ReserveMesa, Inc.

Cookies and device data

Effective 2026-08-19. Templates — not legal, tax, or insurance advice.

ReserveMesa materials are product templates for an application process. They are not legal, tax, or insurance advice. A California attorney and a licensed broker must review any live program. Quotes are estimates. Applications are not offers. Inspection, underwriting, match, and countersignature are required before any vehicle changes hands.

1. Strictly necessary

Signed-in session (httpOnly cookie), CSRF on server actions, theme preference, and the first-visit notice flag. The product does not run without these.

2. Security / fraud snapshots

After you acknowledge the collection notice, the browser may post a snapshot of APIs that Chrome, Safari, Firefox, and Edge all expose or quietly omit: user-agent / Client Hints, language, hardware concurrency, device memory, network information, screen, timezone, storage estimate, display-mode. We do not prompt for GPS from the browser. We do not draw a canvas fingerprint. The desk uses this to see “iPhone Safari, Oakland timezone, 4G” — not to sell ads.

Turn it off in the notice banner, or send Global Privacy Control. Signed-in fraud review may still see the user-agent the request already sent.

3. What we do not set

No advertising pixels. No “share” to Meta/Google ads from this domain. Google or Apple sign-in is their cookie on their domain when you tap those buttons.

4. More

Privacy policy is the CPRA notice.