Cookie policy

Cookies we set

All of these are strictly necessary for a service you asked for, so under §89(3) of Act No. 127/2005 Sb. (which transposes Art. 5(3) of Directive 2002/58/EC) none of them requires consent. Every one is HttpOnly, Secure and SameSite=Lax - script on the page cannot read them.

• waos-locale - records which language the site rendered for you. Set on the first page you open without it, or when you save a language preference; it lives one year from the most recent write. This site is published in one language (English), so there is nothing to switch to. Clearing or expiring the cookie lets the server set it again.
• __Secure-better-auth.session_token - the sign-in session issued by our authentication layer when you sign in. Lives seven days; cleared when you sign out. It is what keeps you signed in - without it the app cannot work.
• __Secure-better-auth.session_data - a short-lived, signed cache of your session that spares a database read on each request. Lives one minute; on larger sessions it may split into numbered parts (.0, .1).
• __Secure-better-auth.dont_remember - set only if you untick "remember me" at sign-in; tells us to end your session when the browser closes. A session cookie, gone when the browser is.
• __Secure-better-auth.state - set only during a Google sign-in, and only where Google sign-in is configured, to protect the sign-in round-trip against forgery. Lives five minutes.

localStorage and sessionStorage

The same law covers these, and the same exemption applies: each key stores a choice you made or carries out something you asked for, on your device, readable by this site only.

• waos-analytics-consent - your answer on the cookie banner (allowed or rejected), so it is not asked again on every page. Stored only once you answer.
• waos-theme - your colour-theme choice.
• waos-tour-seen - that you have finished (or dismissed) the first-run tour, so it does not replay.
• waos-getting-started-dismissed - that you closed the getting-started checklist.
• waos-claim-teaser - carries a free-scan result into a new account so the scan you already ran appears there; deleted the first time it is read.
• waos-pending-terms - records that you accepted the terms on the sign-up page before leaving for Google's sign-in, so the acceptance can be recorded to your new account; read and removed on your first app load.
• better-auth.message - lets your other open tabs notice a sign-in or sign-out so they all agree on who is signed in.
• tsr-scroll-restoration-v1_3 (sessionStorage) - your scroll positions per page, so the back button returns you where you were; gone when the tab closes.

Analytics cookies, only with your consent

We use Google Analytics 4 to count visits to our public pages and see how people use them. It is not strictly necessary, so it needs your consent under §89(3): the script does not load and these cookies are not set until you choose Allow analytics on the cookie banner. No thanks is one click, the same as Allow.

With your consent it records each public page you view, and Google's enhanced measurement adds what happens on it: scrolling to the end of the page, clicks on links that lead to other sites (with that link's address), file downloads, starting and submitting a form (the form's name and where it sends, never what you type into it), plays of embedded videos, and a search term if the page address carries one.

It also counts three steps you start on a public page: that a free scan was started (never the address you entered), and that you followed a link to sign-up or to checkout, with the plan and billing period that link carries. Whether you then finish signing up or paying is not measured.

Pages inside the app, sign-in and sign-up, checkout, and links that carry a token (shared reports, invitations) are never measured, even with consent. Google signals and ad personalisation are switched off, and the address of the page you are on is sent with its query string removed.

• _ga - set by Google Analytics on this domain to tell one browser from another. Lives two years.
• _ga_J45CY9BDBZ - set by Google Analytics on this domain to keep the state of your current visit. Lives two years.

Your cookie choice

Cookie settings in the footer of every page reopens the banner, so you can change your answer at any time. Withdrawing stops measurement straight away and deletes both _ga cookies from this site; it does not affect what was measured before.

Third parties

Cloudflare's Turnstile - the bot check on the free-scan form - loads only on the homepage, from challenges.cloudflare.com, and only to tell people from bots; it is what lets the form work without a CAPTCHA puzzle.

Google Analytics - only after you allow it. It loads from www.googletagmanager.com and sends public-page views to Google's collection servers. Google Ireland Limited processes this data for us under Google's data processing terms; Google may transfer it to the United States under the EU-US Data Privacy Framework.

Sentry - error reporting. It runs without asking for consent because it is necessary to operate this service and keep it secure. On an error, your browser sends the error message and stack trace, browser and operating-system details, the page address without its query string, and preceding page addresses in the same tab. Sign-in and reset tokens are scrubbed. What you type into forms is never included. Console messages, clicks and network requests are excluded from breadcrumbs. No IP address or account identity is stored with the report. Sentry processes reports in its EU region (Frankfurt) and is named at /legal/subprocessors. Without an error it sends nothing, sets no cookie and writes nothing to localStorage, sessionStorage or any other browser storage.

Payment happens on Stripe's own checkout pages, not on this site: no Stripe script loads here, so Stripe's cookies exist only on Stripe's domain, under Stripe's cookie policy.

What we do not set

• No analytics before you allow it, and none inside the app at any time
• No third-party advertising or retargeting pixels, and no Google signals or ad personalisation
• No cross-site tracking, no data brokerage, no fingerprinting fallback

Clearing them, and asking about them

Signing out clears the session cookies. Everything else can be removed in your browser's site-data settings at any time; the only consequences are being signed out and the interface forgetting your theme and tour choices, and the cookie banner asking again.

Questions about this policy go to [email protected].