Cookie Policy

Cookies are small text files a website asks your browser to store and send back on later visits. Similar technologies include browser local storage, session storage, pixels, and software development kits embedded by third parties. This policy uses the word cookies to cover all of them.

This draft cookie policy applies to Folio, the multi-tenant portfolio platform by wrxstack at portfolio.wrxstack.com, app.portfolio.wrxstack.com, tenant subdomains, and connected custom domains. It explains what we store, why, how long we keep it, and the choices you control. It supplements the Privacy Policy and must be reviewed and approved before it is treated as the live policy.

• First-party cookies are set by Folio itself.
• Third-party cookies are set by a provider whose tool a portfolio owner has connected, such as an analytics tag or an embedded widget.
• Browser storage such as localStorage holds data on your device until it is cleared, and it is not transmitted with every request the way a cookie is.

We group cookies into four categories that match the consent model in the product. Strictly necessary cookies are always on because the platform cannot run safely without them. Functional, analytics, and marketing cookies are optional, they default to off, and they only switch on after you give an affirmative choice.

• Strictly necessary: sign-in, session security, abuse prevention, rate limiting, request identifiers, and your saved consent choice. Always on and not consentable.
• Functional: remembers choices such as embedded media and scheduling widgets so the experience stays consistent. Off until you allow it.
• Analytics: helps us and connected portfolio owners understand product usage in aggregate. Off until you allow it.
• Marketing: would measure campaigns and tailor what we show. Off by default. Folio runs no marketing cookies today.

The exact set is defined in code so the policy never drifts from the product. The consent system lives in lib/consent and is the single source of truth for the categories and the stored record.

The first-party page-view measurement that runs on published portfolios is cookieless. It uses a salted daily value that cannot identify you and sets no tracking cookie, so it falls under strictly necessary.

• folio_consent: a first-party cookie and matching localStorage entry that holds your category choices, a schema and policy version number, the source of the decision, and a timestamp. It carries no personal identifier and is set SameSite=Lax, Secure on https.
• Session and security cookies: first-party, configured for secure, HTTP-only, same-site behavior where supported, used for authenticated sign-in and abuse prevention.
• Local browser storage: may hold draft form state so you can recover unsaved work, and it mirrors your consent choice.
• Connected analytics, such as Google Analytics 4, Google Tag Manager, or PostHog, load only after you allow the analytics category, with PostHog starting opted out.
• Embedded functional widgets, such as media players or scheduling tools, set their own cookies only after you allow the functional category.

The first time you visit you can choose Accept all, Reject all, or set categories individually from the consent banner. We record your choice in the first-party folio_consent cookie and in browser storage with a version number, so a material change to this policy asks you to choose again.

You can change your choices at any time using the Manage cookies control in the footer or the floating cookie control. Turning a category off stops the matching optional cookies from loading on future page views; you may also clear existing cookies through your browser settings.

• We use Google Consent Mode version 2, which keeps Google tags in a denied state until you grant the analytics or marketing category.
• Your decision is kept for about six months, after which the banner reappears so you can re-confirm.
• Strictly necessary cookies cannot be turned off because the platform cannot operate without them.

When a portfolio owner connects an analytics or embedded tool, or when we load a platform analytics tag, a third party may set cookies subject to your consent. Those providers act as processors or independent controllers under their own policies.

• Google Analytics 4 and Google Tag Manager for aggregate product analytics, loaded only after the analytics category is allowed.
• PostHog for product analytics where a portfolio owner enables it, starting opted out until consent is granted.
• Embedded media and scheduling widgets connected by a portfolio owner, loaded only after the functional category is allowed.
• See the Subprocessors page for the broader list of providers and the Privacy Policy for how shared data is handled.

Browsers can send a Do Not Track header or a Global Privacy Control signal. There is no single industry standard for how sites must respond to Do Not Track, so the final behavior should be confirmed by counsel before launch.

Because optional cookies are denied by default and only load after an affirmative choice, a browser that sends these signals and makes no choice will not receive optional analytics or marketing cookies.

How long a cookie lasts depends on its purpose. Session cookies are removed when you close the browser session. Persistent cookies last for a defined period or until you clear them.

• The folio_consent record is kept for about six months and then re-confirmed.
• Security and session cookies last for the life of the authenticated session or the configured rotation window.
• Third-party cookies follow the retention defined by the provider that set them.

Strictly necessary cookies rely on the legitimate need to deliver the service you request and do not require consent under ePrivacy rules. Functional, analytics, and marketing cookies rely on your consent, which you can withdraw at any time.

Final legal basis statements should be confirmed by counsel for each launch jurisdiction.

We may update this policy as cookies, providers, or legal requirements change. A material change bumps the consent version number so every visitor is asked to choose again, and the change is reflected with a new review date.

Questions about cookies and privacy choices, and legal-signoff comments, should be sent to legal@wrxstack.com. Include the relevant account email, tenant slug, custom domain, or public URL when available.