We do not track you. This site sets no advertising cookies, no analytics cookies, and no third-party cookies. There are no trackers, no pixels, and no fingerprinting. The only external script we load is Cloudflare’s cookieless Web Analytics beacon (it sets no cookies and does not follow you between sites); our Content Security Policy blocks everything else.
That is why you are not being asked to click a consent banner. There is nothing to consent to.
Why other sites show a banner and we do not
Consent is required for non-essential cookies — advertising, analytics, and anything that follows you between sites. Cookies that are strictly necessary to deliver a service you asked for are exempt.
The public pages of this site set no cookies at all. The only cookies we set are session cookies, and only after somebody deliberately signs in to a private portal. Those are strictly necessary: without one, signing in does not work.
We still have to tell you they exist, which is what this page is for.
What is actually set, and only after you sign in
| Cookie | Set when | Purpose | Lasts |
|---|---|---|---|
mh_session | Staff sign in | Keeps a staff member signed in | 12 hours, or 20 minutes idle |
mh_family | Family portal sign in | Keeps a family member signed in | 1 hour, or 15 minutes idle |
mh_cand | Applicant portal sign in | Keeps a job applicant signed in while they read and sign an offer | 12 hours, or 30 minutes idle |
mh_partner | Referral partner sign in | Keeps a referral partner signed in | Session |
mh_vendor | Contractor portal sign in | Keeps a contractor signed in | 8 hours, or 30 minutes idle |
Every one of them is HttpOnly (unreadable by scripts), Secure (sent only over HTTPS), and SameSite=Strict (never sent from another site). Each is scoped to its own portal path, so a family cookie cannot reach a staff page.
They contain a random session token and nothing else — no name, no personal information, no record of what you looked at.
What we do not do
- No Google Analytics and no analytics cookies — for aggregate traffic counts we use Cloudflare’s privacy-first, cookieless Web Analytics, which sets no cookies and cannot identify you
- No advertising or retargeting pixels
- No social media embeds or share widgets
- No fonts loaded from anyone else — ours are served from this site, so no third party learns you visited
- No selling or sharing of personal information
The font point is deliberate and often missed: loading a font from a third party tells that company every page you looked at, on a site about disability, addiction, and homelessness. That is not a small thing for the people who read this site, so we host them ourselves.
Controlling cookies
Every browser lets you block or delete cookies. If you block ours you can still read every public page — you simply will not be able to sign in to a portal, because the sign-in has nothing to remember you by.
Questions
Privacy questions: privacy@maiheaven.com. See also our Privacy Policy and Terms of Use.