Última actualización: 17/10/2026
Preliminary document — pending legal review. It describes the cookies and equivalent technologies Weko actually loads, including analytics, which is only activated if you accept it.
A cookie is a small file stored on your device when you visit a website that lets us remember information about your visit. Similar technologies, such as browser local storage (localStorage/sessionStorage), serve equivalent purposes and are covered by this policy in the same way.
These are essential for the service to work, or they remember a choice you made yourself. They are set without needing your consent.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Session cookie (Laravel/Sanctum) | Strictly necessary | Keep the authenticated user session | Session |
| XSRF-TOKEN | Strictly necessary | Protection against CSRF attacks | Session |
| settings (light/dark) | Preferences (localStorage) | Remember the chosen theme | Persistent |
| i18nextLng | Preferences (localStorage) | Remember the chosen language | Persistent |
| weko_lang | Preferences (first-party cookie) | Remember the chosen language so pages open directly in it | 1 year |
| wd-cookie-consent | Strictly necessary (localStorage and a weko.app cookie) | Remember whether you accepted either category (analytics and/or advertising) or neither. The cookie copy, shared by weko.app and app.weko.app, makes your choice follow you when you sign up and enter the app, without asking again | 1 year |
| wd-cookie-consent-meta | Strictly necessary (localStorage) | Record WHAT you chose for each category (analytics, advertising) and against which version of this policy, so the choice can be evidenced | Persistent |
| action_tracking_session_id | Strictly necessary (first-party sessionStorage) | Identify your session while you are signed in, to record on our own servers which screens and features you use and to provide you with the service. Not sent to third parties | Session (deleted when the tab is closed) |
| wk_attr / wk_attr_expires | Analytics (localStorage; only if you accept analytics or advertising) | Remember the origin of your visit (utm_source/utm_medium/utm_campaign, or the click identifier gclid/fbclid) so we can attribute your signup to the right channel if you come back another day. Without your consent nothing is stored on your device: the origin lives only in the tab's memory while it is open. Weko's own storage: not sent to Google or Meta on its own; what they receive and when is explained in section 4 | 90 days (with consent); otherwise only while the tab is open |
| wk_outreach | Analytics (localStorage; only if you accept analytics or advertising) | Remember the identifier in the link of a Weko email (the "ref" parameter of the link) to know which email brought the visit or the signup. Without your consent nothing is stored on your device: the identifier lives only in the tab's memory while it is open. Weko's own storage: not sent to Google or Meta | 30 days from the last click on an email, or until you create your account with the signup form if that comes first (with consent); otherwise only while the tab is open |
Weko uses PostHog for product analytics. PostHog automatically records the pages you visit and your interactions with the interface (clicks, form submissions and navigation) and ties them to an identifier for your browser, so it can tell sessions and returning visitors apart. This is more than a visit count: it allows analysis of how the service is used.
Analytics is not loaded by default. Until you accept, the script is not downloaded and no data is sent to PostHog. If you reject it, any leftover "ph_" cookies from earlier visits are also deleted.
What you decide on the Weko website (weko.app) also applies when you sign up and use the app (app.weko.app): we do not ask you again. If you accepted analytics, it stays active there, and the analytics cookie is shared between the two sites so we can tell you are the same person who arrived from the website. When you sign in, PostHog links your browser to your internal account number — never to your email or name — and forgets it when you sign out. The page addresses PostHog receives are sent without whatever follows "?" or "#" (except advertising campaign parameters such as utm_ or gclid) and with the code in single-use links, such as password reset, masked; so they carry neither your email nor keys. If you reject or withdraw it in "Cookie preferences", it stops on both sites.
Session recording: only if you accept analytics, PostHog records your journey through Weko — the screens you see, where you click and the texts of the interface — so we can understand what is hard to use and improve the product. What you type into forms is not recorded, and tables, record sheets and lists with customer or employee data appear covered. The browser's internal messages are not recorded either. If you are signed in, the recording is tied to your account number. If you reject analytics or withdraw your consent, recording stops.
PostHog processes this data on behalf of Weko, as a data processor, on infrastructure hosted in the United States. Accepting analytics therefore involves an international transfer of data outside the European Economic Area. [PENDING: state here the applicable safeguard — standard contractual clauses or certification under the EU-US Data Privacy Framework — once the data processing agreement with the provider is signed.]
| Name | Type | Purpose | Duration |
|---|---|---|---|
| ph_<key>_posthog (cookie and localStorage) | Analytics (third party: PostHog, USA) | Identify the browser across sessions and group usage events | Up to 12 months (provider default) |
| oh_initial_referrer / oh_initial_landing | Analytics (localStorage) | Remember where you first arrived from, to attribute the source of the visit | Persistent |
Weko's pages use the Google Ads tag, Google's advertising tool. It is used to find out whether people who reach Weko from an ad end up signing up and, only if you accept advertising, to show Weko ads again to people who have already visited us (known as "remarketing").
If you accept advertising, Google stores in your browser the cookies listed in the table below, whose names start with "_gcl_", and can link your visit to the ad you clicked. If you accepted it and later withdraw it from "Cookie preferences", the tag stops using those cookies and the "_gcl_" cookies it had stored are deleted from your browser.
If you do not accept it, none of those cookies is set in your browser and Google receives no identifier of yours. The tag is still loaded, though: the website sends Google cookie-free pings that carry only what any internet connection carries — your IP address and the address of the page you visit, including any codes the ad link brings — and what happens on it, for example that someone has signed up. It is set up so that Google uses them only to estimate, in aggregate, how many visits from ads end in a signup, and not to personalise ads. Meta receives nothing if you do not accept.
To show you ads on other websites, Google may also use its own cookies, stored under its own websites (such as google.com or doubleclick.net) rather than Weko's. Those cookies belong to Google and are governed by its policy (policies.google.com/technologies/cookies); Weko cannot see or delete them. You can manage them at myadcenter.google.com or from your browser settings.
If you sign up or take out a subscription after arriving from a Google or Meta (Facebook/Instagram) ad, and only if you accept this category or tick the box when signing up, Weko shares with that network the click identifier (e.g. "gclid" or "fbclid") and the fact that a signup or a purchase happened and, for a purchase, its amount, its currency and its date, so the advertiser can measure how their ad performed. Your name, email or phone number is never shared — only the click identifier (which the network already knew because it generated it) and the data of that signup or purchase.
This lets Google and Meta measure their campaign performance and lets Weko decide where to invest in ads. You can withdraw consent at any time from "Cookie preferences"; from that moment nothing new is shared (what was already shared cannot be retroactively undone on the network's own platform).
Origin of your signup. If you have accepted analytics or advertising, Weko stores in your browser (`wk_attr`, see section 2) the origin of your visit — a utm parameter or a click identifier — for 90 days, so it can attribute your signup to the right channel even if you come back another day. If you have accepted neither, Weko stores nothing on your device: the origin carried by the ad link is kept only in the tab's memory and travels in the address of Weko's links up to the signup form. When you sign up, Weko saves it in its own database, next to your account, to know which channels bring customers; it is not sent to Google or Meta that way. You can also tell us, voluntarily, how you heard about us when signing up.
Weko email. If you arrive from a link in a Weko email, the link carries an identifier (`ref`). If you have accepted analytics or advertising, Weko stores it in your browser (`wk_outreach`, see section 2) for 30 days from your last click (or until you create your account with the signup form, if that comes first), to know which email brought your visit or signup. If you have accepted neither, nothing is stored on your device: it is kept only in the tab's memory and travels in the address of Weko's links up to the signup form. Weko uses it in its own database and does not send it to Google or Meta; the Google tag receives the page address without that identifier.
Legal basis: your explicit consent (GDPR art. 6.1.a) for the "_gcl_" cookies, for remarketing and for sharing the click identifier with Google or Meta. The cookie-free pings sent to Google even if you do not accept advertising rely on Weko's legitimate interest in measuring in aggregate whether its ads work (GDPR art. 6.1.f); you can object by writing to [email protected]. Saving in our database, when you sign up, the origin of your visit and what you tell us about how you heard about us relies on Weko's legitimate interest in knowing which channels bring customers (GDPR art. 6.1.f); it is not shared with third parties and you can object by writing to the same address. Without your consent, Meta receives nothing.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Advertising (Google Ads, stored on Weko's website) | Recognise your browser across visits, to link your visits to Weko with a later signup | 90 days |
| _gcl_aw | Advertising (Google Ads, stored on Weko's website) | Store the click code when you arrive from a Google ad, to find out whether that click ended in a signup | 90 days |
| _gcl_gb / _gcl_ag | Advertising (Google Ads, stored on Weko's website) | Same as _gcl_aw when Google uses a different kind of click code, for example when the ad is opened on an iPhone or iPad | 90 days |
Pages load the site typeface from fonts.googleapis.com and fonts.gstatic.com. That request sets no cookies, but it does disclose your IP address to Google, which serves the file. Weko does not use it for advertising or profiling. Self-hosting the typeface, to remove that disclosure, is still pending.
The first time you visit, a notice shows two independent checkboxes — "Analytics" and "Advertising" — and three buttons with the same visual weight: "Reject all" (unchecks both), "Save selection" (respects exactly what you checked in each box, e.g. analytics yes and advertising no) and "Accept all" (checks both). Rejecting is as easy as accepting and has no effect on how the service works.
You can change your choice at any time from the "Cookie preferences" button on this page, which reopens the same notice with your current choice reflected in the checkboxes. If we materially change what is loaded, or ask about a new category, you will be asked again.
You can also delete cookies and local storage from your browser settings. Note that deleting the strictly necessary cookies may prevent you from signing in or using the application correctly.
For any question about this cookie policy you may write to [email protected].