What Would Dad Say.

Cookie Notice

Last updated: 2026-04-25

DRAFT — for counsel review only. Not a final, published document.

1. What this notice covers

This Cookie Notice explains how What Would Dad Say LLC, a Pennsylvania limited liability company ("we," "us," or "our") uses cookies and similar tracking technologies on the website located at https://whatwoulddadsay.app (the "Site").

For general information about how we handle your personal information, see our Privacy Policy.

2. What are cookies?

Cookies are small text files that a website places on your browser or device when you visit. They are widely used to make websites work, to make them work more efficiently, and to provide information to site owners. Similar technologies include pixel tags (also called web beacons or clear GIFs), local storage, and session storage.

3. Cookies we use

The tables below list every cookie or tracking technology active on the Site as of the date of this notice.

IMPORTANT DRAFTING NOTE: The specific cookie names, identifiers, and exact data collected have been sourced from the cookie consent banner implementation in apps/marketing/src/components/ui/CookieConsentBanner.tsx and the consent hook at apps/marketing/src/hooks/useCookieConsent.ts. The data-inventory.md does not yet enumerate cookies. Before publishing, perform a cookie audit (e.g., with a browser inspector or consent management platform scanner) to verify all cookies present, their actual names, domains, and lifetimes, and update this notice and data-inventory.md accordingly.

3.1 Strictly necessary cookies (always active)

These cookies are required for the Site to function. They cannot be disabled.

Cookie nameSet byPurposeLifetime
wwds_consentWhat Would Dad Say (first party)Stores your cookie preferences so we do not ask again on your next visit395 days
wwds_geo_eu{{TODO: Confirm whether this cookie is set server-side by a middleware/edge function and document the mechanism}}Indicates whether your visit originates from the European Union, used to determine whether to show the consent banner{{TODO: Confirm lifetime — appears to be session or short-lived; verify in middleware}}

3.2 Analytics cookies (off by default for EU visitors)

These cookies help us understand how visitors interact with the Site, which pages are most popular, and where visitors come from. The information is aggregated and does not directly identify individuals.

Cookie nameSet byPurposeLifetime
_gaGoogle LLC (Google Analytics 4 / GA4)Distinguishes unique users; used to calculate visit, session, and campaign data2 years
_ga_*Google LLC (GA4)Stores and counts pageviews and session state2 years
ph_* (PostHog)PostHog, Inc.Session replay, event tracking, feature flags{{TODO: Confirm PostHog cookie lifetime from PostHog documentation or account settings}}
{{TODO}}{{TODO: Run cookie scan to identify all analytics cookies}}

Data transfers: GA4 data may be transferred to Google LLC servers in the United States. Google LLC is certified under the EU–US Data Privacy Framework. PostHog data is transferred to {{TODO: Confirm PostHog data residency — PostHog offers EU and US cloud; confirm which region is configured}}.

3.3 Marketing and advertising cookies (off by default for EU visitors)

These cookies are placed by our advertising partners to build a profile of your interests and show you relevant advertisements on other websites.

Cookie nameSet byPurposeLifetime
_fbpMeta Platforms Ireland Ltd. (Meta Pixel)Identifies browsers for delivering advertising, measuring campaign effectiveness, and building audiences90 days
_fbcMeta Platforms Ireland Ltd. (Meta Pixel)Stores click identifier when a user arrives from a Facebook advertisement90 days
{{TODO}}Google LLC (Google Ads){{TODO: Run cookie scan to identify Google Ads cookies (e.g., _gcl_au, _gcl_aw) and document purpose and lifetime}}
{{TODO}}{{TODO: Run full cookie scan to identify any additional marketing cookies}}

Data transfers: Meta Pixel data is processed by Meta Platforms Ireland Ltd. and may be further transferred to Meta Platforms, Inc. in the United States under Standard Contractual Clauses. Google Ads data is processed by Google LLC in the United States; Google LLC is certified under the EU–US Data Privacy Framework.

4. Your choices and how to manage cookies

4.1 Cookie consent banner (EU visitors)

If we detect that your visit originates from the European Union, we display a cookie consent banner before placing any analytics or marketing cookies. You may:

You may change your preferences at any time by {{TODO: Describe the mechanism for EU visitors to revisit their consent preferences, e.g., a "Cookie settings" link in the footer. This link/button must be implemented in the marketing site before launch; flag as a TODO for the engineering team}}.

4.2 Non-EU visitors

{{TODO: Confirm whether an opt-out or preference mechanism is provided to non-EU visitors. The current implementation (useCookieConsent.ts) defaults analytics and marketing to "true" for non-EU visitors without presenting a banner. Depending on which US state privacy laws are confirmed in-scope (CCPA/CPRA, VCDPA, CPA, etc.), non-EU US visitors may have the right to opt out of "sharing" of personal information for cross-context behavioral advertising. If any such regime is confirmed, an opt-out mechanism must be added for non-EU visitors. Flag to counsel and engineering.}}

4.3 Browser-level controls

Most browsers allow you to refuse or delete cookies through their settings. The effect of doing so varies by browser and cookie type. Disabling strictly necessary cookies may prevent the Site from functioning correctly. For guidance, visit your browser's help documentation.

4.4 Platform opt-outs

You may opt out of interest-based advertising from specific providers through industry opt-out tools:

5. Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) browser signal. If your browser sends the GPC signal, we will treat it as a request to opt out of any sale or sharing of your personal information for cross-context behavioral advertising and will suppress non-essential analytics, advertising, and marketing cookies and tags for that session, including Google Analytics 4, PostHog, Meta Pixel, and Google Ads.

GPC detection is implemented client-side by reading the navigator.globalPrivacyControl property and server-side by reading the Sec-GPC: 1 request header. When either signal is present, the wwds_consent cookie is set to {analytics: false, marketing: false} and no analytics or marketing scripts are loaded for that session.

ENGINEERING NOTE: GPC detection must be implemented and tested before public marketing-site launch. See docs/HUMAN-ACTIONS.md for the pre-launch engineering checklist. Verify in Brave browser (which sends GPC by default) as part of launch QA.

6. Do Not Track

Some browsers transmit a "Do Not Track" (DNT) signal. We currently {{TODO: Confirm DNT handling — does the Site honor DNT signals? If yes, describe the behavior. If no, this must be disclosed under applicable law in certain US states (e.g., California Online Privacy Protection Act / CalOPPA). Confirm with counsel.}}.

7. Changes to this notice

We may update this Cookie Notice from time to time to reflect changes in the cookies we use, changes in applicable law, or for other operational reasons. We will update the "Last updated" date at the top of this notice when we do so. Please review this notice periodically.

8. Contact us

If you have questions about our use of cookies, contact us at:

What Would Dad Say LLC 6587 The Hideout Lake Ariel, PA 18436 United States Email: legal@whatwoulddadsay.app Website: https://whatwoulddadsay.app