Digadop Cookie Policy
Effective Date: September 28, 2026
This Cookie Policy explains how Stony Point, Inc., a Florida corporation, doing business as (“d/b/a”) Digadop (“Digadop,” “we,” “us,” or “our”), 8742 Peachtree Park Ct, Windermere, FL 34786, uses cookies and similar technologies across the Digadop products and websites, including the websites at whoseeswhat.com, whoseeswhat.ai, and their subdomains. It supplements the Digadop Privacy Policy.
1. What cookies are
Cookies are small text files placed on your device when you visit a website or use a web application. Similar technologies (such as local storage and tokens) work in comparable ways. We use these technologies to operate and secure our Services.
2. Cookies we use
2.1 Strictly-functional (essential) cookies
These cookies are necessary for the Service to function and to keep your session secure. They cannot be switched off through our systems without breaking core functionality. The following are used by the Who Sees What Service:
| Cookie | Purpose | Lifetime and attributes | Type |
|---|---|---|---|
wsw_session | Maintains your authenticated session after sign-in. This is an HMAC-signed session cookie used to keep you logged in and to protect session integrity. | 2 hours, or 30 days if you choose “remember me.” HttpOnly; SameSite=Lax; Secure on https connections. | Strictly-functional / essential |
wsw_orgs | Remembers which Connected Orgs you have connected, so the Service can pre-fill them at sign-in. | 30 days. HttpOnly; SameSite=Lax; Secure on https connections. | Strictly-functional / essential |
sp_consent | Set by our first-party consent tool on the whoseeswhat.com and whoseeswhat.ai websites. Stores your cookie-consent choice per category, the version of the banner text you were shown, the timestamp, and the consent rule that applied to you (prior consent or notice) with the country and region code it was based on, so we can honor your choice on later visits and prove it was recorded. It contains no tracking identifier that is shared with any third party. | 180 days. SameSite=Lax; Secure on https connections. | Strictly-functional / essential |
wsw_pkce | A short-lived cookie set during the OAuth sign-in flow to provide CSRF protection for the authorization exchange (PKCE). It is used only during sign-in and then discarded. | Ephemeral, under 5 minutes. HttpOnly; SameSite=Lax; Secure on https connections. | Strictly-functional / essential |
The web client sets no analytics or marketing cookies. It uses browser localStorage only for a front-end debug flag, which contains no personal data.
2.2 Analytics cookies
The whoseeswhat.com and whoseeswhat.ai marketing websites use Google Analytics 4 to understand how visitors use the site: which pages are read, where visitors arrive from, and which forms are completed. Google Analytics sets non-essential analytics cookies. Whether they are set before you make a choice depends on where you are visiting from, because our consent tool applies the rule of your location:
- Where the law requires prior consent (the European Union and European Economic Area including their outermost regions, the United Kingdom with Gibraltar, Jersey, Guernsey and the Isle of Man, Brazil, Turkey, China, South Korea, India, Vietnam, the Canadian province of Quebec, and, while we review their rules, Israel, Saudi Arabia and Argentina), we do not set analytics cookies until you opt in through our cookie-consent banner. The same applies whenever we cannot determine your location. If you reject analytics, or make no choice, no Google Analytics code loads and no analytics cookie is set.
- Everywhere else (for example the United States, Canada outside Quebec, Switzerland, Japan, Australia, New Zealand, Mexico and South Africa), analytics is on by default and a notice tells you so when you first visit. The notice offers a one-click “Opt out”; you can also turn analytics off at any time with the notice’s “Manage” control or the persistent “Cookie preferences” control. Either way, doing so stops further collection and deletes the Google Analytics cookies. If your browser sends the Global Privacy Control signal, we treat it as a request to turn analytics off and never load Google Analytics, wherever you are.
- If we cannot determine your location, we apply the prior-consent rule.
Our consent tool determines your location from your network address at the edge of our content network at the moment of the visit; the location is not stored beyond the country and region code recorded with your choice.
| Cookie | Purpose | Typical lifetime | Type |
|---|---|---|---|
_ga | Google Analytics: distinguishes unique visitors (client ID) | Up to 2 years | Analytics (non-essential, consent-gated) |
_ga_<container-id> | Google Analytics 4: persists session state | Up to 2 years | Analytics (non-essential, consent-gated) |
We use Google Analytics 4, which does not set the legacy _gid cookie. We enable IP anonymization, set Google Consent Mode to “denied” by default in every prior-consent location until you opt in, and disable Google Signals and ad-personalization signals, so your analytics data is not used for Google advertising. The same Google Analytics property is shared with our other websites (stonyp.com and digadop.ai) so that a visit that moves between them is measured as one journey; it is not shared with any other organization. Google’s own description of how it uses data is at policies.google.com/technologies/partner-sites.
When Google Analytics runs, your browser sends Google LLC (United States), acting as our processor, the address of the page you are viewing and the page that referred you, your browser and device details, a truncated IP address used only for coarse location, and site events such as a form submission. We use this only to measure how the site is used. Google Analytics retains this data for 2 months. The transfer to the United States relies on Google’s certification under the EU-US Data Privacy Framework and its UK and Swiss extensions.
The Who Sees What application (the signed-in product at /app) sets no analytics or marketing cookies. Its service-improvement analytics are first-party and server-side.
No advertising cookies. We do not set advertising, cross-site tracking, or session-replay cookies on any site.
2.3 Third-party content delivery
Loading the Who Sees What web application contacts a third-party content-delivery network (esm.sh) to retrieve front-end framework code at runtime. esm.sh does not set cookies, but your browser’s request to it discloses your IP address and user-agent string when the application loads.
3. How to control cookies
On the marketing website, you control analytics cookies through our consent tool: in prior-consent locations you accept or reject Google Analytics when you first visit; elsewhere the first-visit notice offers “Opt out” and “Manage”. In every location the persistent “Cookie preferences” control lets you change or withdraw your choice at any time, as does clearing the sp_consent cookie, which shows the banner or notice again on your next page view. Withdrawing consent, or turning analytics off, stops further analytics collection and deletes the Google Analytics cookies from your browser. We also honor the Global Privacy Control browser signal as described above.
Because our strictly-functional cookies are essential to operating and securing the Service, disabling them may prevent you from signing in or using core features.
You can control or delete cookies through your browser settings. Most browsers let you refuse cookies, delete existing cookies, and warn you before a cookie is stored. The steps differ by browser; consult your browser’s help pages. If we introduce non-essential cookies, we will provide a consent mechanism to let you accept or reject them.
4. Changes to this policy
We may update this Cookie Policy from time to time. When we make material changes, we will update the Effective Date below.
5. Contact
Questions about this Cookie Policy can be directed to privacy@digadop.com.
Stony Point, Inc., doing business as Digadop 8742 Peachtree Park Ct, Windermere, FL 34786, USA
© 2026 Stony Point, Inc. d/b/a Digadop. Effective Date: September 28, 2026. Version 1.1.