2. The cookies we set
The cookies Wordfolk sets itself exist to keep you signed in and, if you choose a light or dark display in your settings, to remember it. There are no advertising cookies. The one optional group, for measurement, is described under third-party cookies below and is off unless you accept it.
| Purpose | Category | What it is for | Lifetime |
|---|---|---|---|
| Session | Strictly necessary | Identifies your signed-in session. Without it, signing in would not survive loading the next page. | 7 days |
| Sign-in preference | Strictly necessary | Records that you did not ask to stay signed in, so the session ends when you close the browser. | Until you close the browser |
| Display preference | Functional (a choice you make) | Remembers whether you chose the light or the dark display in your settings, so the page loads the way you left it. It holds one word and is set only when you make that choice. | 1 year |
The first two are set only once you sign in. The display preference is set only when you pick Light or Dark in your settings, and choosing System removes it. Browsing the directory signed out sets none of our own cookies.
We describe these by what they do rather than printing their internal names, which change when the software behind them does. Your browser will show you the exact names and values for this site at any time, under its own storage or cookie settings.
How they are protected
- The two that keep you signed in are marked HttpOnly, so scripts running in the page cannot read them. A cross-site scripting bug could not steal your session this way.
- They are marked Secure in production, so they are only ever sent over an encrypted connection.
- They are marked SameSite=Lax, which blocks them from being sent along with most cross-site requests. Lax rather than Strict deliberately: your session has to survive returning from the payment provider's checkout and following a link from an email we sent you, and Strict would sign you out at both.
In production they also carry a prefix that tells the browser to refuse the cookie outright if it ever arrives over an unencrypted connection.
3. Third-party cookies
Two third parties can set a cookie through Wordfolk. The first is the bot check on our sign-up, password-reset, contact and newsletter forms. It is provided by a specialist supplier, and any cookie it sets belongs to that supplier's own domain rather than ours. Its purpose is to tell a person from an automated script. It is not used for advertising or cross-site tracking, and we receive no profile of you from it.
The check loads only on those four forms. Every other page on the site loads it not at all.
The other is an optional measurement tool from a large third-party provider, which counts visits so we can see which pages get read. It loads only if you accept it on the banner, and nothing is requested from that provider before then. If you accept, its script sets the cookies below on our domain, and it sends the provider the pages you view, your IP address, and details of your browser and device. The provider handles that data under its own privacy policy. We have switched off its advertising features, so it is not used to build an advertising profile of you through Wordfolk.
| Purpose | Category | What it is for | Lifetime |
|---|---|---|---|
| Visitor | Measurement, needs consent | Recognises the same browser across visits, so returning visitors can be told apart from new ones. | 2 years |
| Sessions | Measurement, needs consent | Groups the pages viewed in one visit together. | 2 years |
Beyond those, very little third-party code runs here. There is no advertising network, no social embed and no comment widget, and our fonts are served from our own servers. The one other outside request a page makes is for blog icons and sponsored images, which come from our image host, so that host sees the IP address and browser that asked for them, as any web server would.
4. What we keep in your browser
Three things are kept in your browser's own storage rather than in a cookie. None of them is ever sent to us, and none identifies you.
- A pending action. If you try to save or endorse a blog while signed out, we remember which one while you sign in, and carry it out afterwards so you do not lose your place. It is cleared as soon as it is used, and when you close the tab.
- An administrator's view preference on the audit log page. Only administrators ever have this, and it records a display setting, nothing else.
- Your answers in the Start a blog guide. The guide remembers your answers, where you had got to and which steps you have ticked, so a refresh does not lose your place. The Start over button clears them. If you copy a link to your plan, your answers are written into the link, so share it only with people you are happy to see them.
You can clear all of it at any time by clearing site data for wordfolk.app in your browser.
5. Your choice about measurement
Cookies that are strictly necessary, like the two that keep you signed in, need no consent. The measurement cookies are not necessary, so they are off until you say yes. A banner at the foot of the page asks once, with Accept and Decline given equal weight, and your answer is remembered in your browser. Declining costs you nothing: every part of the site works the same.
You can change your mind at any time, and withdrawing is as easy as agreeing. Declining after you have accepted stops the tool and deletes the cookies it set.
Separately, we use a second measurement tool, from a different third-party provider, that sets no cookie and stores nothing on your device, so it does not need your consent and runs on every page. Your browser does contact that provider's servers to report each page view, so the provider receives your IP address as any server does. Our reports show only the page, the referring site, your browser, operating system and screen size, your language and, where it can tell, your country. It honours the Do Not Track setting in your browser.
6. Controlling cookies yourself
Your browser can block or delete cookies for any site, usually under a Privacy or Site settings menu. Blocking ours has one consequence, which is worth knowing before you do it: you will not be able to stay signed in, so submitting a blog, saving a listing, or buying a placement will not work.
Browsing, searching and reading the directory work perfectly well with cookies blocked, because none of it needs an account.
Signing out clears your session cookies immediately. Changing your password clears every other session's as well.
7. Changes to this policy
If the cookies we set change, this page changes with them, and the date at the top will move. A change that introduced a new cookie needing consent would be announced before it took effect, not after.
8. Contact
Questions about cookies or anything else on this page: hello@wordfolk.app.