Cookies and browser storage — Wishey.ai
Checked against the code on 2026-10-26 (src/, the Neon Auth package, next.config.ts).
Use this list for the Privacy Policy. Update it whenever a cookie, storage key or
third-party script is added.
Cookies
| Name | Set by | Purpose | Lifetime | Category |
|---|---|---|---|---|
__Secure-neon-auth.session_token |
Neon Auth (sign-in) | Keeps you signed in. HttpOnly, Secure. | Session length set in Neon Auth | Essential |
__Secure-neon-auth.local.session_data |
Neon Auth | Caches the signed-in session so pages don't re-check it on every request. HttpOnly, Secure. | Short (minutes) | Essential |
__Secure-neon-auth.session_challenge |
Neon Auth | Security check used while a session is being verified (also seen with the legacy spelling session_challange). |
Short | Essential |
adagent_workspace |
Wishey.ai (/api/workspaces) |
Remembers which workspace (brand) you are working in. HttpOnly, SameSite=Lax. | 1 year | Essential (functional) |
| Google sign-in state cookies | Google / Neon Auth, only when you choose "Continue with Google" | Protects the sign-in round trip against forgery. | Minutes | Essential |
Browser storage (localStorage)
| Key | Purpose | Category |
|---|---|---|
wishey.cookieConsent |
Remembers your cookie choice (categories + date). Kept 12 months, then you are asked again. | Essential |
adSafety:project:<projectId> |
Remembers the Ad safety On/Off switch per Studio project. | Essential (functional) |
No sessionStorage is used. No IndexedDB is used.
Third-party scripts
None today. No analytics, advertising pixels, tag managers, chat widgets or error trackers are loaded in the browser.
- Fonts (Inter Tight, Instrument Serif, Geist Mono) are self-hosted by Next.js at build time: the browser never contacts Google Fonts.
- Generated images and videos are served from our storage (Cloudflare R2) and, while a render is in progress, from the generation provider's file host. These are file downloads, not scripts, and set no cookies we control.
Non-essential categories (none in use yet)
The consent banner offers Analytics and Marketing. Both are off until the user opts in.
Any future analytics or pixel MUST be loaded through src/lib/consent.ts
(whenConsented("analytics" | "marketing", load)) so it never runs before consent.