Cookie policy

1. What cookies are

A cookie is a small text file a website stores in your browser. Among other things, it lets the site remember that you are signed in, or which language you chose, so you do not have to say so on every page.

European and Spanish law requires your informed consent before setting cookies or similar technologies, except for those strictly necessary to provide a service you have expressly asked for.

2. The cookies we use

We use only first-party, strictly necessary cookies. We use no advertising or analytics cookies and no cross-site tracking.

wf_locale — necessary, first-party

Remembers whether you want the interface in English or Spanish. It lasts one year. Without it, every visit would fall back to the default language.

wf_anon_id — necessary, first-party

A random identifier given to visitors without an account. It lets us apply free AI usage limits per visitor and prevent abuse. It holds no personal data and does not identify you on its own. It is httpOnly and lasts one year.

authjs.session-token — necessary, first-party

The NextAuth (Auth.js) session cookie that keeps you signed in. It is httpOnly, and in production over HTTPS your browser receives it with the security prefix (__Secure-authjs.session-token). Without it you would have to sign in on every page.

authjs.csrf-token — necessary, first-party

A token that protects the sign-in forms against cross-site request forgery. It is a security measure we cannot do without.

authjs.callback-url — necessary, first-party

Remembers which page to return you to after you sign in.

wf_reauth — necessary, first-party

Set only when you change your password, to confirm it is you, and expires after one minute.

wf_admin_mfa — necessary, first-party

For the admin team only: remembers for 12 hours that two-step verification was passed.

Your browser also keeps two technical items in its local storage: your business description while you finish creating your account (deleted when you close the tab), and whether you have closed the editor guide, so it isn't shown again.

All of the above is technical or strictly necessary and therefore exempt from the prior consent requirement. We describe it here anyway, for transparency.

Bot check

On the sign-up form we use Cloudflare Turnstile, which loads from Cloudflare and analyses technical browser data to check that the person signing up is human. It is a security measure needed to provide the service you ask for.

Visit measurement without cookies

To know how many people visit the public pages of this site and which ones work best, we use Cloudflare Web Analytics. It sets no cookies and stores nothing in your browser, creates no visitor identifier and does not follow you across other sites. It collects aggregated technical data: the page visited, the referring page, approximate country, browser and device type, and load times. Because it neither stores nor reads information on your device, it does not require your consent. In addition, while you have a page of this site open, your browser tells us every 30 seconds that you are still on it, so we can count visits in real time: this uses no cookies and stores nothing on your device either; you are identified by an anonymous code that changes every day, derived from your IP address and browser, which is never saved to a database and is erased from the server's memory within minutes. With it we see the page open, the site you came from and an approximate location (country and, where available, city) derived from the IP by Cloudflare; never the IP itself.

It is not used in the customer area or on the websites you publish with the service.

If analytics that uses cookies, support chat, videos or advertising pixels are added later, a prior consent banner — with refusal as easy as acceptance — must be implemented and this table updated before they are switched on.

3. Cookies on the sites you publish

This policy covers yourweb4free.com. The sites you publish with the service have their own cookie policy, linked in their footer. As we deliver them, they set no advertising or analytics cookies: visits are counted on our server, in aggregate and without cookies, and the Google map only loads when the visitor presses “Show map”.

If you add your own tools to your site — analytics, external forms, embedded video or social media — you are responsible for disclosing those cookies and obtaining any consent required.

4. Managing or deleting cookies

You can set your browser to block or delete cookies. Be aware that blocking the necessary cookies described above means you will not be able to sign in or use the editor, because the service relies on them to function.

• Google Chrome: Settings → Privacy and security → Cookies and other site data.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Safari: Preferences → Privacy → Manage Website Data.
• Microsoft Edge: Settings → Cookies and site permissions.

You can also simply sign out from within the service, which invalidates the session cookie.

5. More information

How we handle the personal data associated with these cookies is described in our privacy policy. If anything is unclear, email us at privacy@yourweb4free.com.