WASID Cookie Policy
Last updated: 2026-09-10 Controller: Boldstep Productions Ltd, Accra, Ghana Contact: via the public access-request form on wasid.ai (addresses are not published on this page)
The short version
WASID sets one first-party session cookie for authenticated product surfaces. It keeps a signed-in risk-console user or a royalty/land customer seat authenticated after login. It is not used for analytics, advertising, tracking, or profiling, and it is not set for anonymous public visitors.
Because WASID does not use analytics, advertising, or tracking cookies, no cookie-consent banner is required for this cookie under applicable law — strictly-necessary cookies used solely to provide a service the user has actively requested (here, a login session) are exempt from consent requirements under the EU’s ePrivacy rules, and Ghana’s Data Protection Act, 2012 (Act 843) has no stricter dedicated cookie regime.
If this changes — if we ever add analytics, advertising, or any non-essential tracking cookie/pixel/local-storage mechanism — this policy and our consent approach will be updated first, and a consent banner implemented before such cookies are set.
Cookie table
| Name | Purpose | Set when | Duration | Essential? |
|---|---|---|---|---|
wasid_session |
Signed Flask session cookie for the risk console (/app, /login) and for royalty/land customer seats after they sign in on their product front doors. Holds role/session identity only — no password, no API key, no monitored-source content. |
Only after a successful password or OAuth login. Never set for ordinary anonymous homepage visitors. | Up to 8 hours from login (PERMANENT_SESSION_LIFETIME), or until logout, whichever comes first. |
Yes — strictly necessary for authenticated product use. |
Cookie security attributes
- HttpOnly: Yes
- SameSite:
Lax - Secure: Yes in production HTTPS deployments
- Name:
wasid_session(FlaskSESSION_COOKIE_NAME)
No other cookies
Machine-to-machine API access uses bearer tokens in the Authorization header, not cookies.
We do not use analytics cookies, advertising cookies, or third-party tracking pixels. Self-hosted fonts are used on public and console surfaces; Google Fonts are not loaded.
Managing the session cookie
Use Sign out in the product UI, or clear site cookies in the browser. Blocking the cookie simply requires a fresh login for authenticated surfaces.
Contact
Boldstep Productions Ltd, Accra, Ghana — use the public access-request form on wasid.ai.
This policy reflects the cookie behaviour implemented in the WASID Flask app: one session cookie named wasid_session, 8-hour lifetime when session.permanent is set at login, no analytics or advertising cookies.