Cookie Policy

The first time you visit, a banner asks what you allow, with two separate choices: Analytics and Advertising. Both are off by default — declining is as easy as accepting, and the site works fully either way. You can change or withdraw your choice at any time with the "Cookie settings" button in the footer and at the bottom of this page. We store your choice with a timestamp and the policy version it was given under.

These are required for the site to work and don’t track you. They are set regardless of your consent choice, because without them the site cannot remember your basic preferences:

• cookie-consent (localStorage, kept until you clear it) — remembers the consent choices you made, so we don’t ask on every visit.
• lang (cookie, 1 year) — remembers whether you are reading the site in English or Spanish.

None of these exist unless you accept analytics — before that, we set nothing and send no analytics events at all:

• _ga, _ga_* (cookies, up to 2 years) — Google Analytics 4, used to distinguish visitors and measure how the site is used, with IP anonymization enabled.
• waco3_visit_count, waco3_last_visit, waco3_last_page (localStorage, kept until you clear them) — count how many times you have visited, when you last did, and the last page you were on, so we can tell first-time visits from returning ones.
• waco3_session_start (sessionStorage, current tab session only) — timestamps the start of your visit so we can measure how long a session lasts.
• waco3_utm (sessionStorage, current tab session only) — remembers which campaign or referral brought you here so we can attribute signups to the right source. Ad-click identifiers (gclid, fbclid) are only included if you have also accepted advertising.

Only active if you accept advertising: Google advertising signals (ad_storage, ad_user_data, ad_personalization) used to measure our marketing campaigns and, where consented, show relevant ads on other sites. Declining advertising — or sending a GPC signal — keeps all three off.

We load Google Analytics with Consent Mode v2 set to "denied" as the very first instruction, before any other analytics command runs. In the denied state, Google sets no cookies, and our site sends it no analytics events. Google may still receive the minimal technical information any web request carries, which it uses for aggregate modeling. Cookies and identifiable measurement begin only after you accept. We spell this out because "nothing happens at all" would be almost true — and almost true isn’t good enough for a privacy page.

If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of advertising: advertising signals stay off even if you choose "Accept all", and the banner tells you so and shows the advertising option as unavailable. Analytics remains your choice.

This page covers the waco3.io website. The Waco3 application sets its own storage, and the rules there are different because you are signed in and using a paid service rather than browsing a marketing page:

• Authentication cookies — a short-lived access token (15 minutes), a refresh token (30 days) and a CSRF token. All are strictly necessary; without them you cannot stay signed in.
• Cloudflare Turnstile — bot-protection cookies on the sign-up and sign-in pages.
• PostHog (ph_* cookies and localStorage) — product analytics and error monitoring, which run as part of the Service rather than behind the website banner. They are never used for advertising. Everything you type is masked in session recordings, the document canvas is blocked from recording entirely, and none of this runs on the pages your clients see.

Privacy Policy section 6 explains this in full.

Beyond our banner, every browser lets you view, block, and delete cookies and site data in its settings. Clearing the site’s storage makes the banner ask again on your next visit.

If we add or change cookies or storage, we update this page and bump its policy version, which makes the banner ask for your consent again. This policy is part of our Terms of Service. Questions? Email [email protected].