Last updated: 29 October 2026

Cookie Notice Consent policy 2 · 29 October 2026

1. Your choice

WorldFolder only uses what is strictly necessary until you choose otherwise. The cookie banner offers Reject all and Accept all as equal buttons, and Choose lets you switch each optional category on or off separately. You can change or withdraw your choice at any time: use Cookie settings in the footer of every page, or Settings → Privacy & cookies in your dashboard. Withdrawing stops future collection and deletes the corresponding optional data stored in your browser. It does not by itself erase events or recordings already received by PostHog; their retention and your right to request erasure are described below and in the Privacy Policy.

A Global Privacy Control or Do Not Track signal overrides a saved analytics or replay opt-in. The only exception is if you expressly confirm the separate, tab-only help option in section 6, including an additional confirmation to override your browser signal.

When you are signed in, we also store your choice with your account (the three on/off values, this consent-policy version, a fingerprint of this notice, where you made the choice and the time). This lets your choice follow you to other devices and lets us show that consent was given. These records are deleted with your account. The tab-only help choice in section 6 is separate and does not change or sync your saved choices.

2. Strictly necessary (always on)

These are needed to provide the service you request and are allowed without consent under § 25 (2) No. 2 TDDDG.

Sign-in and session cookies set by Clerk (for example __session and __client_uat) keep you signed in.
Security cookies set by Cloudflare (for example __cf_bm) and the Turnstile bot check protect sign-up, checkout and forms.
Payment cookies set by Stripe on its own checkout pages.
wf-consent in localStorage remembers your cookie choice until it is replaced or you clear site data. We ask again when the consent-policy version changes. An older wf-storage-consent value is read once and then removed.

3. Preferences (optional)

With your consent, localStorage remembers your theme (wf-theme), new-world defaults (wf-world-defaults) and access-list drafts (wf-access-lists-…) until you withdraw preference consent, clear site data or the site replaces them. sessionStorage remembers the world you last selected for the browser tab and is cleared when that tab closes, or earlier if you withdraw preference consent or clear site data.

4. Analytics (optional)

With your consent, we use PostHog (PostHog Inc., data stored in PostHog EU Cloud in Frankfurt, Germany) to find broken buttons, stuck steps and errors. PostHog stores a random visitor and session id in localStorage and sessionStorage under keys starting with ph_, your browser loads PostHog's project settings from eu-assets.i.posthog.com and sends events to eu.i.posthog.com:

pages viewed, without query strings or fragments;
clicks, repeated "rage" clicks and clicks that did nothing, described by the element's position and type — not its text;
JavaScript errors shown by your browser;
steps in key flows (sign-up, creating and starting a world, checkout, upgrade prompts), with a short reason code when something fails;
browser, operating system and screen size, and the approximate location PostHog derives from your IP address;
after you sign in, your WorldFolder account id — never your email address or name.

Analytics identifiers in localStorage remain until consent is withdrawn, site data is cleared or the SDK replaces them. Values in sessionStorage last for the browser tab and are removed earlier if you withdraw consent or clear site data.

The legal basis is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG). PostHog acts as our processor. We use PostHog Cloud's Free plan, with a one-year retention window for events. A reporting window is not a guarantee that all underlying copies are physically erased on its last day. You can ask us to delete personal analytics data using the contact in the Privacy Policy.

5. Session replay (optional, needs analytics)

With your separate consent, PostHog also records how the dashboard and world pages react while you use them, so we can see where a flow got stuck. On every recording, all text and every form input are hidden, and profile pictures and secret values such as tokens and keys are left out completely. No console output or network traffic is recorded. Pages outside the dashboard and world pages are never recorded. On our Free plan, recordings expire after at most 30 days. PostHog notes that deletion can take a short time after expiry.

6. Help with a problem (optional, this tab only)

After an error or in the report dialog, you can separately allow analytics and session replay to help us understand the problem. This enables the same PostHog events and masked recordings described in sections 4 and 5 for the current tab. Recordings remain limited to dashboard and world pages; analytics may also run on other pages you visit in that tab. Sending a support report never depends on your choice.

The permission is stored in sessionStorage as wf-session-help; declining the prompt is remembered as wf-session-help-declined. Both last until the tab closes or the site clears them. This choice is not saved to your account or shared with other tabs. If your browser sends a privacy signal, we ask you to confirm the override before enabling either analytics or replay.

Use Turn it off in the help prompt to end this permission, or withdraw analytics and replay under Cookie settings. Ending this permission leaves your saved cookie choices in place. Closing the tab ends future collection under this permission; it does not erase events or recordings already sent to PostHog.

7. What we do not use

WorldFolder does not use advertising cookies, cross-site tracking pixels or social-media embeds.

More about how we process personal data: Privacy Policy.