Cookie Policy

A cookie is a small piece of data the site asks your browser to store. The same principles apply to similar technologies: localStorage, sessionStorage, IndexedDB, pixel tags. This policy covers all of them. The short version: Watchpost uses strictly necessary storage to run the service. On marketing pages, Google Analytics is optional and loads only after you accept analytics in the cookie banner. We do not use advertising trackers.

This policy is part of the privacy policy.

1. The legal context

The EU ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC) is what most people mean when they talk about "cookie law". It says that storing or accessing information on your device requires your prior, informed consent unless the storage is strictly necessary to provide a service you have explicitly requested. The GDPR sets the standard for what counts as valid consent: freely given, specific, informed, unambiguous, and as easy to withdraw as to give.

2. What we use

2.1 Session cookie (strictly necessary)

When you sign in, we set a cookie that contains an opaque session identifier. The cookie is set by watchpost.systems with the HttpOnly, Secure, and SameSite=Lax flags. It expires when you sign out, or after seven days of inactivity, whichever comes first.

This cookie is strictly necessary: without it you cannot stay signed in. The ePrivacy exemption applies, so we do not ask for consent to set it.

2.2 Local storage entries

A few preferences live in your browser's local storage. Both are scoped to the watchpost.systems origin and can be cleared from your browser settings any time.

• watchpost.cookies.v1 — your "accept" or "reject" choice from the cookie banner. Stored for 12 months. Strictly necessary in the sense that we cannot honor your choice without remembering it.
• theme — your light or dark theme preference (used by the toggle in the nav). Stored indefinitely until you clear it. Strictly necessary for the preference to persist.

2.3 Google Analytics (optional)

If you accept analytics, public marketing, signup, onboarding, and billing pages load Google Analytics 4 from Google. It records page views, referral source, broad device and browser information, and an approximate location derived from the request. Private account activity and staff pages are excluded. We disable Google Signals and advertising personalization in our configuration. We do not send your name, email address, purchase verdicts, rules, or connection tokens to Google Analytics.

Google Analytics may set _ga and a property-specific _ga_* cookie to distinguish visits. Google documents a default lifetime of up to two years, which may be refreshed when you return. These cookies are not requested before consent. Rejecting or withdrawing consent leaves the rest of Watchpost working normally.

3. What we don't use

• Advertising and marketing cookies. No remarketing pixels, no Facebook Pixel, no LinkedIn tag, no TikTok pixel.
• Cross-site advertising trackers. No third-party ad network or remarketing domain is loaded by our pages.
• Fingerprinting. No canvas fingerprinting, font enumeration, or similar techniques.
• A/B testing platforms. No third-party experimentation tools.

4. Third parties on pages we link to

If you click through to GitHub, Stripe's checkout page, or a merchant's site, those third parties may set their own cookies. We do not control those. Their policies apply.

5. The cookie banner

A short banner appears the first time you visit. It explains the optional analytics purpose and asks whether you accept or reject it.

Accepting allows the Google Analytics script to load on marketing pages. Rejecting keeps it unloaded. If we add another optional category, we will update this page first, explain the purpose, and request fresh consent where the change is material.

You can change your choice at any time with the Cookie settings button in the footer, by clearing watchpost.cookies.v1, or with your browser's "clear site data" tool.

6. Refusing or removing cookies

Most browsers let you block or delete cookies and local storage. The exact controls vary by browser; the help pages from Firefox, Chrome, and Safari are good starting points.

If you block our session cookie, you will not be able to stay signed in. Everything else still works.

7. Changes

We will update this page before adding any new cookie or storage entry, and bump the "Last updated" date at the top. Material changes (a new processing purpose, a new third party) trigger a fresh consent prompt.

8. Contact

Questions: privacy@watchpost.systems.