WASID Cookie Policy

Last updated: 2026-07-28 Controller: Boldstep Productions Ltd, Accra, Ghana Contact: the access-request form

The short version

WASID sets one cookie, and it is strictly necessary — it is what keeps an internal verifier/analyst signed in to the internal review console after they log in. It is not used for analytics, advertising, tracking, or profiling, and it is not set for the general public (only for people who explicitly log in to the internal console).

Because WASID does not use analytics, advertising, or tracking cookies, no cookie-consent banner is required for this cookie under applicable law — strictly-necessary cookies used solely to provide a service the user has actively requested (here, a login session) are exempt from consent requirements under the EU's ePrivacy rules, and Ghana's Data Protection Act, 2012 (Act 843) has no stricter dedicated cookie regime.

If this changes — if we ever add analytics, advertising, or any non-essential tracking cookie/pixel/local-storage mechanism — this policy and our consent approach will be updated first, and a consent banner implemented before such cookies are set.

Cookie table

Name	Purpose	Set when	Duration	Essential?
`wasid_console`	Signed session cookie for the internal verifier/analyst console — keeps a signed-in reviewer authenticated between page loads so they can work the verification queue. Holds only the reviewer's display name (no password, no API key, no data about the public).	Only when a team member with console access logs in at `/console`. Never set for ordinary API customers or the general public.	Up to 14 days from login, or until logout, whichever comes first.	Yes — strictly necessary. Without it, the console (an internal tool, not a customer product) cannot maintain a login session.

If a future public marketing/landing site uses any cookie of its own (even a simple "notice dismissed" flag), it will be added to this table before that page ships.

Cookie security attributes

The console session cookie is configured as follows:

HttpOnly: Yes — the cookie cannot be read by page JavaScript, which mitigates theft via a cross-site-scripting (XSS) bug.
SameSite: Lax — the cookie is not sent on most cross-site requests, which mitigates CSRF-style abuse (all state-changing console routes are POST-only forms, which Lax blocks cross-site).
Secure: Yes in production — production deployments (WASID_ENV=production) set the Secure flag, so the cookie is only ever sent over HTTPS.
Name: wasid_console is the actual cookie name used by the code.

No other cookies

WASID's customer-facing API (Signal/Watch/Analyst feed access) is authenticated by an API key sent in a request header, not by a cookie — API customers do not receive any cookie from WASID in the course of normal use.

We do not use: - Analytics cookies (e.g. Google Analytics or similar). - Advertising or retargeting cookies. - Third-party tracking pixels or cross-site tracking mechanisms.

If any of the above is added in the future, we will update this policy first and implement an appropriate consent mechanism (e.g. a cookie banner with granular opt-in) before such cookies are set, consistent with applicable law at that time.

Managing the console cookie

If you are a WASID team member with console access and want to end your session immediately, use the "Sign out" control in the console, which clears the session. You can also block or delete cookies via your browser settings, though doing so will simply require you to log in again to use the console — it has no effect on the public-facing API.

Contact

Boldstep Productions Ltd, Accra, Ghana the access-request form