FittingsOS Cookie and Tracking Notice
Effective date: October 6, 2026
Version: 2026.10.06-1
This Cookie and Tracking Notice (this “Notice”) explains how Montes Software LLC, a California limited liability company doing business as FittingsOS (“Provider,” “we,” “us,” or “our”), uses cookies, local storage, session storage, and similar technologies on the public website at https://fittingsos.com, the FittingsOS hosted user interface, and related public pages (together, the “Site”). This Notice supplements Section 7 of our Privacy Policy and forms part of it. If this Notice and the Privacy Policy conflict, the Privacy Policy controls.
1. What these technologies are
- Cookies are small text files that a website places in your browser. A cookie set by the site you are visiting is a first-party cookie. A cookie set by a different domain is a third-party cookie.
- Session cookies expire when you close your browser or sign out; persistent cookies remain until they expire or you delete them.
- httpOnly cookies cannot be read by JavaScript running on the page, which helps protect session credentials.
- Local storage and session storage are browser features that let a site keep small amounts of data on your device. Session storage is cleared when the browser tab closes; local storage remains until it is cleared.
- Challenge tokens are short-lived values used to distinguish people from automated traffic.
2. Categories we use
2.1 Strictly necessary
These technologies are reasonably necessary to provide the Site and the Software you request and to keep them secure. They are always on.
| Technology | Purpose | Where |
|---|---|---|
| httpOnly session cookie | Keeps you signed in to hosted FittingsOS after authentication. The access token is not stored in JavaScript on fittingsos.com. | Hosted sign-in and shop UI |
| CSRF token | Protects forms and requests against cross-site request forgery. | Hosted sign-in and shop UI |
| Terms-acceptance cache (local or session storage) | Remembers on your device that you have accepted the current instruments so the Site can route you correctly. Provider’s authoritative acceptance record is kept server-side as described in the Terms of Service. | Hosted shop UI |
2.2 Security and abuse prevention
| Technology | Purpose | Where |
|---|---|---|
| Cloudflare Turnstile challenge token | Helps confirm that a sign-in attempt comes from a person and not an automated attack. Used on hosted sign-in when the shop has Turnstile enabled. Cloudflare acts as our service provider, as listed on our Subprocessors page. | Hosted sign-in, when enabled |
| Security and request logs | Server-side records of IP address, user-agent, timestamps, and sign-in success or failure, used for rate-limiting, debugging, and incident response. These are logs, not cookies, and are described in the Privacy Policy. | Site and hosted shop UI |
2.3 Functional
| Technology | Purpose | Where |
|---|---|---|
| Accessibility preferences (local storage) | Remembers display and accessibility choices you make so you do not have to set them again. See our Accessibility Statement. | Site and hosted shop UI |
| Marketing-lead copy (local or session storage) | Keeps a copy on your device of a quote or custom-project form you just submitted so the page can confirm what you sent. | Public website |
2.4 Optional analytics
On the hosted shop UI, a notice asks before optional page-view analytics are enabled. Optional analytics run only if you choose to allow them. If you choose necessary cookies only, necessary session cookies stay on so sign-in and the shop book keep working, and optional page-view analytics stay off.
2.5 Advertising
We do not use advertising cookies, and we do not run a third-party advertising network on fittingsos.com. We do not use cookies or similar technologies for cross-context behavioral advertising.
3. No sale or sharing of personal information
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not disclose personal information to data brokers. These terms have the meanings given in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code § 1798.100 et seq.) (“CCPA”). Because we do not sell or share personal information, we do not display a “Do Not Sell or Share My Personal Information” link. If that changes, we will update the Privacy Policy and this Notice before the change takes effect and, where required, provide the opt-out link and obtain consent.
4. Global Privacy Control and Do Not Track
Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a valid request to opt out of the sale and sharing of personal information for that browser, consistent with Cal. Code Regs. tit. 11, § 7025. Because we do not sell or share personal information, honoring the signal does not change how the Site works for you.
Do Not Track. Some browsers send a “Do Not Track” header. Because we do not track users across third-party websites for advertising, and because no uniform standard for responding to that header has been adopted, the Site does not change its behavior in response to it. This disclosure is provided under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code § 22575(b)(5)).
5. Your choices
- Browser controls. Most browsers let you block or delete cookies and clear local and session storage. If you block or delete the session cookie, hosted sign-in will not work. Public pages remain readable.
- Analytics notice. On the hosted shop UI, you can choose necessary cookies only when the notice is presented.
- Clearing storage. Clearing site data in your browser removes locally stored preferences and the Terms-acceptance cache. You may be asked to confirm acceptance again at next sign-in.
6. Third-party links
The Site may link to third-party websites. Those sites set their own cookies under their own policies, which we do not control.
7. Customer configuration
A Customer organization that deploys FittingsOS may enable shop-level features, such as Turnstile on hosted sign-in. Customer organizations are responsible for any notices they owe their own employees and contractors about workplace systems.
8. Changes to this Notice
We may update this Notice when our use of these technologies changes. The effective date at the top of this page shows when it was last updated. If we introduce non-essential cookies on the public website that require consent, we will update this Notice and the Privacy Policy and, where required, obtain consent before setting them.
9. Contact
Questions about this Notice may be sent to the privacy and security contact listed in our Privacy Policy: security@fittingsos.com. Montes Software LLC, doing business as FittingsOS, 5392 Corradi Ter, Acton, CA 93510, United States.