Wah! SMARTDEALS Cookie Policy
Effective date: October 7, 2026
This Cookie Policy explains how WahSmartDeals LLC ("Wah!", "we", "us") uses cookies and similar technologies on our website, web app, and mobile apps. It should be read with our Customer Terms / Vendor Terms and the applicable Customer Privacy Policy / Vendor Privacy Policy.
In short: the Wah! app and website set no cookies of their own. They store a small amount of information in your browser or on your device to keep you signed in and to remember your drafts and settings. We use no advertising or analytics trackers.
1. What are cookies and similar technologies
Cookies are small text files stored on your browser or device. "Similar technologies" include browser local storage and session storage, IndexedDB, mobile-app preferences, native secure storage (such as Keychain/Keystore), device identifiers, and pixels. In this policy, "cookies" refers to all of these.
2. Why we store information on your device
- Strictly necessary: keeping you signed in, session integrity, security, and abuse prevention.
- Functional: your settings, drafts, and offline copies of your coupons, so the app works smoothly.
- Diagnostics: error and performance reports so we can fix problems.
- Security: a human check (Cloudflare Turnstile) at sign-up and when claiming a Sponsor deal, and limits on how often some actions can be repeated.
3. Technologies we use
What the Wah! app stores on your device:
| Item | Purpose | Storage | Essential? |
|---|---|---|---|
| Sign-in token (Supabase) | Keeps you signed in | Browser local storage; on the phone app, also mirrored into app preferences | Yes, strictly necessary |
| Role and biometric-unlock flags | Which part of the app to show you; whether Face ID or fingerprint unlock is on | Local storage | Functional |
| Biometric sign-in credential | Lets your phone's Face ID or fingerprint unlock your sign-in. It includes your phone number as the username. Wah! never receives biometric data | Device keychain / keystore | Only if you turn on biometric unlock |
| Push-prompt flag and push data | Remembers whether you were asked about notifications; supports push | Local storage; IndexedDB (browser push) | Functional; push only after you opt in |
| Pending invite | Remembers an invite code until you finish signing up | Local storage | Functional |
| Offline copies of your coupons | Shows your coupons without a connection. Removed when you sign out | Local storage | Functional |
| Review and claim drafts | Keeps what you were typing | Local or session storage | Functional |
| Sign-up form | Keeps your sign-up details if you go back and forward | Session storage | Functional |
| Business screen preferences | Remembers display choices on business screens | Local storage | Functional |
| App-store banner dismissal | Remembers that you closed the banner | Local storage | Functional |
| Update bundles (mobile apps) | Stores app content downloaded by our over-the-air update mechanism | Local app storage | Functional |
Services that run on your device or that your device contacts:
| Provider / source | Purpose | Storage / how | Essential? |
|---|---|---|---|
| Supabase | Sign-in and data | Sign-in token as above | Yes, strictly necessary |
| Vercel (hosting/CDN) | Content delivery and security; records page requests (IP address, device string) | Infrastructure | Yes, strictly necessary |
| Sentry | Error and performance diagnostics. About 10% of production page loads are sampled; there is no session replay and no user identifiers are set | Script in the app | Diagnostics |
| Google Firebase (FCM) | Push notifications | Scripts and service worker | Only after you opt in to push |
| Cloudflare Turnstile | Human check at sign-up, in the business review step, and at Sponsor claim | Script loaded from Cloudflare | Security |
| Google Places | Address lookup: sends the characters you type in address fields at sign-up and when editing your profile | API calls | Functional, when entering an address |
| Zippopotam.us | Fills in city and state from your ZIP code at sign-up | API call (your ZIP code) | Functional |
| QRServer.com | Draws the QR code on a deal share page | Image request (the share link) | Functional |
| Google Fonts | Loads a font on three static pages of our website (the Wah! Story page and two business information pages). This sends your IP address and device details to Google | Font request to Google | Functional |
| Google and Apple sign-in; map links; WhatsApp share | Only when you choose to use them | Handled by those providers | Optional |
| Stripe | Used only by businesses, on Stripe-hosted pages (add a card, top-ups). Stripe.js is not loaded in the Wah! app and members never use Stripe | Stripe's own pages | Only for businesses |
| Twilio | Delivery of login-code text messages | Server-side API; sets no cookies on your device | Yes, strictly necessary for sign-in |
| Amazon Web Services (SES) | Delivery of transactional and account email | Server-side API; sets no cookies on your device | Yes, strictly necessary |
| Anthropic (Claude) | AI Assist drafting, only when you start it. It is not used for moderation or fraud checks | Server-side API; sets no cookies on your device | Optional |
We do not use Google Analytics, Meta Pixel, or any other advertising or analytics tracking technologies, and we do not use pixels.
4. No advertising sale or cross-context tracking
We do not use cookies or similar technologies to sell your personal information or to share it for cross-context behavioral advertising. (For how a Sponsor claim shares your details with a business, see the Customer Privacy Policy.)
5. Third-party services
The third parties named in Section 3 process data subject to their own policies; those that operate on your device may set or read cookies or use device storage. Wah! does not control all third-party storage practices.
6. Your choices and consent
We do not currently use a cookie consent banner. Only strictly necessary and functional technologies run by default to operate, secure, and sign you in to the Platform. If we add non-essential analytics or advertising technologies that require consent under applicable law, we will update this policy and provide a consent mechanism. You can also manage or clear cookies and local storage through your browser and device settings; disabling certain items may limit login reliability, security checks, and core functionality. For privacy rights and opt-outs, see the Customer Privacy Policy or Vendor Privacy Policy. In the EU/UK, we rely on consent for non-essential technologies and on legitimate interests or contractual necessity for strictly necessary ones.
7. Do Not Track and Global Privacy Control
Because no uniform technical standard for "Do Not Track" is universally adopted, we may not respond to all browser DNT signals in the same way. Where required by law, we will treat a recognized opt-out preference signal, such as Global Privacy Control (GPC), as a valid opt-out of sale/share to the extent we engage in such activity and as we implement support for it. This is consistent with the GPC language in our Privacy Policies.
8. Mobile apps
Our iOS and Android apps (built with Capacitor) use similar technologies, including local app storage and third-party scripts (such as Firebase for push and Sentry for diagnostics). The apps keep your sign-in session in app preferences on the phone, and keep the credential for Face ID or fingerprint unlock in the device keychain or keystore. The apps also include an over-the-air update mechanism that stores app content bundles in local app storage and periodically checks our servers for updates; this involves no advertising or cross-site tracking. Push notifications require a separate device permission and are not enabled by cookies. The apps may ask permission to use your camera (scan coupons, take photos), photo library (uploads), and microphone (business welcome video); they do not use your location or contacts.
9. Retention
Session storage clears when you close the tab or app. Your sign-in session persists until you sign out or it expires; offline copies of your coupons are removed when you sign out; other items in local storage and app preferences remain until you clear them or remove the app. Third-party items (such as Sentry) follow their providers' lifetimes.
10. Security and anti-abuse
We protect sign-in and claims with a human check (Cloudflare Turnstile, or a built-in sum fallback) and with limits on how often some actions can be repeated. These controls are tied to your account, not to cookies, and cannot be fully disabled while using authenticated platform functions.
11. Updates to this policy
We may update this Cookie Policy from time to time by posting a revised version with an updated effective date.
12. Contact
WahSmartDeals LLC
13235 Affirmed Avenue, Frisco, TX 75035, United States
Privacy and legal: admin@wahsmartdeals.com ยท
General support: contact@wahsmartdeals.com