Version dated October 27, 2026.
Translation for convenience. If there is any difference, the Portuguese version prevails.
This notice explains how WaitScope uses cookies and similar technologies on the website, in the console and in the Android app. In short: the website does not use cookies, and no WaitScope feature is used for audience analytics, advertising or tracking. The console uses only four first-party cookies: three necessary ones and one for language, set only when you choose the language. The person responsible for WaitScope is Johab Benicio de Oliveira, a natural person based in Brazil. This notice supplements the Privacy Policy. The articles cited are from the Lei Geral de Proteção de Dados Pessoais (LGPD, Brazil's General Data Protection Law, Lei nº 13.709/2018).
1. What cookies are
Cookies are small files that a website stores in your browser to remember information from one page to another or from one visit to another. For example: that you have already signed in to your account or which language you chose.
The cookie guide of the Agência Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Agency) classifies cookies in several ways. These are the ones that matter here:
- First-party or third-party. First-party cookies are set by the address you are visiting. Third-party cookies come from another domain embedded in the page, such as an advertiser's.
- Necessary or non-necessary. Without the necessary ones, the website or the service you requested does not work. Non-necessary cookies serve other purposes, such as measuring audience or displaying ads.
- By purpose. Functionality cookies remember a choice you made, such as the language. There are also audience analytics cookies and advertising cookies, which WaitScope does not use.
- Session or persistent. Session cookies are discarded when the session ends. Persistent cookies remain until the end of a defined period.
There are also similar technologies, which store information in the browser or on the phone without being cookies. This notice covers them as well.
2. The waitscope.com website: no cookies
The product website, at waitscope.com, with versions in English, Portuguese and Spanish, sets no cookies, runs no scripts and loads nothing from other domains. Text, images and fonts come from the website itself. There is no audience analytics tool, advertising pixel or other tracker. The address waitscope.com.br only redirects to waitscope.com, usually to the Portuguese version, and also sets no cookies.
Cloudflare network error reports
The website is hosted by Cloudflare, Inc., a United States company. In the responses of the website and of the waitscope.com.br redirect, Cloudflare includes two technical headers, called NEL and Report-To. They are not cookies. They work as follows:
- A browser that supports this feature stores an instruction: if a page of the website fails because of a network error, send a report to Cloudflare.
- The instruction is valid for 7 days, counted from the last time you opened the website.
- Only failures generate a report. Successful visits are not reported.
- The report goes from the browser directly to Cloudflare (
a.nel.cloudflare.com), not to WaitScope. It carries technical data, such as the page address, the type of error and the time. On receiving it, Cloudflare sees the IP address and the browser of whoever sent it. - The purpose is to diagnose failures in Cloudflare's network.
Not every browser supports this feature. In Chrome and Edge, which do support it, the instruction is deleted together with cookies and site data. In those browsers, blocking the website's cookies also prevents the reports from being sent. Since the website does not use cookies, blocking them changes nothing in how it works.
The legal basis is the legitimate interest in keeping the website available (LGPD, art. 7, IX). Because Cloudflare is a United States company, section 6 of the Privacy Policy explains this international data transfer.
3. The waitscope.io console: necessary and language cookies
The console, at waitscope.io, uses four cookies, all first-party, set by the console itself. Three are necessary. The language cookie is a functionality cookie and is set only when you choose the language. The names contain latena, the product's former name.
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
__Host-latena_session | Stores the session token, which keeps you signed in after login. | Up to 12 hours. The session ends earlier if you sign out or do not use the console for 30 minutes. | Necessary |
__Host-latena_login | Protects the login form against forged submissions from other sites. It is set when you open the login screen. | 1 hour | Necessary |
__Host-latena_codigo | Links your browser to the two-step verification code request during login. | 10 minutes | Necessary |
latena_idioma | Stores the language you chose: Portuguese, English or Spanish. It is set only when you choose a language, on the login screen, on the Terms acceptance page or in “My account”. Without it, the console uses your account's language, after you sign in, or the browser's language. | 365 days | Functionality |
The browser sends these cookies only to the console itself. All four travel only over an encrypted connection (HTTPS), cannot be read by the page's scripts (HttpOnly) and are not sent with requests that originate from other sites (SameSite=Strict). The three that begin with __Host- are valid only for the exact address of the console, and no other address can set or change them.
The console does not use other means of storing data in the browser, such as localStorage, sessionStorage or IndexedDB, and does not load content from other domains.
When you sign in, the console records the session on the server, which is in Brazil, at Magalu Cloud. The record contains the IP address, the browser and, in the app, the phone model. Of the token, the server stores only a cryptographic digest (hash), never the token itself. The Privacy Policy explains these records in section 4 and the retention periods in section 7.
Connections to the console do not pass through Cloudflare: waitscope.io leads directly to WaitScope's server, without the network error headers described in section 2.
The console's old address, jb-profiler.tail47afbc.ts.net, still works for a transition period, until it is shut down. It uses the same four cookies, separate from those of waitscope.io. This path passes through relay servers of Tailscale Inc., a Canadian company. These servers are in the United States and set no cookies. They see the IP address of whoever accesses it, but not the content, because the connection remains encrypted all the way to WaitScope's server.
4. Why there is no cookie banner
A cookie banner is there for you to accept or reject cookies that depend on consent, such as audience analytics and advertising cookies. WaitScope does not use any cookie of that kind, so there is nothing to accept or reject.
The session, login and code cookies are strictly necessary: without them, you cannot sign in or use the console. For strictly necessary cookies, the ANPD's cookie guide states that consent is not the appropriate legal basis, because there is no real choice. The language cookie is a functionality cookie: it is set only when you choose a language, stores only that choice and serves no other purpose. Because it arises from your own request, there is nothing to accept or reject separately. The guide calls for clear information on purpose, duration and sharing and accepts that this information may be on a dedicated page, such as this one.
The legal bases for the console cookies are:
__Host-latena_sessionandlatena_idioma: performance of the contract for use of the console, governed by the Terms of Service (LGPD, art. 7, V).__Host-latena_loginand__Host-latena_codigo: legitimate interest in login security, which protects your account and the service (LGPD, art. 7, IX, and art. 10).- If you use the console on behalf of a customer company, the basis for
__Host-latena_sessionandlatena_idiomais the legitimate interest in providing that company with the service it requested (LGPD, art. 7, IX), as explained in the Privacy Policy.
When the basis is legitimate interest, you may object to the processing if you believe the LGPD has not been complied with (art. 18, § 2). The request goes through the channel in section 8.
5. Android app: what is stored on the phone
The app does not use cookies. It sends the session token with each request to the console and stores on the phone only what it needs to work.
| What is stored | Purpose | Until when |
|---|---|---|
| Session token, encrypted with a key from the Android Keystore, Android's own key vault | Keep you signed in without asking for the password each time you use the app. | Until you sign out of the app. The app session expires after 90 days, or earlier, after 30 days without use. When you sign out, the token is deleted from the phone and, if there is a connection, the session is ended on the server. Without a connection, it expires on its own, and you can end it earlier in “My account”, in the console. |
| Preferences: server address, language, biometric lock (on or off) and last username | Open the app the way you left it. | They remain after you sign out, until you uninstall the app or clear its data in the Android settings. |
| Upload data: file names and sizes, how much has already been uploaded and the result | Resume the upload if the connection drops and show the result. | They remain after you sign out, until you uninstall the app or clear its data. |
| Copy of a trace that you send to the app from another app, with Share or Open with | Perform the upload. The copy stays in the app's private storage. | It is deleted when the upload finishes or is canceled. A leftover copy is deleted when the app is opened again, if it is more than 24 hours old. |
Reports you download: on Android 10 or later, in the Downloads/WaitScope folder; on Android 8 and 9, in the app's own downloads folder | Read or share the report later. | Until you delete them. They stay on the phone after you sign out: the app does not delete them. On Android 8 and 9, they are also removed when you uninstall the app or clear its data. |
The Downloads/WaitScope folder is outside the app's private storage: file managers and other apps with permission to access the phone's files can open it. On Android 8 and 9, the download is performed by Android's own download manager, which saves the file in the app's folder and keeps, on the phone, a record of the request with the session token. That token stops being valid when the session is ended on the server or expires.
The app has no third-party libraries for usage analytics, advertising, crash reporting or notifications, and does not use the Android advertising ID. The notice that an analysis is ready comes from a direct query to the console. The app's data are excluded from the Android cloud backup and from transfer to another phone. The biometric lock is handled by Android itself: the app does not receive your fingerprint or the image of your face and stores only whether the lock is on.
6. No analytics, advertising or tracking
Neither the website, nor the console, nor the app uses cookies or tools for audience analytics, advertising or cross-site tracking.
As with any access to the internet, the servers receive technical connection data, such as the IP address, the browser, the page address and the time. This does not depend on cookies. Cloudflare receives these data when delivering the website, and the console keeps them in the sessions and in the server logs. The Privacy Policy states who receives each item of data in section 5 and for how long in section 7.
7. How to manage and delete cookies
You control cookies through your browser: you can view, delete and block the cookies of a single site or of all sites. The official instructions for the most widely used browsers:
What happens in each case:
- The waitscope.com website. Nothing changes, because it does not use cookies. The effect on Cloudflare's network error instruction is described in section 2.
- Deleting the console cookies. You are signed out of your account in that browser and need to sign in again. The session left open on the server ends on its own after 30 minutes without use.
- Blocking the console cookies. You cannot sign in. Without them, the console does not confirm that the login form came from it, does not link the two-step verification code to your browser and does not keep the session open.
- Blocking or deleting only
latena_idioma. The console keeps working: after you sign in, in your account's language; before that, in the browser's language. - Android app. Clearing the app's data in the Android settings signs you out of the account on the phone and resets the preferences to their defaults. Downloaded reports remain until you delete them with the file manager; on Android 8 and 9, they are removed together with the app's data.
In “My account” (click your username at the top of the screen), in the console, you can see the open sessions and end them.
8. Changes and contact
This notice is updated when the use of cookies or similar technologies on the website, in the console or in the app changes. The version date is at the top of the page. If WaitScope starts using another cookie, this notice will be updated beforehand. A cookie that depends on consent will be set only if you accept it, with an option to reject that is as easy as the option to accept.
For questions about cookies or to exercise your rights as a data subject (LGPD, art. 18), write to contato@waitscope.com. WaitScope replies within 15 days. How to make the request and how your identity is confirmed are explained in section 11 of the Privacy Policy.
As a small-scale processing agent, WaitScope has not appointed a data protection officer, or encarregado (art. 11 of Resolução CD/ANPD nº 2/2022, the ANPD regulation for small-scale processing agents). The email address above is the channel of communication with data subjects. You may also lodge a complaint with the ANPD.