This is an English convenience translation; the German version of this page is the binding one.
What is a cookie
A cookie is a tiny text file a website asks your browser to store. Your browser hands it back the next time you visit, so the site can remember whether you’re logged in, what theme you picked, and similar small things.
WAVOA uses cookies on the marketing website (wavoa.app) and the in-app web view that handles billing. The native iOS and Android apps don’t use cookies — see mobile SDKs below.
The full list
Two cookies on the marketing site. That’s it. We update this table within 14 days of any change.
| Cookie | Purpose | Lifetime | Required |
|---|---|---|---|
wavoa_consent | Remembers whether you accepted or declined analytics. Set the moment you click a button on the consent banner. | 1 year | Yes (functional) |
ph_* (PostHog) | Anonymised product and campaign analytics in PostHog’s privacy mode — autocapture off, IP scrubbed, no person profile, no cross-site tracking, no session recording. Set only after you click “Accept” on the consent banner — until then the PostHog SDK never initialises and no analytics cookies are set. | 1 year | No (opt-in) |
What’s not on this list, ever: Google Analytics, Facebook Pixel, Hotjar, LinkedIn Insight, TikTok pixel, advertising network cookies, retargeting cookies, fingerprinting scripts.
Analytics
We use PostHog (EU region, Frankfurt) in privacy mode — Person Profiles are disabled, IPs are scrubbed, and we’ve opted out of all cross-site tracking features. It records:
- The website address and page path you visited, without query parameters or fragments.
- The referring website’s origin (protocol and domain), without its full page address.
- Approximate location inferred from your IP address: country, region and city, plus postcode and approximate coordinates where available. PostHog discards the IP address after enrichment and retains the estimates with analytics events. These are not GPS readings or session tracks.
- Your screen size bucket (mobile / tablet / desktop).
- Fixed engagement and scroll milestones, clicks on navigation, app-store, session-sharing and AI links, and fixed labels for recognised WAVOA campaigns (for example, sticker, QR and design). Campaign labels stay only in page memory during navigation and are cleared on reload, tab closure or withdrawal of analytics consent. Submitted text, arbitrary query values and account IDs are excluded.
PostHog in privacy mode does not follow you across sites or build a person profile. We do not enable session recording, heatmaps, or autocapture. You can opt out at any time at the bottom of any page → “Cookie preferences”, or per-app under Profile → Privacy → Analytics.
Mobile SDKs
The native apps don’t use cookies. They do, however, talk to a few SDKs. Same rules: minimum, audited, declared.
- Apple Push Notification service. Required to deliver push alerts on iOS.
- Firebase Cloud Messaging. Required to deliver push alerts on Android. We send only the notification text — never your account ID.
- StoreKit 2 / Google Play Billing. For Plane and Foil subscriptions.
- Sentry (EU region). Crash reports. Anonymised — no IP, no user ID. 30-day retention.
- PostHog (EU). Product events using anonymous IDs and approximate IP-derived location, including country, region and city, plus postcode and approximate coordinates where available. The IP address is discarded after enrichment. Person profiles and session recording are disabled. IP-derived estimates do not use GPS readings or session tracks.
That’s the entire SDK list. No advertising SDKs, no MMP/attribution SDKs, no AppsFlyer / Adjust / Branch / Singular.
How to disable
On the website
The first time you visit, you’ll see a consent banner at the bottom of the page. PostHog stays off until you click “Accept analytics” — until then, and if you click “Decline”, the SDK never initialises and no events are sent. Your choice is remembered for one year in the wavoa_consent cookie. You can change it any time via the “Cookie preferences” link in the footer.
In the iOS / Android app
Open Profile → Privacy. Three switches:
- Anonymous analytics — off disables our usage events.
- Crash reports — off disables Sentry. We won’t see your crashes; please email us if you spot a bug.
- Personalised sail suggestions — off stops the recommender using your past sessions.
Do Not Track & Global Privacy Control
We honour both. If your browser sends DNT: 1 or Sec-GPC: 1, the optional PostHog cookies (ph_*) are never set, regardless of any banner you saw or button you clicked.
Contact
Cookie or tracking questions: use the contact form.