Cookie Policy - Woberry Data Privacy

1. About this policy

This Cookie Policy explains how Woberry AB (org. nr 559474-0267) uses cookies and similar technologies on woberry.com, and how you can control them. It should be read together with our Privacy Policy, which explains how we handle personal data in general.

2. What cookies and similar technologies are

Cookies are small text files that a website stores in your browser. Similar technologies include local storage, session storage, pixels and scripts that read or store information on your device. In this policy, "cookies" covers all of them.

Strictly necessary cookies are needed to provide a service you ask for, such as staying signed in, so they don't require consent. All other cookies are used only if you consent.

When you first visit woberry.com, a cookie banner lets you accept all cookies, reject all optional cookies, or choose by category (analytics and marketing). Rejecting is as easy as accepting. Analytics and marketing tools load only after you consent to their category.

We store your choice in the woberry_consent cookie for 12 months. After that, we ask you again.

You can change or withdraw your consent at any time with the "Cookie settings" link in the footer of every page. If you withdraw consent, we stop using those tools and delete the PostHog, Meta and Google cookies set on woberry.com. Cookies that Meta or Google set on their own domains can only be deleted in your browser (see section 6).

We use Google Consent Mode v2. Every consent type is set to "denied" by default, and Google's tag loads only after you consent to marketing cookies.

The Meta Pixel never runs on account, login or dashboard pages, even if you have consented.

Sentry error monitoring runs without consent, because we need it to keep the service working. It sets no cookies. Sentry performance monitoring and Session Replay run only if you consent to analytics.

Strictly necessary (always on)
Name	Provider	Purpose	Duration
session	Woberry	Keeps you signed in (login token)	24 hours, renewed while you're active
next-auth.session-token, next-auth.csrf-token, next-auth.callback-url (with a __Secure- or __Host- prefix on HTTPS)	Woberry	Used when you sign in with Google or LinkedIn, to complete the sign-in securely	24 hours, or until you close your browser
woberry_consent	Woberry	Remembers your cookie choices	12 months
sidebar:state	Woberry	Remembers whether the dashboard sidebar is open	7 days
theme, email_banner_dismissed, woberry_desktop_popup_shown, marketingBannerShown-<id> (local storage)	Woberry	Remember interface preferences, such as light or dark mode and banners or pop-ups you've already seen	Until you clear them
__stripe_mid	Stripe	Fraud prevention. Set only if Stripe's payment script loads on one of our payment pages. Checkout currently takes place on Stripe's own pages, so normally this cookie is set on stripe.com	1 year
__stripe_sid	Stripe	Fraud prevention, set in the same way as __stripe_mid	30 minutes

Analytics (only with your consent)
Name	Provider	Purpose	Duration
ph_<key>_posthog (cookie and local storage), __ph_opt_in_out_<key>, ph_* (session storage)	PostHog (EU Cloud)	Product analytics: tells visits and sessions apart so we can see how Woberry is used and improve it. If session recording is turned on in PostHog, it also records how pages are used. __ph_opt_in_out_<key> stores your analytics choice	1 year (cookie and local storage); until you close the browser tab (session storage)
Vercel Web Analytics	Vercel	Counts page views without cookies	No cookie is stored
sentryReplaySession (session storage)	Sentry	Session Replay: records about 10% of sessions, and every session where an error occurs, to help us find and fix bugs	Until you close the browser tab

Marketing (only with your consent)
Name	Provider	Purpose	Duration
_fbp, _fbc	Meta (Meta Pixel)	Recognise your browser and store the ad click ID when you arrive from an ad on Meta, so that Meta can measure and deliver our ads	90 days
fr (on facebook.com)	Meta	Third-party advertising cookie set by Meta on its own domain	90 days
_gcl_au, _gcl_aw	Google (Google Ads)	Measure sign-ups and purchases that come from our Google Ads, and store the ad click ID	90 days
Google cookies such as IDE (on doubleclick.net)	Google	Third-party advertising cookies set by Google on its own domains	Up to 13 months

5. Third-party services

Some services set their own cookies on their own websites under their own policies, for example Stripe's checkout pages and the Google and LinkedIn sign-in pages. When you accept marketing cookies, Meta and Google may also use cookies on their own domains to measure our ads.

Some of these providers process data outside the EU/EEA. Sections 8 and 9 of our Privacy Policy explain who receives data and how transfers are protected.

6. Managing cookies in your browser

As well as using "Cookie settings", you can block or delete cookies in your browser settings. Your browser's help pages explain how. If you block strictly necessary cookies, you won't be able to sign in or pay.

7. Changes and contact

We update this policy when the cookies we use change, and the date at the top shows the latest change. If we add cookies that need consent, we'll ask for your consent again.

Questions? Email support@woberry.com or write to Woberry AB, Träkilsgatan 50 Lgh 1201, 416 50 Göteborg, Sweden.