Cookie Policy

We do not use cookies

We set no cookies. Not in the app, not in the API, not on the marketing site.

There is no analytics cookie, no advertising cookie, no tracking pixel, and nothing that follows you to another website. No advertising network is involved in this product anywhere.

The rest of this page is the small amount that is stored instead, and why.

What is stored in your browser instead

Local storage, not cookies. Here is the whole list.

We use local storage. The difference in one line: a cookie is attached to requests your browser makes, automatically, while local storage is not attached to anything and is only read by the page when it needs it.

Here is the whole list of what we keep there:

• Your sign-in token, which is what keeps you signed in on this browser.
• Your account email address. It stays in the browser between visits so the app can show whose account this is without asking the server first.
• Your email address again while you are in the middle of signing in, so the code screen knows who to check. That one lives in the tab and goes when the tab does.
• Your interface preferences: your theme, your custom colors, which panels you collapsed, which modules you hid, and which hints you dismissed.
• Things you typed into your settings that are not preferences at all. Your display name, and the album name, production name, and legal name you keep for filling in track details. The legal name is there because you typed it, and it stays in the browser like the rest.
• A copy of some of your own account data, so the app opens quickly and keeps working when the network drops. That can include your pack notes, your send history, the addresses you sent to, and the share links you made, including the links themselves.
• A one-off note recording that you declined the policies, so the sign-in screen can tell you why you landed back there. It holds the number 1 and nothing else, and it is deleted the moment it has been read.

None of it is used to track you. None of it is sold or handed to anybody else. There is no profile being built.

The sign-in token goes to us with each request, so we know the request is yours. That is the only item that leaves your browser.

If you open a download link without an account, we store nothing in your browser at all.

Cookies Cloudflare may set

We run on Cloudflare, which sits in front of the service and sees every request before it arrives.

Cloudflare may set a small number of its own cookies on the wavalt.com domain. We do not set them and do not read them. They appear because your request passed through Cloudflare, and which of them you get depends on the request. They are there for:

• Security, including keeping attack traffic away from the service.
• Telling automated traffic apart from real people, which is also what the quick check at sign-in is doing.

They are not advertising cookies, and we do not use them to learn anything about you.

The Privacy Policy lists the outside services we depend on, Cloudflare included, and what each one sees.

Why there is no cookie banner

Consent banners exist because of tracking. Nothing here is used for tracking or for advertising.

What is stored is either needed to sign you in or something you chose yourself. So there is no banner and nothing to click through.

If we ever add something that does track you, this policy changes first, and you get asked before it is switched on.

Signing out clears nearly all of it

Two things survive, and neither says anything about you.

Signing out wipes what we stored in that browser. The sign-in token, your account email, your display name, the album, production and legal names, the cached account data, the addresses you sent to, and the share links all go.

Two things stay. Your theme, so the next sign-in does not flash a different color scheme at you. And, if you got there by declining the policies, the one-off note that lets the sign-in screen explain why. That note holds the number 1, lives in the tab, and is deleted as soon as it has been read.

This is the part that matters on a shared or borrowed machine. Sign out when you are done and the next person finds nothing about you. Clearing "Keep me signed in" before you sign in is the belt to that braces: it keeps the token out of long-term storage in the first place.

How long it lasts, and clearing it yourself

Where the sign-in token is kept, and how long it lasts, is your choice at sign-in. The box is called "Keep me signed in" and it starts off, so the shorter, more private option is what you get unless you ask for the longer one.

Checked, the token goes to local storage, which has no expiry date of its own. What is stored stays until it is cleared. Closing the browser does not clear it, and closing the browser does not sign you out. The token itself stops working after 30 days without use, and 365 days no matter what.

Cleared, the token goes to session storage instead. That is per tab and the browser drops it when you close it, so closing the browser does sign you out. The server ends that sign-in too: 12 hours without use, and 24 hours no matter what. Leave the box off on a shared or borrowed computer.

Either way, when the token stops working you sign in again.

Two ways to clear it yourself:

• Sign out of WAValt, which is the one-click version.
• Clear site data for wavalt.com in your browser settings, which removes everything, the theme and the Cloudflare cookies included.

Clearing site data signs you out and resets your preferences. Nothing on your account is lost: your files, your packs, your sends, and your history live on the server, not in your browser.

Do Not Track

Some browsers send a Do Not Track signal. We do no tracking across websites, so there is nothing for that signal to change.

The Privacy Policy says the same, and it covers who else sees a request when you use WAValt.