What Are Cookies & Browser Storage?
Cookies are small text files placed on your computer or mobile device when you visit websites. They are commonly used to make websites function securely and efficiently.
- HTTP Cookies: Sent automatically by your browser in HTTP request headers. WilBot marks its cookies with
HttpOnly(preventing client-side JavaScript access and XSS theft),Secure(ensuring transmission occurs exclusively over encrypted TLS connections), andSameSite=Lax(guarding against Cross-Site Request Forgery). - Local & Session Storage: HTML5 storage mechanisms that hold data strictly on your device. Unlike cookies, local storage values are never automatically transmitted across the network in HTTP headers and remain under your device's direct control.
Essential Security & Session Cookies
Under Regulation 6 of the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, strictly necessary cookies that are essential for providing an online service requested by the user are exempt from consent requirements. The cookies set by WilBot fall squarely into this essential classification:
| Cookie Identifier | Classification | Purpose & Security Attributes | Lifespan |
|---|---|---|---|
wilbot_session | Strictly Necessary | Cryptographically signed session token maintaining your authenticated account state across dashboard, cloud IDE, and web chat. Marked HttpOnly, Secure, SameSite=Lax. | 14 days (or until sign-out) |
wilbot_chat_guest | Functional / Necessary | Signed random guest token enabling unauthenticated visitors to maintain and resume private guest chat conversations on their browser without creating an account. | 30 days |
oauth_state, oauth_code_verifier | Security | Short-lived PKCE security verifier protecting Discord and Google OAuth2 sign-in flows against CSRF and authorization code interception attacks. | 10 minutes (single-use) |
wilbot_passkey_challenge | Security | Ephemeral cryptographic challenge token used during WebAuthn passkey registration and assertion. Contains no biometric data. | 5 minutes (single-use) |
Browser Local & Session Storage
We utilize client-side local storage exclusively to remember your interface preferences and IDE layout:
| Storage Key | Category | Functional Purpose | Retention |
|---|---|---|---|
wilbot_theme | Interface | Remembers your preference for dark, light, or cosmic system theme. | Persistent on device |
wilbot_default_model | Preferences | Saves your preferred AI model (e.g. Gemini, Groq, or GPT-6) for rapid chat execution. | Persistent on device |
wilbot_sound_fx | Interface | Remembers whether tactical audio synthesizer sound effects are enabled or muted. | Persistent on device |
wbc_active_workspace | WilBotCode | Caches your recently opened cloud coding workspace identifier so the IDE reopens where you left off. | Persistent on device |
wbc_recent_projects | WilBotCode Desktop | Remembers local project directory shortcuts in the desktop app native file picker. | Persistent on device |
wilbot_cookie_consent | Compliance | Records your acknowledgment of this essential storage notification. | Persistent on device |
sessionStorage | Navigation | Restores unsent chat drafts in this tab for up to 24 hours, scoped to your chat identity. Also stores temporary homepage query entry markers. | Tab lifecycle only |
Optional First-Party Web-Chat Analytics
If the operator enables web-chat analytics, limited event metadata is processed server-side against a pseudonymous key, without an analytics cookie. A temporary homepage entry-point marker may be stored in sessionStorage so a prompt started on the homepage can be attributed to that entry point when you send it in chat. This is not used for cross-site tracking.
The chat guide is no longer shown after its dismissal preference is saved in localStorage. These browser markers do not contain prompt or response text.
Zero Third-Party Advertising & Tracking Pixels
We believe online developers and communities deserve an ad-free, surveillance-free environment:
- We do not embed Google Analytics, Meta / Facebook tracking pixels, TikTok pixels, or LinkedIn insights tags.
- We do not participate in cross-site retargeting networks or sell audience segments to data brokers.
- We do not use browser fingerprinting techniques to track users across external domains.
How to Control, Inspect & Clear Storage
You maintain total autonomy over all cookies and stored data on your device:
- Browser Controls: You can inspect, view, block, or delete cookies and site data through your browser's privacy settings (e.g., in Chrome: Settings > Privacy and Security > Third-party cookies > See all site data and permissions; in Safari: Settings > Privacy > Manage Website Data).
- Impact of Disabling Cookies: Because our cookies are strictly necessary for session verification and security, disabling cookies will prevent you from signing into your dashboard or maintaining web chat history.
- Instant Sign-Out: Clicking "Sign out" in Account Settings immediately invalidates your session token on the server and clears the
wilbot_sessioncookie from your browser.
Regulatory Compliance & Inquiries
This Cookie Policy complies with the UK Privacy and Electronic Communications Regulations (PECR), the UK Data Protection Act 2018, and EU Directive 2002/58/EC (ePrivacy Directive). Questions regarding our storage practices should be directed to our privacy desk at [email protected].