Cookie Policy and Settings

Version 2026-10-27.1 · Updated 27 October 2026

DRAFT — owner and professional legal approval required before commercial reliance. Missing details and unverified safeguards are explicitly identified below.

Current settings

Only service-related storage was found in first-party source inspection. No first-party analytics, advertising pixels or optional cookie categories were found. No consent banner or tracking has been added. This is a source inventory, not a completed live-browser or third-party checkout cookie audit.

Storage inventory

Supabase JS authentication: sb-ymnswcstdwerlwegqpkb-auth-token (localStorage, SDK-derived expected key; runtime verification required), purpose login persistence, until sign-out/clearance, tokens refresh/expire independently. whale.workspace.v4.<user-id or draft> and legacy v3 (localStorage): onboarding content/settings until manually cleared, with no automatic expiry. whale.selectedPlan (sessionStorage): selected plan until tab session ends. The widget session token is held in memory until page unload and has server expiry; no widget cookies are set by source code.

Providers and choices

WHALE supplies onboarding storage; Supabase supplies authentication. Google OAuth and external Paddle checkout may use their own storage, which has not been inspected. Sign out to remove the active authentication session; use browser site-data controls to remove onboarding drafts and other persistent data. Clearing storage can lose unsaved work. The publicly served widget makes no chat request until a message is submitted.

Before optional technology is introduced

Re-audit every script and provider. Add a versioned consent configuration with unselected optional categories, equally accessible acceptance/rejection, withdrawal and script blocking before activation. Do not treat this necessary-storage notice as permission for future tracking. The necessity of persistent onboarding content requires owner review and minimisation.