Cookie Policy

Browser cookies and storage separate necessary functions from optional statistics. Refusing statistics leaves service functions available.

Necessary — first party

The PHP session cookie (configured name below) manages access, language and CSRF protection; it lasts for the browser session, with separate application access timeouts. wm_house_access_{home_id} retains guest authorization for a protected house for the configured duration below, unless revoked earlier. welmemo_consent stores version, analytics choice and decision date for six months, without email, account or session ID.

Guest-requested offline storage — first party

localStorage welmemo-offline:{slug} remembers Save on phone. Cache Storage welmemo-home-v3-{slug} holds resources and pages of the saved open house. There is no fixed expiry: clear site data to remove them, or the app invalidates the online copy; the browser may evict them. Protected houses and private previews are not saved offline.

Optional analytics — Google

Only after consent and when configured on marketing pages, GA4 may write first-party _ga and _ga_<identifier> cookies to distinguish visits and session state. Google supplies the tag; configuration requests a 180-day expiry without automatic renewal. No Google Analytics loads before consent. Advertising and ad personalization are not enabled.

Choice and withdrawal

Manage cookies lets you accept, refuse or change your choice. After six months or a relevant version/configuration change, a new choice is requested. Withdrawal disables GA, attempts to remove known _ga cookies and reloads if the tag was active. Preferences may not persist when the browser blocks cookies.

External services

Turnstile is used for security in enabled flows. The repository does not configure pre-clearance or set cf_clearance or __cf_bm cookies: cookies added by Cloudflare hosting must be checked before release. PayPal handles payment in its own environment and, for cards, through hosted fields on the WelMemo payment page. PayPal notices apply. Actual card-component cookies must be checked in Sandbox and Live before activation; no unverified cookie names are asserted here. No WelMemo marketing cookie is implemented.

Session cookie: welmemo_session