Watchpost Cookie Policy

This Cookie Policy (the "Policy") explains which cookies and similar technologies XYZ Sdn Bhd ("Watchpost", "we", "us") uses on the Watchpost website and web application (the "Service"). It also explains why we use them and how you can control them. It applies to everyone who uses the Service, including people without an account who open a post preview link.

Key points

1. About this Policy

1.1 Who we are. XYZ Sdn Bhd (Company Registration No. 202601000000), Malaysia, email [email protected] (Companies Act 2016 s.30). You can contact our Data Protection Officer ("DPO") at the same email address (subject "Privacy"). The DPO is also our data protection officer for Singapore.

1.2 Scope. This Policy covers what we store on or read from your Device when you use the Service, and what our Payment Processor stores or reads through the card form described in Clause 6. It also covers our emails. It does not cover websites run by others, such as those of Google, Meta, TikTok or X, our Payment Processor's own hosted pages or your bank's pages (Clauses 6.5 and 7).

1.3 Other documents. This Policy is part of our notice under PDPA s.7 and, where they apply, GDPR Arts. 13–14 and SG PDPA s.20. It expands on Section 15 of our Privacy Policy. Section 13 of the Privacy Policy explains your rights, and Section 20 explains how to complain. This Policy is a notice, not a contract term (Terms of Service clause 3.3).

1.4 Languages. This Policy is written in English. Our Privacy Policy, which we publish in Bahasa Malaysia and English as PDPA s.7(3) requires, covers the same matters in its Section 15. We do not publish a translation of this Policy.

2. Definitions

2.1 In this Policy:

2.2 Other capitalised terms, such as "Workspace" and "Team Member", have the meanings given in our Privacy Policy.

3. Our approach

3.1 Strictly Necessary and Preference only. We set only Cookies and Similar Technologies that are Strictly Necessary or that store a Preference. We do not use:

(a) analytics or audience-measurement tools; (b) advertising, retargeting or conversion-tracking cookies or pixels; (c) social media plug-ins, "Like" buttons or embedded Platform scripts; (d) session recording, heat maps, or device fingerprinting for tracking or advertising (our new-device check in Clause 4.1 uses your browser identification string and IP address only to protect your account); or (e) anything that follows you across other websites.

3.2 Scripts. Our pages run scripts only from our own servers. The one exception is our Payment Processor's script, which loads only when you open the card form (Clause 6).

3.3 No consent banner. Consent is needed before information is stored on or read from your Device, unless that is strictly necessary for a service you have explicitly asked for (ePrivacy Directive Art. 5(3); PECR reg. 6(4)). In our assessment, everything in Clauses 4 to 6 falls within that exemption. The Strictly Necessary items do so because the feature you asked for cannot work without them. The Preference items do so because they only remember a choice you made in the Service you are using (WP29 Opinion 04/2012 on Cookie Consent Exemption, user-interface customisation). We therefore ask for no consent. The first time you visit our website, a short notice tells you this and links to this Policy; dismissing it only hides it (Clause 5.2). We still describe each item so that you have clear and complete information (PDPA s.7(1); PECR reg. 6(2); SG PDPA s.20; Commissioner's Guidance on Preparation of PDP Notices 2022). This approach also follows the Commissioner's Data Protection by Design Guideline (2026).

3.4 Browser signals. We do not track you or sell your data, so the Service works the same whether or not your browser sends a "Do Not Track" or "Global Privacy Control" signal.

3.5 No other third parties. Apart from our Payment Processor on the card form (Clause 6), no third party may place or read Cookies through the Service, or collect information directly from your browser through it. We show no third-party advertising. Platform servers that supply pictures receive ordinary web requests (Clause 7.2). This clause is also the device-storage disclosure required by the YouTube API Services Developer Policies (section III.A.2); see Privacy Policy clause 6.4.

4. Cookies we set

4.1 This table describes every Cookie that Watchpost itself may set. Our Payment Processor's Cookies are described in Clause 6.

4.2 Security settings. The session cookie, the CSRF token, the device recognition cookie and the administration messages cookie are "Secure", which means they are sent only over encrypted HTTPS connections. They are also "SameSite=Lax", which means they are not sent with most requests that start on other websites. The session, device recognition and administration messages cookies are also "HttpOnly", so page scripts cannot read them. Our app must read the CSRF token to send it back with your changes (PDPA s.9; GDPR Art. 32).

4.3 Sign-in and connection "state". For "Sign in with Google", our sign-in software creates a one-time security value called "state" to block forged sign-ins. It is kept inside your session on our server, so it needs no Cookie beyond the session cookie. When you connect a Platform account, the equivalent value is a signed, single-use code that expires after 10 minutes. It travels in the link to the Platform and back, and we check it against a one-time record on our server. No Cookie is set for it.

4.4 Personal data. The session cookie and the device recognition cookie are linked to your account, so we treat them as personal data. We treat the same way the new-device events they produce and the related server records, including the active sessions list, which shows each session's IP address, browser and last activity. We collect this data automatically from your browser. None of our Cookies contains your password, your Platform access tokens or Platform Data.

We use these Cookies because they are necessary to provide and secure the Service you signed up for (PDPA s.6(2)(a); for security, also s.6(2)(c) with s.9; GDPR and UK GDPR Art. 6(1)(b)). For security, we also rely on our legitimate interest in preventing unauthorised access to your account and to the Platform accounts connected to it (Art. 6(1)(f)). You can object to that use (Art. 21; Privacy Policy Section 13). A new-device alert is only an email to you: it does not block your sign-in or lead to any other decision about you.

When you log out or end a session, we delete that session's server records. An expired session can no longer be used. Security logs, including new-device events, are kept for 2 years (Privacy Policy Section 10). We never use these Cookies for marketing, and we never sell them.

5. Browser storage

5.1 In the app. The Watchpost app keeps the following in your browser's Local Storage:

5.2 On our website. Our public pages, such as Pricing and these legal pages, keep the following in Local Storage:

5.3 During onboarding. While you connect your first account during onboarding, the app keeps one item in session storage, which the browser deletes when you close the tab:

5.4 Who can read them. Only the Watchpost app in your browser reads these items, and they are not sent to our server automatically. Most hold only a setting or a random ID that means nothing to anyone who cannot access the account. The unsent post and the recent hashtags and mentions hold text you typed, so anyone using the same browser profile can read them. These items stay after you log out. If you use a shared computer, clear the browser's site data for Watchpost when you finish (Clause 10.1).

5.5 Legal basis. The rules on Device storage apply to Local Storage as they do to Cookies (EDPB Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive). Remembering a display or navigation choice you made in the Service falls within the exemption for a service you explicitly asked for (WP29 Opinion 04/2012, user-interface customisation). In the UK, the DUAA exemption for appearance and preferences will also apply once it is in force.

5.6 Nothing else. Apart from the session storage item in Clause 5.3, we do not use session storage, IndexedDB, service workers or other browser databases. If we start saving these settings to your account instead, or add other items, we will update this Policy first.

6. Payment pages and our Payment Processor

6.1 The card form. When you open the "Add a card" form on the Billing page, the app loads our Payment Processor's script from its servers. You type your card details into fields that the Payment Processor hosts, so Watchpost never sees or stores your full card number or security code. Watchpost runs as a single-page app, so once the script has loaded, it stays active in that browser tab until you reload or close the tab, even after you close the form. Other billing actions, such as choosing your default card or removing a card, do not load the script.

6.2 The Payment Processor's Cookies. The script may set the Cookies below to prevent payment fraud. The Payment Processor decides their content and lifetime. These details are as the Payment Processor describes them at the date of this Policy, and they may change.

6.3 Device and usage information. To detect fraud, the script also collects information about your Device, browser and network, and about how you use the pages where it is active, for example how you move through the card form. It sends this information to our Payment Processor, which may process it in other countries under the safeguards the law requires (Privacy Policy Section 9).

6.4 Roles and legal basis. We decide to load the script on the card form, and we are responsible for telling you about it. Our Payment Processor decides how it uses the information it collects. It does so as an independent controller for its fraud prevention, under its own privacy notice (Privacy Policy clause 2.5). In our assessment, fraud checks are Strictly Necessary for the secure card payment you asked for, so they need no consent (ePrivacy Directive Art. 5(3); PECR reg. 6(4)). Our Payment Processor may also set Cookies on its own domains inside the payment fields it hosts.

6.5 Payment Processor and bank pages. The following pages are run by our Payment Processor or by your bank, and some may appear in a separate window:

These pages set their own Cookies under their own policies. We will tell you who our Payment Processor is, and where to find its privacy and cookie notices, on request at [email protected].

7. Other websites and Platform content

7.1 Sign-in and connection pages. "Sign in with Google", and connecting a social account, take you to the Platform's own pages. Those pages set their own Cookies under their own policies, and we cannot read them. The same applies to any website you reach through a link.

7.2 Images from Platforms and other websites. Some pictures load directly from the servers of the Platform or website that hosts them. Examples are the profile pictures of connected accounts, your Google profile photo or a Team Member's, and the TikTok creator picture shown when you prepare a TikTok post. As with any web request, those servers receive your IP address and basic browser information. Our referrer setting means they also learn our domain name, but not the page you are on. They may set or read their own Cookies under their own policies. We add no tracking code to these requests.

8. Emails

8.1 Our emails contain no tracking pixels, web beacons or remote images. We do not record whether you open them or which links you click, and we keep open and click tracking switched off at our email delivery provider. We record only that we sent an email and whether it was delivered (Privacy Policy Section 3, category G). Links that perform an action, such as unsubscribing or accepting an invitation, carry a secure code only so that the action works.

9. If we add non-essential Cookies

9.1 Before we set any Cookie or Similar Technology that is neither Strictly Necessary nor a Preference, such as an analytics tool, we will:

(a) update this Policy and its tables; (b) ask for your consent through a notice in Bahasa Malaysia and English, with "Accept" and "Reject" options of equal prominence on the first screen and no pre-ticked boxes (PDPA ss.6(1) and 7(3); GDPR Arts. 4(11) and 7; CJEU Case C-673/17 Planet49); (c) set nothing non-essential unless you accept, respect your refusal, and keep the Service fully usable if you refuse (GDPR Art. 7(4)); (d) keep a record of your choice, with the date, the Policy version and the options you chose (PDP Regulations reg. 3; GDPR Art. 7(1)); and (e) put a "Cookie settings" link on every page, so that you can withdraw consent as easily as you gave it (GDPR Art. 7(3); PDPA s.38).

10. How to control Cookies and browser storage

10.1 Browser settings. Most browsers let you view, block and delete Cookies and other site data, including Local Storage. You can do this for all websites or for chosen ones, such as Watchpost, our Payment Processor or a Platform. Private browsing deletes them when you close the window. Your browser's help pages explain how.

10.2 Your choice and its consequences. Allowing Cookies and browser storage is voluntary, but you need the Strictly Necessary ones to use the Service (PDPA s.7(1)(f)–(h); GDPR Art. 13(2)(e)). If you block or delete them:

(a) the session cookie or the CSRF token: you are signed out, and you cannot sign in or save changes until you allow them again; (b) the device recognition cookie: your next sign-in from that browser triggers a new-device security alert; (c) Local Storage: your appearance, view and calendar settings return to the defaults, the app may open a different Workspace, and an unsent post is lost; (d) the Payment Processor's Cookies or script: you may be unable to add a card, or the Payment Processor may ask for extra checks.

10.3 Signing out. Logging out ends your session on our server and deletes the session cookie. In your account settings, you can see and end your active sessions, or log out everywhere. Logging out does not delete the device recognition cookie or Local Storage; you can delete them in your browser.

11. Legal framework

11.1 Malaysia. The PDPA has no separate rule on cookies. However, Cookie data that relates to an identifiable person is personal data, so all seven Personal Data Protection Principles apply to it. We apply them as follows:

Transfers to other countries follow PDPA s.129 (Privacy Policy Section 9).

11.2 European Union. We rely on the strictly necessary exemption in ePrivacy Directive Art. 5(3), as implemented in each Member State. The GDPR applies to related personal data.

11.3 United Kingdom. We rely on PECR reg. 6(4). From their commencement, we also rely on the exemptions that the DUAA adds to PECR for security and for adapting a service's appearance to your preferences. The UK GDPR applies to related personal data.

11.4 Singapore. This Policy tells you the purposes for which Cookies and Similar Technologies may collect personal data (SG PDPA ss.18 and 20). For those needed for sign-in and payment, and for the Preferences you set, we rely on your consent. Your consent is deemed when you use the feature after we have told you its purpose (SG PDPA ss.13 and 15). For security Cookies, such as the CSRF token and the device recognition cookie, we rely on the legitimate interests exception (First Schedule, Part 3), as Privacy Policy clause 4.2 explains for security purposes.

11.5 Other countries. If you live elsewhere, you keep the rights your local law gives you over cookies and similar technologies, and you may contact us at [email protected] to use them.

12. Your rights and contact

12.1 You have the rights set out in Section 13 of our Privacy Policy. They include access and correction (PDPA ss.30 and 34), withdrawal of consent (s.38) and, where the GDPR or UK GDPR applies, the right to object (Art. 21). You can contact our DPO at [email protected], at Malaysia or through our Contact page, in Bahasa Malaysia or English. Where the law requires us to appoint a representative in the European Union or the United Kingdom, we will publish its details here. Until then, contact us at [email protected]. You may also complain to the Commissioner or to the other regulators listed in Section 20 of our Privacy Policy.

13. Changes to this Policy

13.1 We review this Policy at least once a year and whenever we change the technologies we use.

13.2 Each update changes the version, the effective date and the version history. A material change is, for example, a new category of Cookie or a new third party. Before a material change takes effect, we will notify you by email or in the Service. Where Clause 9 requires it, we will also ask for your consent (PDPA s.7(2)).

14. Version history

XYZ Sdn Bhd (Company Registration No. 202601000000) · Malaysia · [email protected] (including our DPO)