ortwort

Cookies & local storage

Last updated: 2026-08-30

ortwort sets no advertising, analytics or third-party tracking cookies. Every item below is either strictly necessary for a function you asked for (§ 25(2) TTDSG) or a purely local UI preference that never leaves your browser, so no opt-in consent is required — the short notice shown on your first visit is informational only, and dismissing it stores a single flag (ow_cookie_ack) so you are not shown it again. This list is exhaustive as of the “last updated” date.

Cookies

  • sb-…-auth-token (and related) — Supabase authentication session for signed-in creators. First-party. Strictly necessary. Lifetime: managed by Supabase Auth (session / refresh token).
  • ow_did — a random id set when you open a survey, used (as a salted HMAC, never in the clear) to detect duplicate or abusive submissions and to rate-limit. For an anonymous answer it is the only one-answer-per-person key; for a signed-in answer it works alongside your account id. It identifies a browser, not a person. First-party, HTTP-only, SameSite=Lax. Strictly necessary for the integrity of the result you asked to contribute to. Lifetime: ~13 months (400 days).
  • ow_loc_consent — set when you agree to the location check on a survey, so you are not asked again on every visit. First-party, SameSite=Lax, not HTTP-only. Lifetime: 180 days. Strictly necessary for the consent function you used; remove it via the browser or by revoking location consent in the app.

Local storage / session storage (not cookies)

  • ow_signup (sessionStorage) — carries your privacy-policy consent choice and any referral code through the sign-in redirect; deleted immediately after it is read.
  • ow_sidebar_collapsed (localStorage) — remembers whether you collapsed the dashboard sidebar.
  • ow_cookie_ack (localStorage) — set when you dismiss the first-visit cookie notice, so it is not shown again.
  • ow_local_survey_count (sessionStorage) — remembers how many local surveys were near you, for the “Browse surveys” badge.

Third parties whose content can set storage when it loads

The following load only in specific situations and are governed by their own privacy and cookie policies:

  • MapTiler — when a map is shown. MapTiler serves the map tiles and receives your IP address; see maptiler.com/privacy-policy.
  • Paddle — only when you open the checkout. Paddle may set cookies necessary for the payment session; see paddle.com/legal/privacy.
  • Google — only if you use “Continue with Google”, on Google’s own sign-in page.

If analytics or any non-essential storage is added later, a consent mechanism compliant with § 25(1) TTDSG and the GDPR must be added first.