ortwort

Cookies & local storage

Last updated: 2026-08-30

ortwort sets no advertising, analytics or third-party tracking cookies, so no cookie-consent banner is required for the storage below — every item is either strictly necessary for a function you asked for (§ 25(2) TTDSG) or is a purely local UI preference that never leaves your browser. This list is exhaustive as of the “last updated” date.

Cookies

  • sb-…-auth-token (and related) — Supabase authentication session for signed-in creators. First-party. Strictly necessary. Lifetime: managed by Supabase Auth (session / refresh token).
  • ow_did — a random id set for an anonymous respondent when they open a survey, used (as a salted HMAC, never in the clear) to stop the same browser answering the same survey twice. First-party, HTTP-only, SameSite=Lax. Strictly necessary for the integrity of the result you asked to contribute to. Lifetime: ~13 months (400 days).
  • ow_loc_consent — set when you agree to the location check on a survey, so you are not asked again on every visit. First-party, SameSite=Lax, not HTTP-only. Lifetime: 180 days. Strictly necessary for the consent function you used; remove it via the browser or by revoking location consent in the app.

Local storage / session storage (not cookies)

  • ow_signup (sessionStorage) — carries your privacy-policy consent choice and any referral code through the sign-in redirect; deleted immediately after it is read.
  • ow_sidebar_collapsed (localStorage) — remembers whether you collapsed the dashboard sidebar.
  • ow_local_survey_count (sessionStorage) — remembers how many local surveys were near you, for the “Browse surveys” badge.

Third parties whose content can set storage when it loads

The following load only in specific situations and are governed by their own privacy and cookie policies:

  • MapTiler — when a map is shown. MapTiler serves the map tiles and receives your IP address; see maptiler.com/privacy-policy.
  • Paddle — only when you open the checkout. Paddle may set cookies necessary for the payment session; see paddle.com/legal/privacy.
  • Google — only if you use “Continue with Google”, on Google’s own sign-in page.

If analytics or any non-essential storage is added later, a consent mechanism compliant with § 25(1) TTDSG and the GDPR must be added first.