Storage on this website
This public website uses Cloudflare Web Analytics to measure usage and page performance. Cloudflare states that its analytics beacon does not use cookies or local storage to collect usage metrics. A public-page observation confirmed that the beacon loads; delivery of individual measurements was not verified. PostHog is off on this public website; there is no PostHog consent banner or analytics preference to save. About Cloudflare Web Analytics and how its analytics protect visitor privacy.
Pages keep interface state in your browser: session storage for the current tab, and local storage for examples you work through on workspace pages. Clearing this site's data in your browser removes it. The contact form loads a Cloudflare Turnstile verification check from challenges.cloudflare.com when you start filling it in; it confirms a person is sending the request.
Strictly necessary
These cookies are required for the product to function. Authentication, billing checkout, and theme settings cannot be disabled without breaking core features.
| Cookie | Purpose | Expiry | Flags |
|---|---|---|---|
| gba_rt | Refresh token for authenticated sessions. | 30 days | HttpOnly, Secure, SameSite=Lax |
| gba_signed_in | Client-visible flag indicating an active session. | 30 days | Secure, SameSite=Lax |
| __stripe_mid | Stripe checkout machine identifier. | 1 year | Secure, SameSite=Strict |
| __stripe_sid | Stripe checkout session identifier. | Session | Secure, SameSite=Strict |
| winrove_theme | Light or dark interface preference. | 1 year | Secure, SameSite=Lax |
| cf_clearance | Cloudflare bot protection token. | 30 min to 1 year | HttpOnly, Secure |
Public website analytics
PostHog is off on this public website. Its former analytics cookies, opt-in page-load measurement and consent banner are not part of the current public website package. The package also does not load the former Sentry initializer. These statements do not describe signed-in application behavior.
The hosting platform supplies a Cloudflare Web Analytics beacon. A public-browser observation confirmed that it loads; delivery of individual measurements was not verified. Cloudflare describes its service as measuring usage and page performance without cookies or local storage. This website offers no control that switches that hosted beacon off. Browser tools can block static.cloudflareinsights.com. Read Cloudflare’s description of Web Analytics.
Marketing (opt-in)
We currently set no marketing or retargeting cookies. This category is reserved. If we ever add one (for example, a LinkedIn Insight Tag for retargeting), we will update this policy at least 30 days before activation and require fresh consent.
Third-party
A small number of third parties set cookies inside their embedded surfaces on our pages.
- Stripe: cookies set inside the billing iframe on the /billing page for fraud prevention and session continuity.
- Cloudflare Turnstile: bot-challenge tokens on authentication pages.
- Google Fonts: font caching hints. Fonts are served with no behavioral cookies.
Managing cookies
The Cookie context link opens this notice; it does not save an analytics preference. You can clear and block cookies and site storage in your browser:
California residents can submit a Do-Not-Sell signal at /do-not-sell. We do not sell personal information; the link is provided for CCPA compliance.
No advertising
We run no ad networks, no retargeting, and no social-media tracking pixels on this site today. If that changes, we will update this section and require fresh consent before activation.
Updates
Material changes to this policy will be announced at least 30 days in advance by email to account holders and by banner on the site. The version number and effective date at the top of this document are authoritative.
Contact
Questions about this policy or about a specific cookie set in your browser: hello@winrove.com.
Last reviewed: Sep 2026v1.5 · 8 sectionsThis notice describes the public website. Viewing it does not change account preferences. Historical source text is retained in the source record; the current public-website analytics description above replaces its former PostHog banner instructions.