable browser notifications, or until your browser reports the address is dead.
Stripe checkout cookies Set on stripe.com — see Stripe's privacy policy.
7

Updates to This Policy

We may update this Cookie Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the "Effective Date" at the top of this page when we make changes.

We encourage you to review this policy periodically to stay informed about our use of cookies.

8

Contact Us

If you have any questions about our use of cookies or this Cookie Policy, please contact us:

Pro Nova Technologies Inc.
https://rmms.pronovatech.com
support@pronovatech.com

Rejoining the server...

Rejoin failed... trying again in seconds.

Failed to rejoin.
Please retry or reload the page.

The session has been paused by the server.

Failed to resume the session.
Please retry or reload the page.