Your browser choices, clearly explained.
Understand necessary storage and make optional choices deliberately.
Storage on this website
This public website uses Cloudflare Web Analytics to measure usage and page performance. Its analytics beacon does not use cookies or local storage to collect usage metrics. About Cloudflare Web Analytics and how its analytics protect visitor privacy.
Pages keep interface state in your browser: session storage for the current tab, and local storage for examples you work through on workspace pages. Clearing this site's data in your browser removes it. The contact form loads a Cloudflare Turnstile verification check from challenges.cloudflare.com when you start filling it in; it confirms a person is sending the request.
Historical cookies statement bound into the approved notice composition.
Strictly necessary
These cookies are required for the product to function. Authentication, billing checkout, consent persistence, and theme settings cannot be disabled without breaking core features.
| Cookie | Purpose | Expiry | Flags |
|---|---|---|---|
| gba_rt | Refresh token for authenticated sessions. | 30 days | HttpOnly, Secure, SameSite=Lax |
| gba_signed_in | Client-visible flag indicating an active session. | 30 days | Secure, SameSite=Lax |
| __stripe_mid | Stripe checkout machine identifier. | 1 year | Secure, SameSite=Strict |
| __stripe_sid | Stripe checkout session identifier. | Session | Secure, SameSite=Strict |
| winrove_cookie_consent | Stores your cookie banner preferences. | 1 year | Secure, SameSite=Lax |
| winrove_theme | Light or dark interface preference. | 1 year | Secure, SameSite=Lax |
| cf_clearance | Cloudflare bot protection token. | 30 min to 1 year | HttpOnly, Secure |
Analytics (opt-in)
Analytics cookies are set only after you accept them in the banner. We use PostHog for product analytics. Session replay is disabled by default. We also take a first-party page-load measurement, which reports timing figures such as how long the page took to load and become usable. It sets no cookie and stores nothing on your device, so it has no row in the table below, and it waits for your acceptance exactly as the cookies here do.
One measurement does not wait, and our banner cannot switch it off. Cloudflare Web Analytics is injected by our hosting platform on every page. It reports page timings, the page address, the page you came from, your browser and operating system version, and a browser memory figure to Cloudflare, and it runs whether you accept, decline, or choose nothing at all. It sets no cookie and stores nothing on your device, so the browser controls in section 05 will not switch it off; blocking static.cloudflareinsights.com in your browser will. Cloudflare holds that data unsampled for 7 days and then aggregates it down to around 10 percent. We rely on our legitimate interest in knowing whether the site is fast and working.
Error monitoring does not wait either. Sentry starts on page load and reports crashes and a session-health ping so we can see when the site breaks. It is named in the subprocessor list in our privacy notice, session replay is off, and we do not send it identifying information about you. It is a reliability tool rather than an analytics one, which is why it is not in the table below and not part of the choice in the banner.
| Cookie | Purpose | Expiry |
|---|---|---|
| ph_<project_id>_posthog | Anonymous device and event identifier for product analytics. | 1 year |
| ph_<project_id>_window_id | Window scoping for analytics events. | Session |
If you decline analytics, neither cookie is set, and we receive no behavioral data from your sessions.
Marketing (opt-in)
We currently set no marketing or retargeting cookies. This category is reserved. If we ever add one (for example, a LinkedIn Insight Tag for retargeting), we will update this policy at least 30 days before activation and require fresh consent.
Third-party
A small number of third parties set cookies inside their embedded surfaces on our pages.
- Stripe: cookies set inside the billing iframe on the /billing page for fraud prevention and session continuity.
- Cloudflare Turnstile: bot-challenge tokens on authentication pages.
- Google Fonts: font caching hints. Fonts are served with no behavioral cookies.
Managing cookies
You can change consent any time with Cookie settings in the site footer, or clear and block cookies in your browser:
California residents can submit a Do-Not-Sell signal at /do-not-sell. We do not sell personal information; the link is provided for CCPA compliance.
No advertising
We run no ad networks, no retargeting, and no social-media tracking pixels on this site today. If that changes, we will update this section and require fresh consent before activation.
Updates
Material changes to this policy will be announced at least 30 days in advance by email to account holders and by banner on the site. The version number and effective date at the top of this document are authoritative.
Contact
Questions about this policy or about a specific cookie set in your browser: hello@winrove.com.
Last reviewed: Sep 2026v1.5 · 8 sections