Cookie Policy
Last updated: 12 July 2026
This page lists every cookie Whao actually sets — nothing more. We keep this list in sync with what the code does, not with a generic template.
1. Strictly necessary cookies (always on)
These cookies are required for the site to work — you can't opt out of them, and under GDPR/PECR they don't require consent because they're necessary to provide the service you asked for (staying logged in, keeping your OAuth flow secure).
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
sb-*-auth-token | Supabase Auth (via our server) | Keeps you signed in to your dashboard session | Session / until sign-out |
g_oauth_pkce | Whao | Temporarily holds the security parameters (PKCE verifier, state) of a Google account connection while you complete the consent screen — prevents CSRF and interception | 10 minutes |
2. Non-essential cookies (only with your consent)
Whao uses Google Analytics 4 on our marketing pages to understand how visitors find and use the site. These cookies are not set until you click "Accept"on the cookie banner — the tracking script itself isn't even loaded before that.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics | Distinguishes unique visitors | Up to 2 years |
_ga_<container-id> | Google Analytics | Persists session state for GA4 measurement | Up to 2 years |
We do not use any advertising, retargeting, or social media tracking pixels. Fonts on this site (Fraunces, Inter Tight) are bundled and self-hosted at build time — no request is made to Google Fonts servers, and no cookie is set for them.
3. How the banner works
The first time you visit, we show a banner with two equally-weighted options: Accept and Reject. Nothing beyond the strictly necessary cookies above is set until you actively click Accept. If you click Reject, or close the banner without choosing, Google Analytics stays off. Your choice is remembered locally in your browser (via localStorage) so we don't ask again on every page.
4. Browser controls
You can also block or delete cookies at any time through your browser settings. Blocking the strictly necessary cookies above will prevent you from staying signed in to the dashboard.
5. Contact
Questions about this Cookie Policy: privacy@whao.dev.