What we use
| Cookie | What it does | Lasts |
|---|---|---|
wt_portal | Keeps you signed in to the account area. | 30 minutes |
wt_oauth | Only while you sign in with Apple or Google: links the provider's answer to the sign-in you started. | 10 minutes |
wt_portal_2fa | Only after signing in with Apple or Google when two-factor sign-in is on: remembers that the first step is done. | 5 minutes |
They are set by our own server and removed when you sign out.
Cloudflare
Cloudflare, which delivers and protects the site, may set these security cookies. The security check of the sign-in form (Cloudflare Turnstile) sets no cookie.
| Cookie | What it does | Lasts |
|---|---|---|
__cf_bm | Helps tell people apart from automated traffic. | 30 minutes |
cf_clearance | Only after a security check: remembers that it was passed. | The time set for the check, usually 30 minutes |
The site also keeps in the browser's storage, without sending them to us: for the rest of a visit, that a purchase has already been counted in our statistics (wt_reported_…); the language of the site, picked in the menu or taken from the browser, to open the home page in it (wt_lang); light or dark, if you choose it with the button at the top (wt_theme).
Our statistics
Our own statistics script sets one cookie on this site. It measures only the audience of this site, and nothing is passed to others.
| Cookie | What it does | Lasts |
|---|---|---|
wt_first | The date of your first visit (for example 2026-11-07), nothing else. It tells new and returning visits apart. | 13 months, not extended by later visits |
wt_optout | Only if you choose not to be counted. | 13 months |
During a visit the script also keeps in the session storage of the browser tab a random number (wt_sid), whether the visit is new or returning (wt_vis) and the time of the last page (wt_last), removed when the tab is closed. When the home page opens in your language, the site you came from waits there for a moment (wt_ref) and is removed as soon as the page in your language counts it.
Consent
The sign-in cookies are strictly necessary to provide the account area that you ask for, so the law does not require consent for them (Article 22.2 of the Spanish Law 34/2002 on information society services, and the ePrivacy Directive).
The Cloudflare cookies are strictly necessary for the security of the site, so they need no consent either.
The cookie of our own statistics needs no consent: it serves only to measure the audience of this site, a use the Spanish data protection authority (AEPD) treats as exempt.
Advertising
The site sets no advertising or social media cookies.
Controlling cookies
You can delete or block cookies in your browser settings. The public pages still work; the account area needs the sign-in cookies. The apps do not use cookies.