We follow GDPR/ePrivacy and § 25 TDDDG: essential technologies run without consent, while device access for diagnostics, session replay, marketing pixels and paid attribution starts only after your cookie-banner choice.
1. What counts as cookies
By cookies we mean cookies and similar technologies: localStorage, sessionStorage, SDKs, pixel tags and scripts that store information on your device or read it from your device.
2. Categories
Essential — always active
sb-*-auth-token— Supabase Auth user session; required for login and account security.app-language— selected UI language.wtfb_consent_v3— your category-level cookie choices.- Stripe
__stripe_*— payment-form security; loaded only during checkout/top-up. - Cloudflare
cf_*— bot/DDoS protection and domain stability.
Cookieless analytics — always active
Plausible Analytics is used for aggregated visit statistics without cookies and without advertising profiles. We do not store UTM/gclid/fbclid attribution until you give marketing consent.
Diagnostics — consent only
- Sentry — frontend errors and Session Replay; inputs, passwords and sensitive text are masked.
- Datadog RUM + Logs — performance, logs and session replay for debugging; EU region when configured.
Marketing — consent only
- 30-day attribution in localStorage —
wtfb_attr_v1(UTM, gclid, fbclid, ttclid, referrer). - Meta Pixel —
_fbp,fr - Google Ads / GA4 —
_ga,_gid,_gcl_* - TikTok Pixel —
_ttp - Reddit, LinkedIn, X, Microsoft/Bing, Pinterest or Snapchat may be added later only in this category and only after marketing consent.
3. Legal basis and retention
- Essential — § 25(2) TDDDG and Art. 6(1)(b)/(f) GDPR; kept for the session or as long as needed for the selected function.
- Diagnostics and marketing — Art. 6(1)(a) GDPR and § 25(1) TDDDG; consent remains valid until withdrawal or a policy update.
4. Managing and withdrawing consent
You can change or withdraw consent at any time via the 'Cookie settings' link in the footer. Refusal is as easy as consent: 'Reject all', 'Save choices' and 'Accept all' are available in the same banner. You may also delete wtfb_consent_v3 and wtfb_attr_v1 in localStorage; blocking essential cookies may break account and payment functionality.
5. Contact
Cookies / Privacy: [email protected]