Cookies and storage
Cookies and storage
Last updated September 21, 2026Previous versions →
Every cookie and every key Wendy keeps in your browser, where it is set, for how long and why. There is no banner because nothing here needs your consent.
1.The notice
Wendy sets no cookie on any marketing page. Six cookies exist, all strictly necessary and none used for tracking: __session keeps you signed in after you sign in (14 days); wendy_ch holds the sign-in code challenge for the 10 minutes it takes you to type the code we emailed you; wendy_rn holds the one-time nonce from a resume link you opened from an email, for 5 minutes and only on the one address that spends it; wendy_oauth_{provider} (for example wendy_oauth_microsoft) protects a connection to one of your accounts for the 10 minutes it takes you to approve it at the provider, and is removed as soon as you come back; and wendy_preview lets a browser we handed a preview link see the site before it is published, for 30 days, and carries no identity. On the demo pages a cookie named wendy_v holds a random visitor id so the demo can limit turns per visitor; it is set only there and only for the demo.
The app also keeps a few things on your device under keys that start with wendy.: your unfinished assessment answers until you sign in, and a random id for them; your set-up answers while you type them; small preferences such as which side of Wendy you opened last, whether you installed the app, and the address this browser registered for check-ins; the values that carry a sign-in across a redirect to Google or Microsoft, for that tab only; a short note of whether you have a report, so the page header shows the right button; and a workspace invite or a team intent while you take the assessment. The demo keeps its own transcript on your device under wendy.demo. only while the tab is open. The sign-in library keeps its own record of your sign-in in your browser under its own name, and the installed app keeps the unread count for its icon in a store named wendy-badge. None of that leaves your device until you choose to save or sign in, and every key is listed below.
Our analytics run without cookies and without storing anything in your browser; events are recorded by our servers under your account id or the demo visitor id, and never include your answers, scores, names or text. We use no advertising cookies and no third-party tracking. Because nothing here needs your consent under EU or UK rules, there is no banner. If that changes, we will ask first.
2.Every key, listed
| Name | Kind | Set on | Lifetime | Purpose |
|---|---|---|---|---|
__session | cookie | POST /api/auth/session, after you sign in | 14 days | Keeps you signed in. |
wendy_ch | cookie | POST /api/auth/code/start, when we email you a sign-in code | 10 minutes | Ties the code you type to the code we sent. |
wendy_rn | cookie | GET /r/{token}, when you open a resume link from an email | 5 minutes; spent by the one request it is sent with | Proves the resume link was opened in this browser. |
wendy_oauth_{provider} | cookie | POST /api/connect/{provider}/start, when you connect an account | 10 minutes; cleared on the callback | Binds the connection you approve at the provider to the one you started. |
wendy_v | cookie | /demo/* and /api/demo/* only | 1 year | A random visitor id so the demo can limit turns per visitor. |
wendy_preview | cookie | A preview link we hand out before the site is published, or /api/admin/preview for staff | 30 days | Lets that browser see the unpublished site. It carries no identity. |
wendy.draft.{bankVersion}.{uid}.{mode} | local storage | /assessment | Until the draft is claimed at sign-in or cleared | Your unfinished assessment answers, on this device. |
wendy.localUid | local storage | /assessment, when the browser cannot open an anonymous session | Until you clear site data | A random id for the draft above, so it has somewhere to live. |
wendy.probe | local storage | /start and /assessment | Removed in the same instant it is written | Checks whether this browser lets us keep a draft at all. |
wendy.context.{uid}.{mode} | local storage | The set-up screens | Until the answers are saved, or you sign out | Your set-up answers while you type them. |
wendy.auth.sessionAt | local storage | Any signed-in page, when the sign-in is refreshed | Until you sign out; it stands in for a day at most | When this device last refreshed your sign-in, and for which account. |
wendy.tz.kept | local storage | /coach | Until changed | Remembers that you kept your check-ins' time zone when your phone's clock showed another. |
wendy.checkins.later | local storage | /coach | 7 days | Remembers that you put off choosing a check-in time, so the offer waits a week. |
wendy.installed | local storage | The first open of the installed app | Permanent | Notes that the installed app has opened once, so we count it once. |
wendy.push.endpoint | local storage | Profile & settings, when you turn check-ins on | Until you turn check-ins off | The address this browser registered for notifications, so turning them off can find it. |
wendy.me | session storage | The marketing pages, when you are signed in | The tab | Whether you have a report and a plan, so the header shows the right button. |
wendy.demo.{persona} | session storage | /demo/{persona} | The tab | The demo transcript and its state. |
wendy.auth.next | session storage | /sign-in, before a redirect to Google or Microsoft | The tab; cleared when the redirect returns | The page to open once you come back from the provider. |
wendy.auth.anonUid | session storage | /sign-in, before a redirect to Google or Microsoft | The tab; cleared when the redirect returns | The anonymous session your draft belongs to, so signing in keeps it. |
wendy.auth.provider | session storage | /sign-in, before a redirect to Google or Microsoft | The tab; cleared when the redirect returns | Which provider you left for, so the return is handled once. |
wendy.intent | session storage | /start, when you arrive from Set up a team | The tab | That you came to set up a team, so the report ends with that card. |
wendy.plan | session storage | /start, when you arrive from Set up a team with a plan picked on the pricing page | The tab | The plan you picked, so the set-up sheet opens on it after your report. |
wendy.pair | session storage | /start, when you arrive from a compare link | The tab | The compare you were invited to, so your report can end with it. |
wendy.pairToken | session storage | /start, when you arrive from a compare link | The tab | The compare link you arrived on, so the card can open it again. |
wendy.pairFirst | session storage | /start, when you arrive from a compare link that names its sender | The tab; cleared by Not now on the report, or when you accept | The first name of the person who invited you, so your report can say who is waiting. |
wendy.invite | session storage | /join/{token}, when the invite is still open | The tab | The invite link you arrived on, so the join screen can accept it. |
wendy-badge | IndexedDB | The installed app, when a notification arrives | Until you remove the app or clear site data | The unread count the app icon shows. |
firebaseLocalStorageDb | IndexedDB | Any page, once you sign in | Until you sign out | The sign-in library's own record of your sign-in, under its own name. |
firebase:pendingRedirect:{app} | session storage | /sign-in, before a redirect to Google or Microsoft | The tab; cleared when the redirect returns | The sign-in library's note that a redirect is in progress. |
A new cookie or key is added to this list in the same change that writes it, or our build fails. Two rows are set by the sign-in library under its own name; the rest are ours.
3.Pages that are not ours
When you pay, you are on a page Stripe serves, and when you connect an account or sign in with a provider, you are on that provider’s page for a moment. Those pages set their own cookies under their own notices; ours sets none of them and reads none of them.
4.How to clear them
Signing out removes the session cookie and the sign-in library’s record. Everything else clears with your browser’s site data for askwendy.ai, and a draft on your device is deleted on its own once it is saved to your account.