What we set
| Cookie | Category | Set by | Expires | What it does |
|---|---|---|---|---|
| sb-<project>-auth-token | Strictly necessary | Supabase Auth | Until you sign out | Keeps you signed in. Holds the session token; without it every page load would ask for your password. May be split across numbered cookies when the token is long. |
| NEXT_LOCALE | Functional | Weekwright | 1 year | Remembers whether you chose English or Spanish, so the app does not reset to English on every visit. |
| ph_<key>_posthog | Analytics | PostHog | 1 year | Distinguishes one visit from the next so we can see which features are used and where people get stuck, and on the public pages only, records the session so we can watch where a page loses people. Recording stops the moment you enter the app. Never receives the content of your schedules, your notes, or anything you type to the AI. |
| _clck | Analytics | Microsoft Clarity | 1 year | Remembers this browser between visits to the public pages, so two visits are not counted as two different people. Set only on the marketing site — never inside the app. |
| _clsk | Analytics | Microsoft Clarity | 1 day | Groups the pages you view in one sitting into a single session, so we can see where a page confuses people. Set only on the marketing site — never inside the app. |
| _gcl_au | Advertising | Google Ads | 90 days | Lets us count how many people who arrived from one of our ads went on to create an account, without knowing who you are. It measures the ad; it does not build a profile of you or follow you to other sites. |
| _gcl_aw | Advertising | Google Ads | 90 days | Set only if you arrived by clicking one of our ads: it stores that click's id so the signup can be matched back to the ad that produced it. Nobody who arrives from a search result or a link ever gets this one. |
| _uetsid | Advertising | Microsoft Advertising | 1 day | Groups the pages you view in one sitting into a single visit, so a signup can be tied to the visit that produced it rather than counted on its own. |
| _uetvid | Advertising | Microsoft Advertising | 13 months | Recognises this browser between visits so two visits are not counted as two different people. It measures the ad; personalised advertising is not switched on for this account. |
| _uetmsclkid | Advertising | Microsoft Advertising | Up to 90 days | Set only if you arrived by clicking one of our ads on Bing: it stores that click's id so the signup can be matched back to the ad that produced it. Nobody who arrives from a search result or a link ever gets this one. |
PostHog also uses your browser's local storage alongside its cookie. Clearing site data removes both.
What the banner does, and who sees it
The two cookies the product needs to work — signing you in, remembering your language — are set either way. You cannot stay signed in without a session cookie, and consent is not required for those anywhere.
The banner is shown to visitors in the European Economic Area, the United Kingdom and Switzerland, where the law requires us to ask before analytics or advertising storage is written. Everywhere else it is not shown and both run on our legitimate interest in knowing which features get used and which ads pay for themselves — with the same off switch below, which works from anywhere. If we cannot tell where a request came from, we treat it as needing consent and ask.
The other five are different: none of them is written until you accept. Not when the page loads, not while the banner is on screen. If you refuse, or simply never answer, no analytics or advertising script is loaded at all — so there is nothing running in the background waiting to be told to stop.
Rejecting takes exactly one click, the same as accepting, and there is no way to dismiss the banner without answering — closing a dialog is not agreement, and we would rather ask twice than assume. If you change your mind, the switch below does the same job in the other direction and clears the cookies that were already set.
This is a change. Weekwright previously ran analytics under legitimate interest with no banner, on the reading that it is offered in the United States (Terms §1) and set no advertising cookies at all. The pages you are reading are public and reachable from anywhere, including a Spanish edition, so we now ask rather than assume — and now that we measure whether our ads work, there is a second reason to.
Turning it off
This setting applies to this browser and persists across visits, and it covers all five: the three analytics cookies and the two advertising ones. One switch, because one yes-or-no is the only thing we would want to defend putting in front of you.
Analytics is off for this browser.
We also honour Global Privacy Control and Do Not Track. When your browser sends either, neither analytics nor the advertising tag is initialised — no cookie is written and no request is made, so there is nothing to opt out of afterwards. This is enforced by a test, not by intention.
You can also block or delete cookies in your browser settings. Deleting the session cookie signs you out; deleting the language cookie resets the app to English.
Changes
If we add a cookie, it appears here before it ships, and this page is the authoritative list. The Privacy Policy covers everything else we do with data, and the subprocessors page lists who receives it.
Contact
Questions: privacy@weekwright.com.