Skip to main content

Cookie Policy

This page lists every cookie and every piece of client-side storage that WireKit (wirekit.app) & WireKit Docs (docs.wirekit.app) uses, what it is for, how long it lives, and who sets it. We keep this list complete and current — if you find something that is set on your browser but not documented here, please let us know at hello@pushery.com.

Information About Cookies

Cookies are small text files that a website can place on your device. We use cookies only where they are strictly necessary to make the site work (keeping you signed in, protecting forms against CSRF). We do not use cookies for advertising, for behavioral tracking, or for any kind of cross-site profiling. See our Privacy Policy for the legal background.

Technically Necessary Cookies

These cookies are required for the application to function and cannot be disabled. They do not identify you personally and do not track you across other websites.

wirekit_docs_session (name may vary based on configuration)

  • Purpose: session management — keeps you signed in and protects form submissions. The cookie itself contains only an opaque reference ID; the actual session data is stored server-side in our database.
  • Duration: 120 minutes of inactivity, extended with each request.
  • Provider: WireKit Docs (first-party).

XSRF-TOKEN

  • Purpose: CSRF protection — prevents unauthorized third-party sites from triggering state-changing requests on your behalf. Set automatically on every page load.
  • Duration: session duration.
  • Provider: WireKit Docs (first-party).

feedback_voter

  • Purpose: page feedback — records that this browser has already voted on a page, so a second click is not counted twice and the page can show you your own answer. Contains a random value; the server stores only a keyed hash of it, so the value in your browser and the value in our database cannot be matched by anyone holding just one of them.
  • Duration: 1 year.
  • Provider: WireKit Docs (first-party). Set only when you press one of the feedback buttons — never merely by reading a page.

remember_web_*

  • Purpose: "Remember me" functionality for automatic sign-in on return visits. Set only when a team member explicitly ticks the "Remember me" box at login.
  • Duration: up to 5 years.
  • Provider: WireKit Docs (first-party).

feedback_probe

  • Purpose: a test write. The feedback buttons use it to find out whether your browser can keep anything at all, because a vote from a browser that keeps nothing could be counted any number of times. Where cookies are blocked, the same test is made in localStorage.
  • Duration: none. It is removed in the same step that writes it.
  • Provider: WireKit Docs (first-party). Written only when you press one of the feedback buttons — never merely by reading a page.

Functional Browser Storage

These items are kept in your browser's own storage (localStorage, and sessionStorage where it says so). They are not transmitted to our server: the site writes them in your browser and reads them there again. Each entry names the moment it is written. Clearing this site's data in your browser removes all of them, and the site then behaves as it does on a first visit.

wirekit-dark-mode

  • Purpose: remembers your preferred color scheme (light, dark, or system).
  • Written: when you switch the color scheme.
  • Duration: permanent, until the browser's site data is cleared.

wirekit-docs-theme and wirekit-docs-theme-hint-seen

  • Purpose: the first remembers the theme you picked in the theme menu. The second records that the one-time note about previews following the theme has been shown, so that it does not return.
  • Written: when you pick a theme. Nothing is stored before you pick one.
  • Duration: permanent, until the browser's site data is cleared.

wirekit-sidebar-… (one entry for each group of the navigation, for example wirekit-sidebar-sidebar-group-essentials)

  • Purpose: remembers which groups of the sidebar you folded and which you opened.
  • Written: when you fold or open a group, and when you open a "Share this view" link, whose address names the groups its sender had open.
  • Duration: permanent, until the browser's site data is cleared.

wirekit-favorites

  • Purpose: the pages you marked with the star, shown under "Favorites" in the sidebar. Up to 25 entries, each with the page's title, its address and the time you marked it.
  • Written: when you press the star on a page. Not written while your browser sends a Do-Not-Track signal.
  • Duration: permanent, until you remove the star or clear the browser's site data.

wirekit-recent

  • Purpose: the last ten pages of this site you opened, shown under "Recently viewed" in the sidebar. Each entry holds the page's title, its address and the time you opened it. The start page, the sign-in and account pages and the search are left out.
  • Written: every time you open a page. Not written while your browser sends a Do-Not-Track signal.
  • Duration: an entry is dropped 30 days after the visit, and the list never holds more than ten.

wirekit-docs:sandbox-default

  • Purpose: remembers whether you switched "Live preview" on, so that the previews offering it open the same way on the next page.
  • Written: when you switch "Live preview" on or off.
  • Duration: permanent, until the browser's site data is cleared.

wirekit-docs:single-key-shortcuts

  • Purpose: remembers that you switched the single-key keyboard shortcuts off.
  • Written: when you switch them off in the shortcut overview, and removed when you switch them on again.
  • Duration: until you switch them on again or clear the browser's site data.

wirekit-docs:reduce-motion

  • Purpose: remembers that you switched "Reduce motion" on, so that the moving examples stay still on the next page as well.
  • Written: when you switch "Reduce motion" on in the sidebar, and removed when you switch it off again.
  • Duration: until you switch it off or clear the browser's site data.

wirekit-sidebar-scroll (sessionStorage)

  • Purpose: carries the scroll position of the sidebar to the next page, so that the navigation does not jump back to its top.
  • Written: when you follow a link in the sidebar, and removed as soon as the next page has read it.
  • Duration: until the next page has loaded, at most until the tab is closed.

Entries written by a live preview

The documentation shows WireKit's components running. A component you operate in a preview can remember its own state in your browser, exactly as it would in an application built with WireKit: a sidebar or a rail you collapsed, a banner you dismissed, a reading bookmark, the colors you picked last, or the theme chosen in the theme controller's demo (wirekit-theme). Such an entry is written only when you operate that preview, it stays in your browser, and it goes when the site's data is cleared.

Web Analytics (Matomo)

We use the open-source analytics platform Matomo, self-hosted on our own servers in Germany.

  • Server-side and cookieless. No Matomo JavaScript tracker runs in your browser and no cookies are set — page views are counted by our backend, and UI interactions plus anonymous Core Web Vitals are sent as small requests to our own server.
  • Do-Not-Track respected. A DNT: 1 or Sec-GPC: 1 signal from your browser disables tracking entirely.
  • IP anonymization. IP addresses are truncated before storage.

Matomo records which pages are viewed, how long visitors stay, the referring page, browser and operating system (from the User-Agent header), and an anonymized geographic location — nothing more. Because no identifier is stored in your browser, we cannot link visits from different sessions or devices.

Error Monitoring

We use two server-side monitoring services to detect and fix bugs. Neither sets cookies in your browser, and neither runs any JavaScript on this website.

Flare (flareapp.io, operated by Flare App BV in Belgium)

  • Server-side PHP error reporting.
  • Captures error messages and stack traces when an uncaught exception occurs.
  • No cookies, no client-side code.

Laravel Nightwatch (operated by Laravel Holdings, Inc.)

  • Server-side application performance monitoring.
  • Captures aggregate request timings, query timings, and exception counts.
  • No cookies, no client-side code.

External Services

Cloudflare (Cloudflare, Inc., USA)

Our DNS and caching layer. Cloudflare may set its own security cookies only when its security layer determines it needs to; under normal conditions you will not see them at all.

__cf_bm

  • Purpose: bot-management challenge — distinguishes human visitors from automated traffic.
  • Duration: 30 minutes.
  • Provider: Cloudflare.

cf_clearance

  • Purpose: security-challenge completion marker — set after a successful challenge so you are not re-challenged on every subsequent request.
  • Duration: up to 15 minutes.
  • Provider: Cloudflare.

Both cookies are used exclusively for security (bot mitigation, DDoS protection) and never for advertising or behavioral profiling. Further details: Cloudflare cookies.

Cloudflare Turnstile (Cloudflare, Inc., USA)

The feedback buttons at the foot of each documentation page and the Send feedback form are protected against automated abuse by Cloudflare Turnstile. It loads only when you press one of those buttons or open the form — reading a page never contacts Cloudflare for this purpose. Turnstile sets no cookie of its own; the two security cookies above may apply as they do to any request. See the privacy policy for what is transmitted and on what legal basis.

What We Do Not Use

For the avoidance of doubt, this website uses none of the following:

  • Google Analytics, Google Tag Manager, Meta Pixel, LinkedIn Insight, TikTok Pixel, or any comparable third-party analytics/advertising script (our own Matomo runs server-side, loads no tracking script in your browser, and sets no cookies — see above).
  • Google Fonts, YouTube embeds, Google Maps, Google reCAPTCHA, or any other Google service — all fonts, scripts, and media are self-hosted.
  • Advertising cookies, retargeting pixels, affiliate trackers, or conversion tags.
  • Social-media share widgets that would cause your browser to contact social platforms.
  • Cloudflare Workers, or other Cloudflare products that would process visitor data beyond DNS, cache, and WAF. (Cloudflare Turnstile is the one exception and is used on the page-feedback buttons and the Send feedback form only — see “External Services” above.)
  • Device fingerprinting, canvas fingerprinting, cross-device tracking, or any similar technique.
  • OAuth sign-in with Google, GitHub, or any other third-party identity provider.
  • Data sales, data sharing for advertising, or data brokerage of any kind.

Managing Cookies

Because we only use cookies that are strictly necessary, there is nothing to opt out of — blocking all cookies in your browser will simply sign you out and prevent form submissions. Modern browsers let you view and delete all cookies in their settings; every cookie listed above can be removed at any time without any further consequence.

The entries under "Functional Browser Storage" are removed the same way, with this site's data. Two of them, the favorites and the list of recently viewed pages, are also not written while your browser sends a Do-Not-Track signal.

We keep this list in sync with what the application actually sets. If we ever add a new cookie or storage item, it will be documented here first. The current version is always available on this page.