Cookie policy
Wayvin uses four cookies the service needs in order to work and, only if you agree, two Google analytics cookies. No cookie on this site is used for advertising.
What a cookie is
A cookie is a small file a website stores in your browser to remember something from one page to the next: that you have already signed in, for example. All three cookies on this page are first-party, set by Wayvin's own domain, and there are no third-party cookies.
Which cookies we use
This is the complete list. The first four are always set because the service cannot run without them; the last two only if you accept analytics. If we ever add another, it will appear here before we start using it.
| Name | Set by | What it is for | Category | Duration |
|---|---|---|---|---|
wos-session | Wayvin, carrying the session WorkOS issues | Keeping your session open after you sign in. | Technical, strictly necessary | 7 days (604,800 seconds). Signing out deletes it immediately. |
wv_session | Wayvin | Telling the page whether a session is open, so the header paints in the right state from the start instead of changing as you watch. | Technical, strictly necessary | Session only: it has no expiry date and disappears when you close the browser. |
NEXT_LOCALE | Wayvin, through the next-intl library | Remembering which language you want to read the site in. | Technical: a language preference you choose yourself | Whatever next-intl applies by default. Wayvin does not configure its lifetime. |
wv_consent | Wayvin | Remembers whether you accepted or refused analytics, so that you are not asked again on every page. | Technical, strictly necessary | 180 days (15,552,000 seconds) from your answer. After that we ask again. |
_ga | Google Analytics, loaded through Google Tag Manager | Tells one browser apart from another in order to count visitors. | Analytics. Only if you accept | 2 years, per Google's own documentation. |
_ga_* | Google Analytics, loaded through Google Tag Manager | Holds the measurement session state. The asterisk stands for the Google Analytics data stream identifier, which is appended to the name. | Analytics. Only if you accept | 2 years, per Google's own documentation. |
Technical detail for each cookie
- wos-session: not readable from JavaScript (HttpOnly), SameSite=Lax, scoped to the whole site (Path=/), and marked Secure when the site is served over HTTPS, which is the case in production.
- wv_session: its value is only the character 1 and it carries no personal data. Unlike the one above it is readable from JavaScript, deliberately so: the page itself needs to read it before the first paint. SameSite=Lax, scoped to the whole site (Path=/), and marked Secure when the site is served over HTTPS.
- NEXT_LOCALE: written by the next-intl library. Wayvin only sets its name, so its attributes and its lifetime are the library's defaults.
- wv_consent: its value is only ever the word granted or the word denied, and it holds no personal data. It is readable from JavaScript on purpose, because the page itself has to read it before the first paint so that the notice is never shown to somebody who already answered. It uses SameSite=Lax, its scope is the whole site (Path=/) and it is marked Secure whenever the site is served over HTTPS.
- _ga: written by Google Analytics on the Wayvin domain. Its attributes and its lifetime are set by Google, not by Wayvin. If you refuse analytics it is never set at all.
- _ga_*: written by Google Analytics in the same way as the previous one, and the same caveats apply to it. The real name ends with the Google Analytics data stream identifier. Google Tag Manager, which is what loads analytics, sets no cookie of its own.
When we ask for your consent
The first four cookies in the table are strictly necessary to deliver the service you asked for — keeping your session open, remembering the language you chose, and remembering your own answer to this notice — and that kind of cookie is exempt from the duty to obtain prior consent. The two analytics cookies are not exempt, so they are not set until you accept them: until that moment the browser never even requests Google's script. Accept and reject sit in the same notice, look the same, and are one click each, and refusing limits no part of the site.
Analytics and measurement
Wayvin measures with two different tools, and they are not treated the same way. Cloudflare Web Analytics works without cookies: it stores nothing in your browser, assigns you no identifier and cannot recognise you on a later visit, so it needs no consent and is always on. Google Analytics, which we load through Google Tag Manager, does set the two cookies at the end of the table, which is why it is not loaded until you accept it. Before any Google script arrives, the page declares all four Google Consent Mode permissions denied, including the two advertising ones, which stay denied permanently because Wayvin does no advertising. We use no error-tracking service either. The server's technical logs, described in the privacy policy, use no cookies.
Local storage
Beyond those three cookies, Wayvin stores nothing in your browser's storage: it uses no localStorage, no sessionStorage and no IndexedDB anywhere on the site.
How to control cookies
You can view, block and delete cookies from your browser's settings. Every browser explains how in its own help pages. For analytics you do not need to go that far: the “Cookie preferences” link at the bottom of any page reopens the notice, and you can change your answer there.
Bear the effect in mind: if you block or delete the necessary cookies, your session will end and you will have to sign in again, the site will stop remembering your language, and we will ask you about analytics again. If you delete only the analytics ones, or refuse them, you lose no functionality at all: the site behaves exactly the same.
And the rest of your data
What data Wayvin handles, who else sees it and how to exercise your rights is in the privacy policy.