23 September 2026 · Notice en-v1 · Policy 2026-09-meta-v1
Wavesso is operated by Jacek Knaur Analityka, ul. Topazowa 27, 62-081 Baranowo, Poland, NIP 7792579722. Contact [email protected] for privacy requests, including an account-wide advertising opt-out. See our Privacy Policy for rights, recipients and international transfers.
Necessary storage supports sign-in, security and your privacy preferences. Optional Meta advertising tracking is off until you choose it and Wavesso records your grant. Refusing does not restrict the app, registration or payment. Use to change your choice without signing in. Global Privacy Control disables optional advertising tracking; accepting cannot override it. For a signed-in account the signal also records account-wide advertising suppression.
Withdrawal stops future application tracking and clears accessible Meta first-party cookies. It does not delete information already sent to Meta or cookies on Meta domains. A page reload may be necessary to stop already loaded tracking code. For deletion or other rights requests contact us and/or Meta.
When enabled and accepted, Meta Pixel measures eligible visits, completed registrations and initial paid subscriptions and supports personalised advertising on Facebook and Instagram. Meta Platforms Ireland Limited and Meta Platforms, Inc. receive browser/network metadata (including IP address), eligible page URL/referrer and event activity. Meta may associate this information with your Meta account. Wavesso does not send names, emails, auth identifiers, form values or exact locations as event parameters; automatic advanced matching and automatic event detection are disabled. No Conversions API is used.
Processing for this integration is based on your consent. Meta's role for collection/transmission and its subsequent processing is described in the Meta Business Tools Terms and Controller Addendum. Meta may process data outside your country, including the United States, using the safeguards described in its Privacy Policy. See also Meta's Cookies Policy. Meta determines retention of data it receives under its policies; withdrawing here does not erase that data.
This inventory distinguishes source-code storage from cookies that require live verification. Production tracking stays disabled until the live Meta cookie inventory, retention and vendor disclosures have been reviewed. Cookies set by external Google or Stripe pages are governed by those providers; they are not assumed to be present on every Wavesso visit.
| Key / provider | Purpose / category | Storage and scope | Duration and deletion |
|---|---|---|---|
| wavesso.consent.v1 / Wavesso | Remember choice / Necessary | localStorage, current origin; no cookie path | Application expiry up to 183 days from choice for both grant/refusal; overwritten on choice. No automatic extension. |
| wavesso.consent.pending / Wavesso | Retry withdrawal receipt / Necessary | localStorage, current origin | Removed after successful receipt update, at most 183 days. |
| wavesso.consent.veto / Wavesso | Keep withdrawal effective if preference writes fail / Necessary | sessionStorage, current origin; withdrawal timestamp | Tab lifetime; cleared by a newly recorded explicit grant. |
| wavesso.privacy.suppressed / Wavesso | Remember a known account advertising restriction / Necessary | localStorage, current origin; boolean only | Replaced after an authenticated account check; remains restrictive through logout. Server suppression remains until a verified rights request or account deletion. |
| wavesso.registration.intent / Wavesso | Associate a current registration with consent / Marketing | sessionStorage, current origin | Tab lifetime; removed on withdrawal; server intent expires after 1 day. |
| flutter.remembered_refresh_token / Wavesso, Supabase Auth | Optional “keep logged in” session persistence / Necessary | SharedPreferences localStorage, current origin | Rotated on refresh; removed on logout or selecting non-persistent login. Token validity is controlled by Supabase. |
| flutter.pending_google_oauth_mode, flutter.pending_google_oauth_tier, flutter.pending_google_oauth_code_verifier / Wavesso | Complete requested OAuth sign-in / Necessary | SharedPreferences localStorage, current origin | Cleared after callback or failed launch; abandoned flows can remain until replaced/storage deletion. |
| _fbp, _fbc / Meta | Browser/click attribution / Marketing | Possible first-party cookies after consent; actual domain, path and expiry must be observed with the configured test Pixel | Not currently observed with a configured Pixel. Accessible hostname/parent-domain/path variants are cleared on withdrawal. No manufactured click identifiers. |
| Consent receipts / Wavesso | Evidence of choice / Necessary, server only | Private database; random receipt, notice/policy, purpose, action and server timestamps; no IP or user agent | Finite owner-configured retention required before activation (183–730 days); automatic cleanup every 15 minutes. |
| Conversion claims / Wavesso | Prevent duplicate consented conversions / Marketing, server only | Private database; opaque browser key; account/payment references never sent to Meta | 30 days; separate from business payment records. |
Cloudflare dashboard traffic reporting does not itself install a browser cookie. No checked-in Cloudflare Web Analytics beacon or Zaraz integration was found. Live edge injection and external-provider cookies are release checks, not assumed absent.