| Name | Purpose | Set when | Lifetime | Type |
|---|---|---|---|---|
| session | Keeps you signed in between page loads. Without it you would have to re-enter your password on every request. | Only when you log in | 30 days, or until you log out | Strictly necessary |
It is HttpOnly (JavaScript cannot read it), Secure (HTTPS only), SameSite=Strict (never sent from another site), and scoped to wstonks.app. It contains an opaque session token — not your email, not your password, and nothing about your browsing.
If you never create an account, WStonks sets no cookies at all.
Two small values are kept in your own browser rather than as cookies. They never leave your device and are never sent to us:
| Key | Storage | Purpose |
|---|---|---|
| wstonks-disclaimer-v2 | localStorage | Remembers that you dismissed the first-visit disclaimer, so it does not reappear on every page load. |
| cf-exits | localStorage | Remembers your own entries in the position planner tool. |
You can clear both at any time through your browser’s “clear site data” setting. Clearing them only means the disclaimer shows again and the planner forgets your entries.
We use Cloudflare Web Analytics to count page views. We chose it specifically because it is cookieless: it sets no cookie, uses no fingerprinting, assigns no persistent identifier, and does not follow you to other sites.
It tells us how many people opened a page. It does not tell us who you are, and we perform no individual-level behavioural analysis. See cloudflare.com/web-analytics.
For completeness, none of the following exist anywhere on WStonks:
Our Content-Security-Policy enforces this at the browser level, not just as a promise: scripts may load only from our own origin and Cloudflare’s analytics endpoint, and everything else is blocked.
Consent is required for cookies and storage that are not strictly necessary — advertising, profiling, cross-site tracking. We use none of those.
The session cookie is strictly necessary for a service you explicitly asked for by logging in. The two localStorage values are functional and stay on your device. Cloudflare Web Analytics stores nothing on your device at all. That leaves nothing to ask consent for.
If that ever changes — if we add anything that tracks you — we will ask you first, properly, before it loads. We will not bury it in a pre-ticked box.
You can block or delete cookies in your browser settings. If you block the session cookie you can still read essentially all of WStonks — briefs, signals, charts and the public record are all available without an account — but you will not be able to stay logged in or use the Ledger app.
If we change what we store, we will update this page and its effective date. Material changes will also be noticed on the site.
Questions about cookies or anything on this page:
Email: hello@wstonks.app
Response time: typically within 7 days.
See also: Privacy Policy · Terms of Use