HeyDoWhat Cookie Policy
Publication Date: September 9, 2026 Last Updated: September 9, 2026
1. Scope, Relationship to Other Notices, and Meaning of Technologies
This Cookie Policy explains how HeyDoWhat LLC ("HDW," "we," "us," or "our") uses cookies and similar technologies in connection with the HeyDoWhat website, web application, and other HDW digital properties that link to this Policy (collectively, the "Platform"). It supplements the HeyDoWhat Privacy Policy, which explains the broader categories of Personal Information HDW processes, the purposes of that processing, retention criteria, disclosures, and privacy rights. If this Policy and the Privacy Policy address the same technology, they are intended to be read together.
For this Policy, "Cookie Technologies" means cookies, local storage, session storage, browser or device identifiers, embedded scripts, and similar technologies that can store information in, retrieve information from, or otherwise recognize a browser or device. A cookie is a small text file a website can place in a browser. Local storage usually remains until it is cleared or replaced; session storage normally remains only for the browser session. Their actual availability and duration can depend on the browser, browser settings, and the relevant provider.
This Policy is a privacy notice and control explanation. It is not a contract, a blanket consent, or a waiver of privacy rights. The Terms of Service govern the consumer agreement with HDW. Where HDW needs consent or affirmative agreement for a particular activity, it presents the required request at the relevant point of collection or control; acknowledging that this Policy is available does not supply that separate consent.
2. How HDW Categorizes Cookie Technologies
HDW uses or may use the following categories only as described in this Policy:
- Essential, security, authentication, and functional technologies help the Platform work, protect accounts and transactions, remember a privacy preference, preserve a requested flow, or maintain a user-selected setting. They may operate without an optional-analytics choice because the requested service cannot reasonably operate without them.
- Optional first-party analytics technologies help HDW measure how the Platform performs and how people interact with it. They operate only after a user selects "Allow optional analytics" and only while Global Privacy Control is not active in that browser.
- Conditional provider technologies may be used by a provider only when a person loads the relevant feature, such as checkout or a protected action. They are not a claim that the provider is loaded on every visit.
Under HDW's practices as of the Last Updated date, HDW does not use an advertising, retargeting, cross-context behavioral-advertising, session-replay, tag-manager, or third-party analytics category on the Platform. Section 7 explains HDW's current practices and the separate treatment of first-party in-Platform promoted placements.
3. HDW Browser-Storage and Similar-Technology Inventory
The table below identifies the HDW-controlled browser storage and similar technology confirmed for this Policy's source date. A value marked "browser-controlled" can be removed earlier by a user, browser setting, or browser data-clearing process. A value marked "session" ordinarily ends when the applicable browser session ends, although browser behavior can vary.
| Technology or naming pattern | Party and category | Purpose and information involved | When it operates | Persistence |
|---|---|---|---|---|
| hdw_cookie_consent | HDW; essential privacy-preference storage | Records the browser's choice as essential or all. The public control labels all as "Allow optional analytics." | When a person makes a choice, or HDW detects active Global Privacy Control and records essential-only status. | Local storage until changed, cleared, or replaced. |
| HDW authentication-session storage (provider-generated runtime name) | HDW authentication integration; essential authentication and security storage | Maintains a signed-in session, account continuity, and related authentication state. HDW does not list a fixed key because the authenticated provider may generate the browser-storage name at runtime. | When an account session is created or maintained. | Provider- and browser-controlled; may persist until sign-out, expiration, clearing, or replacement. |
| hdw_join_party and hdw_q_loc | HDW; functional queue-session storage | Preserves a selected party size across a sign-in redirect and temporarily stores the selected Merchant-location snapshot used to continue a queue flow. It does not store a person's precise device coordinates. | Only when the relevant queue flow is used. | Session storage. hdw_join_party is removed after it is restored to the queue flow. |
| hdw_ai_teased and hdw_verify_dismissed | HDW; functional session-preference storage | Remembers that a person has already seen the optional AI teaser or dismissed the phone-verification reminder during the session. | Only when the relevant interface appears and the person triggers the state. | Session storage. |
| hdw_sms_sweep_<account identifier> | HDW; essential compliance-session storage | Prevents repeated execution in the same session of the signed-in consent-evidence sweep. It is not an optional analytics identifier. | Only for a signed-in account when the relevant sweep runs. | Session storage. |
| hdw_aid | HDW; optional first-party analytics | A randomly generated browser identifier that may link consented same-browser analytics activity to an authenticated account after sign-in. It is pseudonymous, not anonymous. | Created only after optional analytics is allowed and no active Global Privacy Control signal applies. | Local storage until HDW's withdrawal control removes it, it is cleared, or it is replaced. |
| hdw_sid | HDW; optional first-party analytics | A randomly generated visit/session identifier used with consented analytics events. | Created only after optional analytics is allowed and no active Global Privacy Control signal applies. | Session storage until the browser session ends or HDW's withdrawal control removes it. |
HDW's reviewed application source does not directly set a browser cookie through the document.cookie interface for the HDW-controlled functions listed above. That does not mean browser storage is the only relevant technology: authentication and conditional third-party features can use their own technologies as described in Sections 5 and 6.
4. Essential, Security, and Functional Technologies
HDW uses essential and functional Cookie Technologies to provide requested Platform functions, including account authentication and session continuity, security and fraud protection, privacy-choice storage, legal-document and consent workflow continuity, transaction and queue workflow continuity, and limited interface preferences. Blocking or deleting these technologies can sign a person out, interrupt a queue or checkout flow, make a setting unavailable, or otherwise impair the requested service.
HDW may use the information generated through essential, security, authentication, and functional technologies for the lawful purposes described in the Privacy Policy, including operating and protecting the Platform, preventing fraud, enforcing agreements, maintaining compliance and consent evidence, resolving errors, responding to legal process, and establishing, exercising, or defending legal rights. This Policy does not limit HDW's lawful use of first-party operational, security, service-improvement, aggregate, or deidentified information under the Privacy Policy and applicable law.
5. Optional First-Party Analytics
5.1 Choice, Gate, and Global Privacy Control
HDW's optional analytics is first-party. It is not an advertising pixel, third-party analytics SDK, or session-replay service. Optional analytics does not send an event, create hdw_aid or hdw_sid, buffer an event for later sending, or make an optional-analytics network request when no choice has been made, when a person has selected Essential only, or when the browser asserts Global Privacy Control ("GPC").
The public control defaults to Essential only and provides an equally accessible "Allow optional analytics" choice. An active GPC signal takes precedence over an earlier or later optional-analytics choice in that browser, so optional analytics remains off while GPC is active. GPC does not prevent essential technologies from operating and does not by itself delete prior server-side records.
5.2 What Optional Analytics Measures
When optional analytics is enabled, HDW may collect limited first-party event information such as the event name, page path, date and time, device class, pseudonymous browser and session identifiers, and limited non-content event properties. Depending on the feature a person uses, those properties can include a listing or location identifier, search length and source, result count and category, whether an AI interaction occurred, AI-message character count, whether a fallback occurred, result count, and result selection.
HDW's optional first-party analytics does not retain raw search text or AI-prompt content in the analytics event. HDW's analytics event row does not store Internet Protocol address or user-agent information. The relevant server-side analytics endpoint applies a property allowlist to the identified search and queue events so that an older or altered client cannot reintroduce unapproved properties for those events.
The browser identifier may be associated with an authenticated account after that person signs in. Optional analytics therefore is not anonymous and may be Personal Information under applicable law. HDW processes it for the purposes in the Privacy Policy, including Platform measurement, troubleshooting, security, product and service improvement, and the controlled aggregate or deidentified insight activities described there. Under HDW's current analytics design, HDW does not sell, license, or provide a customer with an identifiable, pseudonymous, or user-level analytics dataset.
5.3 Withdrawal and Effect on Existing Records
A person may withdraw optional analytics at any time through the public preference control described in Section 8. When a withdrawal is made, HDW will change the browser's preference to Essential only, stop future optional analytics in that browser, and remove hdw_aid from local storage and hdw_sid from session storage. A withdrawal does not delete, reverse, or make unlawful optional-analytics events already received by HDW before withdrawal. Those prior events remain subject to the Privacy Policy's retention criteria, applicable privacy rights, and applicable law.
6. Conditional Feature-Specific Providers
Some providers may use their own Cookie Technologies when a person chooses to load a feature that depends on that provider. HDW does not control the provider's independent policies, browser storage, or processing. Review the provider's notice for more information.
| Provider and feature | When it may load | HDW's disclosure | Provider materials |
|---|---|---|---|
| Stripe Payment Element | When a person uses checkout or another payment feature that loads Stripe's payment interface. | Stripe may process payment, transaction, fraud-prevention, and browser/device information needed for its services and may use its own Cookie Technologies, including for fraud prevention or a Stripe-provided payment experience. HDW does not receive or store full payment-card numbers through the Payment Element. | Stripe Privacy Policy and Stripe Cookie Policy |
| Cloudflare Turnstile | When HDW loads a protected action that uses the Turnstile widget, such as an applicable queue action. | Turnstile may process browser/device information and use its own technologies to help distinguish human activity from automated abuse. Its use is conditional on the protected action; it is not an HDW optional-analytics provider. | Cloudflare Privacy Policy |
HDW may add, replace, or remove a provider only in accordance with Section 7 and the Privacy Policy. A provider's inclusion in this table does not mean the provider is active on every page or in every browser session.
7. Sale, Sharing, Targeted Advertising, and Promoted Placements
Under HDW's practices as of the Last Updated date, HDW does not Sell Personal Information, Share Personal Information for cross-context behavioral advertising, or conduct targeted advertising as those terms apply under applicable privacy law. HDW does not currently use advertising pixels, retargeting technologies, or third-party analytics SDKs to track a person's activity across unaffiliated services. HDW's use of first-party activity to operate, secure, improve, personalize, or measure its own Platform, and its controlled aggregate or deidentified insight activities, are described in the Privacy Policy and are not represented here as a Sale, Sharing, or targeted-advertising practice.
HDW may use eligible first-party activity occurring on the Platform to select and rank clearly identified promoted placements displayed within the Platform. Under HDW's current promoted-placement design, the promoting Merchant or advertiser does not receive the underlying individual profile, identifiable activity, or row-level event data. HDW may provide the aggregate or deidentified campaign reporting described in the Privacy Policy.
This Section describes HDW's practices as of the Last Updated date; it is not a promise that HDW's business or technology will never change. Before a new Cookie Technology, provider, advertising practice, or data disclosure materially changes the practices described here, HDW will complete the applicable privacy, security, vendor, and data-flow review; update the relevant inventory and disclosures; and provide any notice, choice, opt-out, consent, preference-signal treatment, or version treatment required by applicable law. An earlier Cookie Policy acknowledgment or optional-analytics choice is not authorization for a materially different use.
8. Controls Available to You
8.1 HDW Preference Control
At release, HDW provides an accessible control from the Cookie Policy and Do Not Sell/Share pages that lets a person choose Essential only or Allow optional analytics. The control can be reopened after a choice. Selecting Essential only, withdrawing optional analytics, or using a browser with active GPC disables future optional first-party analytics in that browser as described in Section 5.
The choice applies to the browser and device on which it is made. It does not necessarily apply to a different browser, profile, device, or a browser that has cleared its site data. If a person clears HDW browser storage, the browser may treat the person as having no stored preference and show the choice again, except that active GPC continues to control optional analytics in that browser.
8.2 Browser and Device Controls
Most browsers and devices provide settings that allow a person to delete, block, or limit cookies, local storage, session storage, or similar data. Those settings may not control every provider technology, and a person may need to use the relevant provider's controls as well. Blocking or clearing essential technologies can interfere with authentication, transaction, queue, privacy, and other Platform functions.
Some browsers offer a Do Not Track setting. Because there is no common industry or technical standard for that signal, HDW does not respond to Do Not Track. HDW does honor GPC and other legally recognized opt-out preference signals to the extent applicable law requires, as stated in this Policy and the Privacy Policy.
8.3 Privacy Requests and Do Not Sell/Share
The Do Not Sell/Share page provides the current-model statement and links to the applicable preference control. The Privacy Policy explains how to submit a privacy-rights request, the jurisdiction-qualified rights that may apply, verification, authorized-agent, appeal, and retention information. An optional-analytics choice is distinct from a request to access, correct, delete, or exercise another privacy right.
9. Retention and Data Rights
Browser-stored values persist as described in Section 3 unless they are cleared, replaced, deleted through HDW's withdrawal control, or expire under a provider's settings. Server-side information associated with Cookie Technologies is retained according to the Privacy Policy's category-based criteria and any applicable legal, security, fraud-prevention, accounting, consent-evidence, dispute, or recordkeeping requirements.
Where applicable law grants a privacy right, HDW processes the request under the request-specific verification, procedure, and timing rules described in the Privacy Policy and applicable law. Deleting browser storage from a device does not itself delete an account record or a server-side record, and an account-level request does not require HDW to reconstruct or delete Aggregate Information or Deidentified Information where applicable law permits its retention.
10. Changes to This Policy
HDW may update this Cookie Policy to reflect changes in law, technology, providers, features, or data practices. HDW will post the updated Policy and revise its Last Updated date when a final version is published. If a change materially affects how HDW uses Cookie Technologies or Personal Information, HDW will provide the notice, choice, consent, opt-out, and version treatment required by applicable law and the Privacy Policy. A technical clarification or correction that does not materially change a person's rights or HDW's data practices may take effect when posted, to the extent permitted by law.
11. Contact
For questions about this Cookie Policy, an optional-analytics choice, or a privacy request, contact:
HeyDoWhat LLC
Attn: Privacy
418 Broadway STE R
Albany, NY 12207
United States