Cookies and storage
Which technologies are used on your device — and which are not.
25 August 2026
In short
Wmarks uses necessary cookies for sign-in and account security. Optional Google sign-in adds short-lived security cookies. The anonymous check allowance is enforced server-side and sets no cookie. We use no analytics, advertising or marketing cookies, so no consent banner is shown.
What is actually set
| Technology | Purpose | Classification | Lifetime |
|---|---|---|---|
| Session cookie (Better Auth) | sign-in and account security | necessary, § 25(2)(2) TDDDG | up to 30 days |
| OAuth state/PKCE (only for Google sign-in) | protects the sign-in flow against attacks | necessary, § 25(2)(2) TDDDG | a few minutes |
In production these cookies are set with the HttpOnly and Secure attributes and an appropriate SameSite value.
What is not used
- no analytics or audience measurement
- no advertising or marketing cookies, and no fingerprinting
- no session replay and no A/B testing
- no localStorage or sessionStorage used for tracking
- no cookie for the anonymous free allowance
The anonymous allowance without a cookie
So that anonymous use remains possible without an account, we limit it per UTC calendar day. To do so the server derives a non-reversible value from your IP address, the current UTC day and a secret, rotatable key, and stores only that value together with a counter. The IP address itself is not stored for this purpose.
These records are deleted automatically once the relevant UTC day has ended. The legal basis is our legitimate interest in an abuse-resistant free offering under Article 6(1)(f) GDPR. Because no access to your device takes place, § 25 TDDDG does not apply to it.
If this changes
If analytics, marketing or other non-essential technologies are introduced in future, they will be technically blocked until valid consent is given. We would then introduce genuine consent management with an equally prominent reject option, granular choices, logging and withdrawal at any time.