Legal · Code census
Cookie & browser storage inventory
Last updated: October 3, 2026
Our Privacy Policy describes WaterMark's first-party browser storage and says we do not use advertising pixels or cross-site tracking. This inventory makes that statement verifiable against the current web code.
Census finding: some browser storage is optional
WaterMark's two cookies are essential. The code census also found first-party localStorage entries for language, layouts, saved views, collapsed panels, and dismissed guidance. Those convenience preferences are optional: the related screens still work with their defaults if the entries are absent. This corrects the older shorthand that all WaterMark local storage was essential.
WaterMark does not use advertising pixels, cross-site tracking scripts, analytics cookies, or third-party browser-storage keys. Product analytics disclosed in the Privacy Policy is sent server-to-server and does not add a browser cookie.
Complete current inventory
Names in braces are runtime parts of a key: for example, the WaterMark company or construction project number. “Persistent” browser storage remains until WaterMark removes or overwrites it, or you clear site data. “Tab session” storage ends when that browser tab closes.
| Type | Exact name or pattern | Plain-language purpose | Lifespan | Classification |
|---|---|---|---|---|
| Cookie | wm_office_refresh | Keeps an office user signed in by holding the rotating refresh credential. It is HttpOnly, SameSite=Strict, and limited to /api/auth. | Persistent: configured for 7 to 180 days; 60 days by default. Replaced during rotation and removed at sign-out. | Essential |
| Cookie | wm_csrf | Supplies the readable half of the same-origin CSRF check for cookie-authenticated office requests. It does not authorize a request by itself. | Same configured duration as the refresh cookie; replaced with the session and removed at sign-out. | Essential |
| Cookie | wm_oauth_qbo_state | Set only when a company owner connects QuickBooks. It ties that connection to the browser that started it, so a connect link handed to someone else cannot finish. It is HttpOnly, SameSite=Lax, and sent only to /api/quickbooks/callback. It holds a keyed check value and no customer data. | Fifteen minutes at most; removed when QuickBooks sends the browser back. | Essential |
| Cookie | wm_oauth_xero_state | Set only when a company owner connects Xero. It ties that connection to the browser that started it, so a connect link handed to someone else cannot finish. It is HttpOnly, SameSite=Lax, and sent only to /api/xero/callback. It holds a keyed check value and no customer data. | Fifteen minutes at most; removed when Xero sends the browser back. | Essential |
| Cookie | wm_oauth_gbp_state | Set only when a company owner connects Google reviews. It ties that connection to the browser that started it, so a connect link handed to someone else cannot finish. It is HttpOnly, SameSite=Lax, and sent only to /api/google-reviews/callback. It holds a keyed check value and no customer data. | Fifteen minutes at most; removed when Google reviews sends the browser back. | Essential |
| Local storage | wm_office_migrate_attempts | Bounds retries while an older browser session is moved from legacy stored credentials to safer cookies. | Persistent only during migration; removed after success, a definitive refusal, or the three-attempt limit. | Essential |
| Local storage | wm_lang | Remembers whether public pages, homeowner pages and the office dashboard should open in English or Spanish. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_view | Reopens the office dashboard view you last used. | Persistent until another view is chosen or site data is cleared. | Optional |
| Local storage | wm_today_layout | Remembers whether the office Today screen opens in its focused or classic layout on this browser, so the choice survives a page that drops the address-bar setting. The same choice is also saved to your account. | Persistent until changed or site data is cleared. | Optional |
| Cookie | wm_office_generation | Remembers your choice of the new office or the preserved wave 2 office. Set only when you switch versions. The server reads it before serving the page; it does not track activity. | One year; replaced when you switch, or removed when site data is cleared. | Optional |
| Cookie | wm_archive_ticket | Lets a WaterMark platform administrator keep reading the preserved wave 2 office after they open it. It is set only for a signed-in platform administrator, and never for a company user or a visitor. It holds a short signed permission for that one page, carries no customer data, and does not track activity. | Thirty minutes, then it expires on its own; sent only to the dashboard page, and removed when site data is cleared. | Essential |
| Local storage | wm_view_all_companies | Remembers whether a multi-company office is viewing one company or all managed companies. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_demo_tour_dismissed_{organization_id|public} | Remembers that the demo guide was dismissed for that company or public demo. | Persistent until site data is cleared. | Optional |
| Local storage | wm_demo_banner_compact_{organization_id|public} | Remembers whether the demo banner is compact for that company or public demo. | Persistent until the banner is expanded or site data is cleared. | Optional |
| Local storage | wm_onboard_{organization_id|x}_imported | Remembers that a customer import completed so onboarding guidance reflects that step. | Persistent until site data is cleared. | Optional |
| Local storage | wm_onboard_{organization_id|x}_customer-import-active | Holds the active import batch number so an interrupted customer import can resume after a reload. | Until the import completes, definitively fails, or the marker is invalid; otherwise until site data is cleared. | Essential |
| Local storage | wm_onboard_{organization_id|x}_dismissed | Remembers that the office dismissed its onboarding checklist. | Persistent until site data is cleared. | Optional |
| Local storage | wm_onboard_{organization_id|x}_convDone | Prevents the post-setup plan prompt from being shown repeatedly after a choice. | Persistent until site data is cleared. | Optional |
| Local storage | wm_rm_view | Remembers Route Manager filters and display configuration. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm-record-payment-intent:{invoice_id} | Holds the one-time key for a payment the office is recording on an invoice, so a page reload after a lost response replays the same payment instead of booking it twice. | Per invoice; removed as soon as the server confirms the payment, or when site data is cleared. | Essential |
| Local storage | wk_layout | Remembers whether the week board uses day columns or technician swim lanes. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_office_panel_collapsed_{organization_id|office}_unpaid | Remembers whether the Unpaid Invoices office panel is collapsed. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_office_panel_collapsed_{organization_id|office}_chem-tech | Remembers whether the Chemical Cost by Technician panel is collapsed. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_office_panel_collapsed_{organization_id|office}_chem-pool | Remembers whether the Chemical Cost by Pool panel is collapsed. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_office_panel_collapsed_{organization_id|office}_sms | Remembers whether the Customer Messages panel is collapsed. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_ops_alerts_collapsed_{organization_id|office} | Remembers whether the Operations Alerts panel is collapsed. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_command_center_collapsed_{organization_id|office} | Remembers whether the office command-center panel is collapsed. | Persistent until changed or site data is cleared. | Optional |
| Local storage | wm_command_center_high_water_{organization_id|office} | Remembers the highest dollar exposure shown in the command center so its visual scale stays comparable. | Persistent until overwritten or site data is cleared. | Optional |
| Session storage | wm_call_seen_{organization_id|x} | Records the latest call ID seen by the live-call poller so old calls are not presented again in the same tab. | Tab session. | Essential |
| Session storage | wm.billing.intent.draw.{project_id} | Keeps one idempotency reference for an unresolved construction draw so a retry cannot create a duplicate invoice. | Until a definitive outcome, or when the tab closes. | Essential |
| Session storage | wm.billing.intent.retainage.{project_id} | Keeps one idempotency reference for an unresolved retainage release so a retry cannot bill twice. | Until a definitive outcome, or when the tab closes. | Essential |
| Session storage | wm_pay_method | Carries the selected card or bank-payment method through the payment-provider redirect. | One redirect: removed when the portal returns, or when the tab closes. | Essential |
| Session storage | wm_view_as | Platform operators only. Tells a newly opened tab which company was opened read-only, so the tab can name it in the banner above the page. It carries the company and the operator who opened it, never anything a customer typed. | Tab session: removed when the view is left, or when the tab closes. | Essential |
| Local storage | wm_view_as_exit | Platform operators only. Tells the operator's other tab that the read-only view was left, so the console stops showing a view as open. | One signal: removed as soon as the other tab reads it. | Essential |
| Session storage | wm_view_as_ended | Platform operators only. Marks a tab whose read-only view has ended, so reloading that tab asks for a sign-in instead of opening the operator's own account in it. It holds the value 1 and nothing else. | Tab session: removed when someone signs in on that tab, or when the tab closes. | Essential |
Legacy cleanup entries
The current web code does not create these entries. It recognizes and removes them so browsers returning from an older version are migrated or cleaned up safely.
| Type | Exact name | Plain-language purpose | Lifespan | Classification |
|---|---|---|---|---|
| Legacy local storage | wm_office_token | Old office access credential, now read only to exchange it for the cookie session and then erase it. | Not created now; an old copy persists only until migration or browser-data clearing. | Essential, legacy |
| Legacy local storage | wm_office_refresh_token | Old office refresh credential, now consumed once to establish the HttpOnly cookie session and then erased. | Not created now; an old copy persists only until migration or browser-data clearing. | Essential, legacy |
| Legacy local storage | wm:office:appearance:v1 | Retired office appearance preference. The dashboard only removes it. | Not created now; removed when the dashboard loads. | Optional, legacy |
| Legacy local storage | wm_office_design | Retired office style preference (the new or the previous style). The office has one style now, so the dashboard only removes it. | Not created now; removed when the dashboard loads. | Optional, legacy |
| Legacy local storage | wm_office_workspace | Retired choice between the new workspace and the older office. The older office is retired, so the dashboard only removes it. | Not created now; removed when the dashboard loads. | Optional, legacy |
This inventory covers the production web surface. Mobile operating-system storage and server database records are outside browser cookie and Web Storage APIs and are described separately in the Privacy Policy.