8. Cookie & Tracking Policy

Preamble This Cookie Policy explains how Waiver2.0 / waiver2.com uses cookies, session storage, and forensic tracking technologies in connection with the Platform. Waiver2.0 is committed to the principle of data minimization: only strictly necessary technical mechanisms and the first-party count of form steps described in Section 2.5 are deployed. No advertising, marketing, or behavioral tracking technologies are used on the Platform. 1. What Are Cookies & Session Storage 1.1 Cookies are small text files placed on a user's device by a web application for the purpose of maintaining session state, security integrity, and functional continuity. 1.2 Session storage is a browser-based mechanism that allows a web application to store data on the user's device while a browser tab is open; it is discarded when the tab is closed. 1.3 Waiver2.0 uses a sign-in cookie and session storage exclusively for the technical purposes described in this Policy, and does not use local storage. No persistent tracking cookies, third-party advertising cookies, or behavioral profiling technologies are deployed on the Platform. 2. Categories of Technologies Used 2.1 Waiver2.0 uses only the following strictly necessary technical mechanisms (the measurement in Section 2.5 is described separately): TechnologyPurposeDurationThird PartySign-in CookieKeeps a Gym, the owner of a group of Gyms, or an Athlete signed in after they open a sign-in link sent to their email address7 days; a Gym or the owner of a group of Gyms can end it earlier by signing outNoSession Storage — Waiver IdentifierHolds a random waiver identifier for one Gym's waiverUntil the browser tab is closedNo 2.2 No third-party cookies, pixels, beacons, fingerprinting scripts, advertising networks, or analytics platforms are deployed on the Platform. Section 2.5 describes the measurement that the Platform carries out itself. 2.3 The Platform does not use Google Analytics, Meta Pixel, or any equivalent third-party tracking service. 2.4 sessionStorage holds a random waiver identifier for the duration of the tab, strictly necessary to reduce the risk of duplicate payment. The identifier is generated at random in the browser, is not derived from any information about the Athlete, and is kept separately for each Gym. 2.5 While an Athlete completes the waiver form, the form reports to Waiver2.0's own servers how far the visit has progressed: the Gym, the version of the form, the number of the furthest step reached and, once the submission has been accepted, that it was. A visit is told apart by a random identifier that the browser generates for that visit and holds in its memory only; it is not stored in the browser, it is not the waiver identifier, and it is lost when the page is reloaded or closed. The report contains no answer, signature or payment detail; the IP address is used as a short-lived counter to limit repeated requests from one network and is not stored with the report. One record is kept for each visit, holding the Gym, the version of the form, the furthest step reached and the times of the first report, the latest report and the submission; the records are counted per step and per version of the form, and the time from the first report to the submission is measured, to see where visits stop and to improve the form. Each record is kept for 13 months from the latest report of the visit and is then deleted; copies held in backups are removed as those backups expire. This measurement is carried out by Waiver2.0 itself. The body of the report contains no name, email address or IP address. Waiver2.0 keeps the records apart from the waiver and the payment, and does not attempt to connect them. 3. Forensic Metadata Collection 3.1 To support the evidentiary record of every signed document, Waiver2.0 collects and logs the following technical metadata at the moment of the signing event. This data is not used for profiling or advertising; it is recorded with the sealed record as forensic evidence of the signing event, and the IP address is also used to limit repeated submissions from one network: MetadataPurposeIP AddressNetwork address from which the submission was received, recorded for the forensic record and used to limit repeated submissions from one networkServer TimestampChronological record of the signing event, recorded by the Platform's own server clock at the moment of receipt 3.2 This forensic metadata is recorded with the sealed record and forms part of the Athlete's forensic record; for waivers submitted from 16 October 2026 it is not an input to the hash chain described in the Privacy Policy, Section 5. It cannot be disabled without compromising the legal validity of the signed document. 3.3 Collection of this metadata is not subject to cookie consent requirements as it does not constitute tracking for advertising or profiling purposes. It is collected under the legal basis of contractual necessity and legitimate interests in forensic security and legal non-repudiation. 4. Consent & Legal Basis 4.1 As Waiver2.0 deploys only strictly necessary cookies and forensic metadata collection, no cookie consent banner or opt-in mechanism is required under applicable law for the technical mechanisms described in Sections 2.1 to 2.4 and 3; Section 4.3 deals with the measurement in Section 2.5. 4.2 Jurisdiction-Specific Legal Basis: 🇦🇺 Australia: Strictly necessary cookies and forensic metadata collection are conducted under the legal basis of contractual necessity and legitimate interests consistent with the Privacy Act 1988 (Cth) and the APPs. The Australian Privacy Act does not require consent for strictly necessary technical operations that are integral to the delivery of a contracted digital service. 🇨🇦 Canada: Strictly necessary cookies and forensic metadata collection are conducted under the legal basis of contractual necessity consistent with PIPEDA Principle 3 (collection limited to necessary purposes). Implied consent is sufficient for technical mechanisms essential to the delivery of the contracted service. 🇺🇸 United States: Strictly necessary cookies and forensic metadata collection do not require consent under applicable federal or state law as they are technically necessary for service delivery. California residents are notified of this data collection under the CCPA; this data is not sold or shared for cross-context behavioral advertising, and is used only for the purposes described in Sections 2 and 3. 4.3 Waiver2.0 relies on its legitimate interest in understanding where the waiver form is difficult to complete (Article 6(1)(f) GDPR). Nothing is stored on the Athlete's device for this purpose. To the extent that this information could nonetheless relate to an identifiable person, the Athlete may object at any time by writing to privacy@waiver2.com (Article 21 GDPR). 5. User Controls & Opt-Out 5.1 Users may clear cookies and session storage via their browser settings at any time; clearing the sign-in cookie signs the user out. 5.2 Disabling strictly necessary cookies via browser settings may prevent signing in; disabling session storage may cause a new waiver identifier to be generated if the page is reloaded during a signing session. 5.3 Forensic metadata collected as part of a completed signing event is recorded with the sealed record; for waivers submitted from 16 October 2026 it is not an input to the hash chain described in the Privacy Policy, Section 5. Users who wish to exercise erasure rights in relation to their forensic record should refer to the Privacy Policy, Sections 5 and 11. 5.4 Waiver2.0 does not deploy any non-essential cookies or third-party tracking technologies. The measurement in Section 2.5 uses neither cookies nor storage on the device. 6. Third-Party Services 6.1 The Platform integrates with Our payment provider, named at checkout, for payment processing. That provider may deploy its own cookies and tracking technologies on its payment pages, governed exclusively by its own privacy and cookie policy. Waiver2.0 has no control over and bears no responsibility for its cookie practices. 6.2 Users are directed to review the payment provider's own Cookie Policy, linked at checkout, before completing a payment transaction. 6.3 No other third-party services with cookie or tracking capabilities are integrated into the Platform. 7. Children & Minors 7.1 The Platform is intended only for people who have reached the age of majority under the law of the jurisdiction in which the Gym operates. 7.2 The Platform is not directed to, and does not knowingly collect personal information from, anyone under the age of majority, including children under 13 within the meaning of the Children's Online Privacy Protection Act (COPPA). 8. Amendments to this Cookie Policy 8.1 This Cookie Policy is versioned and stored on the Platform. We will notify users of material changes and, where required by law, seek consent again. 8.2 Last updated: 23 October 2026.