WhoMesh

Version 1.0 — Effective date: 23 September 2026

Cookie Policy — WhoMesh

1. Scope and responsibility

This Cookie Policy explains how WhoMesh uses cookies, browser storage and similar technologies in connection with whomesh.com, app.whomesh.com, admin.whomesh.com, WhoMesh referral and invitation pages, and WhoMesh payment redirects.

WhoMesh is operated by OMNIVIA TECH, SASU, 104 197 967 R.C.S. Paris. Registered office: 58 rue de Monceau, 75008 Paris, France.

Correspondence: OMNIVIA TECH, 58 rue de Monceau, CS 48756, 75380 Paris Cedex 08, France.

Privacy and cookie questions: support@whomesh.com

This Policy should be read together with the WhoMesh Privacy Notice.

A cookie is a small piece of information stored on or read from a user's device. Similar technologies include local storage, session storage, and scripts that store or read information on a device.

Whether consent is required depends on the actual purpose and operation of the technology, not only on its name.

2. Why WhoMesh may use these technologies

Strictly necessary technologies

Some technologies are required to provide a service you expressly request. On WhoMesh they are used to remember a display theme, keep a share link available during a browser session after you create it, and (in browser local storage, not as a cookie) hold a short-lived sign-in token for the customer or admin app.

Where applicable law permits, strictly necessary technologies may operate without optional tracking consent.

A technology is not strictly necessary merely because it is useful to WhoMesh.

Optional analytics, personalisation and advertising

WhoMesh does not currently activate optional analytics, audience measurement, advertising, or content-personalisation cookies. If any of those technologies are introduced, they will be named in the inventory below and, where the law requires consent, they will not run before you choose.

Referral and reward attribution

WhoMesh referral URLs can contain a request or branch identifier so the service can tell how a request reached a participant. That identifier is part of the link. It is not, by itself, an advertising cookie.

Opening a link does not mean WhoMesh treats the visitor as an identified participant. Declining unrelated optional analytics, when such analytics exist, must not be used to cancel a genuine reward attribution that the service needs in order to perform a reward the participants requested.

3. Technologies actually used

This inventory was checked against the live production service on 23 September 2026 (UTC). The check covered the public homepage, the customer sign-in page, an invitation URL, and the admin sign-in page, including response headers, script hosts, document cookies, local storage and session storage. It did not include a signed-in request, chat, Stripe Checkout session or Stripe recipient onboarding, because those steps require an account and a payment action.

No analytics, advertising, profiling, email-open or click-tracking script was loaded on those pages.

whomesh_theme

  • Who sets it: app.whomesh.com (WhoMesh). It is not set on whomesh.com.
  • Purpose: stores the customer app colour theme.
  • Data: the value light or dark only.
  • Where: every customer-app page, including sign-in, as a response cookie.
  • Lifetime: browser session. The production cookie has no expiry date.
  • Necessary or optional: functional display preference for the app. It is not analytics or advertising.
  • If you block it: the app still loads and uses the default light theme. The server sets the cookie again on the next page.

whomesh_presence

  • Who sets it: app.whomesh.com (WhoMesh), with a shared parent domain (for example .whomesh.com) so whomesh.com can read it.
  • Purpose: a display-only hint so the public site can show an initials avatar and “Open app” instead of “Sign in” when you already use the customer app in that browser. It is not a sign-in token and is not used for API authentication.
  • Data: a short versioned string (v1. plus a URL-encoded display name, at most 80 characters). It does not store email, phone, or the Sanctum access token.
  • Where: written after the customer app confirms you are signed in; cleared when you sign out, use “logout all”, or the app clears a dead session.
  • Lifetime: until cleared as above, or until the cookie max-age expires (~400 days).
  • Necessary or optional: functional display preference for the marketing chrome. It is not analytics or advertising.
  • If you block it: the marketing site keeps showing “Sign in”. The customer app and bearer token still work.

whomesh.token / whomesh.admin.token (local storage)

  • What it is: browser local storage, not a cookie. Keys are whomesh.token on app.whomesh.com and whomesh.admin.token on admin.whomesh.com.
  • Who sets it: the customer or admin app after a successful sign-in (OTP, Google, Apple, or admin password).
  • Purpose: Sanctum personal access token. The app sends it as Authorization: Bearer on API calls. Cookies and CSRF tokens are not used for WhoMesh API authentication.
  • Data: an opaque access token. Treat it like a password for that browser; clearing it signs you out.
  • Where: after sign-in on the customer or admin app. Not set on whomesh.com.
  • Lifetime: until you sign out, use “logout all”, or clear site data.
  • Necessary or optional: strictly necessary to stay signed in and use authenticated features.
  • If you block local storage / clear it: you must sign in again. Public marketing pages do not need it.

g_state

  • Who sets it: Google Identity Services (https://accounts.google.com/gsi/client), stored on app.whomesh.com.
  • Purpose: state for the Google sign-in button. It is not a WhoMesh analytics or advertising cookie.
  • Data: a JSON object written by Google’s script, including button-state fields and timestamps. It does not contain a WhoMesh account identifier.
  • Where: the customer sign-in page, because that page renders “Continue with Google”. It was not set on whomesh.com. It remained available on later app.whomesh.com pages in the same browser.
  • Lifetime: set by Google’s script. The page itself does not show an expiry.
  • Necessary or optional: not required for email or phone sign-in. It is part of offering Google sign-in.
  • If you block it: email and phone codes still work. Google sign-in can stop working if accounts.google.com is blocked. WhoMesh does not show a separate accept or reject control for this cookie.

wm-invite-share:{request id}

  • What it is: session storage, not a cookie. The key starts with wm-invite-share: and ends with the request identifier.
  • Who sets it: app.whomesh.com, after a signed-in participant creates a share link.
  • Purpose: keeps the share URL on that request screen if the page is reloaded during the same browser tab session.
  • Data: the share URL and whether it is a branch link or a candidate link.
  • Where: the signed-in request page, only after a link is created. It was not present on the public homepage, the sign-in page, or a logged-out invitation page.
  • Lifetime: until the tab or browser session storage is cleared.
  • Necessary or optional: functional for the share action you just took. It is not analytics.
  • If you block session storage: creating a link can still succeed, but the page may not restore that URL after a reload.

whomesh-admin-color-mode

  • What it is: local storage on admin.whomesh.com only.
  • Purpose: remembers the admin colour theme.
  • Data: a theme name such as dark.
  • Where: the admin sign-in page and other admin pages.
  • Lifetime: until you clear site data. Local storage has no expiry date.
  • Necessary or optional: display preference for the admin tool. It is not analytics.
  • If you clear it: the admin theme returns to the default dark theme.

What was checked and not found

On the pages above, production did not set or load:

  • a cookie, local-storage entry or session-storage entry on whomesh.com;
  • an analytics, advertising or profiling script (no tag manager, advertising pixel, or product-analytics host);
  • a Cloudflare browser cookie (responses were served through Caddy, and the API through nginx; no Cloudflare cookie was set);
  • a Zoho script, cookie or pixel;
  • a Brevo script or cookie (email is sent from WhoMesh servers, not from a browser tag);
  • Stripe.js, or a Stripe cookie on a WhoMesh domain (checkout is a redirect to Stripe; that Stripe page was not opened);
  • an Apple sign-in script, until someone chooses Apple sign-in (the button is shown, the script is not loaded on page view);
  • a Firebase or push script on the logged-out pages.

Google Fonts stylesheets are loaded on app.whomesh.com. The font response did not set a cookie.

4. Third-party technologies

Caasify

WhoMesh uses Caasify for hosting and database infrastructure. That server-side hosting did not place a browser cookie during the production check.

Brevo

WhoMesh uses Brevo to send email and SMS from its servers. No Brevo cookie or tracking pixel was present on the websites checked. If email open-tracking or click-tracking is later turned on, it will be disclosed before it is used where consent is required. Inactivity is not consent.

Stripe

Payment and recipient onboarding use Stripe. WhoMesh redirects to Stripe Checkout rather than embedding Stripe’s card field on a WhoMesh page. Cookies on a Stripe-hosted page are Stripe’s while you are on that page. They are not listed above as WhoMesh cookies, because that page was not part of the production check. A Stripe cookie is not treated as strictly necessary for browsing WhoMesh merely because Stripe can process a payment.

Google

Google Identity Services runs on the customer sign-in page and set g_state, described above. Google Fonts did not set a cookie.

Apple

Apple’s sign-in script is loaded only when you start Apple sign-in. It was not loaded during the production page check, so no Apple cookie was observed.

Cloudflare

No Cloudflare browser cookie was set on the journeys checked. Using a provider for DNS or domain records does not, by itself, mean that provider stores a cookie in the browser.

5. Your choices

WhoMesh does not currently run optional analytics or advertising cookies, so it does not show an “Accept optional cookies” / “Reject optional cookies” banner.

Visiting WhoMesh, scrolling, continuing to browse, opening a referral link, or accepting the Terms of Use is not consent to optional tracking.

If WhoMesh later adds a technology that needs consent, it will ask first, with an equally accessible way to refuse and to accept, and a Cookie Settings control that stays available. A stored choice will be kept for 6 months, and WhoMesh may ask again sooner if the purposes, providers or categories materially change, or if the law requires a new choice.

That 6-month period is separate from the lifetime of each cookie above and separate from how long server-side records are kept. WhoMesh does not currently keep a separate consent log, because those optional technologies are not in use.

You can also block or delete cookies and site storage in the browser. Clearing whomesh.token / whomesh.admin.token signs you out of that app. Blocking optional tracking, when it exists, will not be used to turn off the introduction service.

6. Referral links

A WhoMesh referral URL may contain a request or branch identifier even when no browser cookie is used.

When someone follows that link, WhoMesh may record a referral event as described in the Privacy Notice.

Opening a link alone does not mean the visitor is an identified participant in a referral chain.

A referral identifier must not expose the private message, private contact information, or the complete acquaintance graph.

7. Links shared through other services

If you share a referral link through email, SMS, WhatsApp, Telegram or another service, that service has its own privacy practices. WhoMesh does not control cookies those services set on their own sites.

The recipient may forward the link to someone else.

8. Email tracking

WhoMesh does not treat the use of Brevo as proof that email open-tracking or click-tracking is enabled. No such pixel was loaded on the websites checked.

If WhoMesh later activates optional email tracking, the purpose will be disclosed before it is used where consent is required. Inactivity will not be treated as consent.

9. International transfers

Some providers may process information outside the country where you are. The Privacy Notice explains the transfer rules. A cookie choice is not blanket consent to international transfers.

10. Updates

We will update this Policy and the inventory when a technology is added, a purpose or provider changes, storage durations materially change, or the law requires an update.

Where a new purpose needs consent, WhoMesh will ask before activating that optional technology.

The version and effective date are shown at the top of this Policy.

11. Questions and privacy rights

For questions about cookies or privacy rights, contact support@whomesh.com or use the Support section in WhoMesh.

For retention, international transfers, access and deletion, referred people, and complaints to supervisory authorities, read the Privacy Notice.

Because OMNIVIA TECH is established in France, the CNIL is a relevant supervisory authority under applicable EU data-protection law.