WorkMesh Cookie Policy

This Cookie Policy explains how Cost Time Risk Pty Ltd trading as WorkMesh uses cookies and similar browser technologies. It should be read with the WorkMesh Privacy Policy.

1. What cookies are

Cookies are small text files stored by a website in your browser. Similar technologies include local browser storage and browser identifiers. They may be necessary for a service to work or may be optional technologies used for preferences, analytics or marketing.

2. Our approach

Necessary cookies are used for security, login, trusted-device choices and remembering your privacy selection. Optional categories are off by default. Google Analytics is loaded only after you consent to Analytics, and only on the public WorkMesh website pages listed below. WorkMesh does not currently use advertising or retargeting trackers.

3. Cookie inventory

Name or pattern	Provider	Category and purpose	Typical duration
SYSTEMS_APP_SESSION	WorkMesh	Necessary. Maintains an authenticated WorkMesh session and supports security and request protection.	Browser session, subject to server idle and absolute timeout settings
WM_TRUSTED_DEVICE	WorkMesh	Necessary when you select the option. Remembers an MFA-trusted browser using a protected random token. It does not contain the MFA secret.	30 days
WM_PRIVACY_CONSENT	WorkMesh	Necessary. Remembers your versioned privacy choices and consent identifier so optional services can honour them.	180 days
_ga	Google Analytics	Analytics. Distinguishes browsers using a random identifier so aggregate public website usage can be measured.	Up to 2 years
_ga_*	Google Analytics	Analytics. Persists session state for the Google Analytics property, including measurement ID G-KY1052LEME.	Up to 2 years

4. Google Analytics

After Analytics consent, WorkMesh loads Google Analytics 4 using measurement ID G-KY1052LEME. It helps us understand matters such as visits, pages viewed, general referral sources, browser and device types and broad geographic usage so we can improve the public website.

We configure the tag without Google advertising signals or advertising personalisation. We do not provide a WorkMesh user ID, do not send names, email addresses or form contents, and remove query strings from the page location sent by our tag.

Google Analytics is enabled only on WorkMesh public website pages, including public marketing, pricing, waitlist, privacy, cookie and commercial-terms pages.

• Home;
• WorkMesh People;
• WorkMesh Developer;
• WorkMesh Digital Signatures;
• Pricing;
• Waitlist;
• Privacy Policy; and
• Cookie Policy.

It is not loaded on app.html, authenticated application screens, login, onboarding, signing, external forms, external timesheet approvals, unsubscribe or maintenance pages.

5. Local browser storage

Authenticated WorkMesh screens may use first-party local storage for navigation return paths, workspace selection, archive-view preferences and similar interface settings. These items do not enable cross-site advertising and remain in the browser until cleared or replaced.

6. Your choices

On your first visit, you can select Accept all, Reject non-essential or Manage preferences. Analytics and marketing are not selected in advance. Select Cookie settings at any time to change or withdraw optional consent.

When Analytics consent is withdrawn, WorkMesh disables the public Analytics tag for the current page and attempts to remove first-party Google Analytics cookies accessible from the WorkMesh domain. You can also clear cookies and local storage through your browser settings. Deleting WM_PRIVACY_CONSENT will cause the banner to appear again.

Necessary cookies cannot be switched off through the banner because login, security, trusted-device and privacy-choice functions may otherwise stop working.

7. Consent records

When you make or change a choice, WorkMesh stores the selection in WM_PRIVACY_CONSENT and may record a pseudonymous audit event containing the consent identifier, selected categories, policy versions, time, page, a protected IP hash and browser information. These records are normally retained for up to three years unless needed for a complaint, investigation or legal obligation.

8. Changes and contact

We will update this policy and the cookie inventory when our technologies or practices change. A new choice will be requested where a material change affects consent-based processing.

Questions and privacy rights requests may be submitted through the WorkMesh privacy request form.