Cookie Policy

This is the complete list. If something is not on it, we do not set it.

• Sign-in cookies (application only). When you sign in, Supabase Auth sets session cookies that keep you logged in and protect requests against cross-site request forgery. Strictly necessary: without them you could not stay signed in or use the product. They carry no advertising identifier and are cleared when you sign out.
• wsg_consent (site and application). Records the privacy choice you made, the version of this policy you made it under, and when. Strictly necessary: it exists only so we can honor your answer and stop asking on every page. Permission you gave is relied on for six months and then we ask again; anything you turned off stays off and is never quietly reinstated by the answer getting old.
• wsg_signals (site and application). Holds two facts worked out from your request: which consent rules apply where you are, and whether your browser sent a Global Privacy Control signal. It lasts for the visit only and is deleted when you close the browser. Strictly necessary for the same reason: the consent mechanism cannot behave correctly without knowing which rules to apply.
• wsg_plan_intent (application only, and only if you asked to buy). Set when you choose "buy now" on the pricing page rather than "start free trial", and it holds one thing: which plan you picked. Strictly necessary for the thing you just asked for, because creating your account runs through a confirmation email and there is no other way for the checkout you chose to survive that trip. It carries no identifier, is deleted the moment it is used, and expires after seven days if it never is.
• PostHog product analytics and session replay (application only, and only if you allow it). This is browser storage rather than a cookie: entries beginning with ph_ in localStorage, holding an anonymous identifier and session state. Where you have allowed analytics the application also records how the screen is used, meaning clicks, scrolling and navigation, so that we can find and fix problems. Typed text, names, addresses, signatures and document contents are masked before anything leaves the browser, images and drawing areas are blanked, and recording never runs on the training sign-off screens that a tablet is handed around for. Nothing is written until you allow analytics, and withdrawing stops the recording and removes what was written. Not strictly necessary, which is exactly why it is behind a switch.
• YouTube video player (site only, and only after you press play). The demo films on this site are hosted on YouTube. Until you press play there is no player on the page at all: what you see is a still image served from this site, and nothing about your visit has reached YouTube. Pressing play loads the player from youtube-nocookie.com, YouTube's reduced tracking host, and from that moment YouTube receives your IP address and browser details as it would on any page you visited, and may write entries to your device under its own domain to remember playback settings and how much of the film you watched. It is not behind the consent switches, because nothing loads until you act and no film would play if it were turned off. Not pressing play is how you decline it, and Google's privacy policy covers what they do with it.
• Google Analytics (site only, and only if you allow it). Counts visits and which pages get read, so we know which parts of the site are worth writing more of. It sets these cookies: _ga (Holds a random identifier for this browser, so two visits count as one visitor. Lasts 400 days.) and _ga_VLWTSPNW0W (Holds the state of the current visit: when it started and how many pages in. Lasts 400 days.) Nothing is written until you allow product analytics, and withdrawing removes it again. Google Analytics is a processor with a privacy policy of its own, at https://policies.google.com/privacy.
• PostHog (site only, and only if you allow it). Times how fast pages load and respond in your browser, so we can tell a page that got slower from one that was always slow. It sends four numbers and the page path, and nothing about you. It stores nothing on your device: no cookie, no browser storage entry, and no identifier that outlives the page. Nothing is measured until you allow product analytics, and withdrawing stops it again. PostHog is a processor with a privacy policy of its own, at https://posthog.com/privacy.
• PostHog (site only, and only if you allow it). Product analytics and session replay: counts page views, and records how the page is used, meaning clicks, scrolling, navigation and which options you select, so that we can find and fix problems. The words on the page are our own public copy and are recorded as shown. Anything you type into a form or a calculator is masked before it leaves your browser, and the results a calculator works out from what you typed are blanked. It sets these cookies and browser storage entries: ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_posthog (Holds a random identifier for this browser and the state of the current visit, so the pages of one visit are counted together. A copy for the current tab is kept in session storage under the same name. Lasts until you turn analytics off or clear your browser's storage.), ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_session_registered_properties (Holds details of the current visit, such as the page it started on, for this tab only. Lasts until the tab is closed.), ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_window_id (Tells one browser tab from another, so a recording is kept in order. Lasts until the tab is closed.) and ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_primary_window_exists (Notes that this tab is already counted, so a second tab is not mistaken for it. Lasts until the tab is closed.) Nothing is written until you allow product analytics, and withdrawing removes it again. PostHog is a processor with a privacy policy of its own, at https://posthog.com/privacy.

We run no advertising or retargeting pixels. No Meta pixel, no Google Ads tag, no LinkedIn Insight tag, no heatmaps, no data brokers, and no cross-site profiling, on this site or in the application. We do not sell or share personal information for cross-context behavioral advertising.

The one recording tool we use is not advertising. PostHog session replay runs under the product analytics switch and nowhere else, in the application and on this site. In the application, typed text, names, addresses, signatures and document contents are masked before anything leaves the browser. On this site the words on the page are our own public copy and are recorded as shown, anything you type into a form or a calculator is masked before it leaves your browser, and the results a calculator works out from what you typed are blanked. The storage list above says exactly what it keeps and where it never runs.

You will still find an "Advertising and sharing" switch in the preferences dialog, and it currently governs nothing. It is there so that if we ever do add an advertising tool, it cannot load without your answer already on record. If that day comes, this page will name the vendor and what it sets before anything loads, and the policy version will be raised so that everyone is asked again rather than carried over on an old answer.

Two sets of rules apply to the same product and they want opposite defaults. We do not follow the weaker one anywhere: nothing non-essential loads on its own for anyone, in any country, until they have answered. What changes with where you are is why we are asking, not whether we ask.

In the European Economic Area and the United Kingdom, the ePrivacy rules require consent before anything non-essential is stored or read. So you get a notice on your first visit, nothing non-essential loads on its own until you answer, accepting and rejecting are the same two clicks with nothing pre-ticked, and refusing changes nothing about how the product works. There is no close button that quietly counts as agreement, because that would not be consent.

Everywhere else, including the United States, prior consent is not required and we ask anyway. You get the same notice, with the same two choices given the same weight, and nothing loads on its own before you answer there either. The notice does not block the page and there is nothing you have to do to read the site. The standing controls are permanent alongside it: "Cookie preferences" and "Do Not Sell or Share My Personal Information" sit in the footer of every page on this site, and under Settings, then Privacy, in the application.

"On its own" is carrying one thing, and it is the video player in the storage list above. A film on this site is a still image until you press play, and pressing play is what loads the player from YouTube. It is not behind the notice, because the press is already the asking: nothing loads it but a decision to watch, and somebody who turned measurement off should still be able to watch a demo of the product. Not pressing play is how you decline it, and it is the only thing on this site that works that way.

Where you are is worked out from the country our host reports for your network connection. We never look up your address, and the country is not stored anywhere beyond the visit. When it cannot be determined, which happens on a VPN or a corporate network, we apply the stricter rules and show the notice.

If your browser or an extension sends a Global Privacy Control signal, we treat it as an opt out and act on it without asking you to confirm. California and Colorado both require this, and we apply it to every visitor rather than only to residents of those states.

It turns off both optional categories, advertising and sharing and product analytics alike. That is wider than the signal's own definition, which is about selling and sharing, and we do it deliberately. Any measurement tool named in the list above runs in your browser and sends what it collects to the company that made it, which is close enough to the transfer the signal is asking us to stop that treating it as outside the signal would be honoring it in name only. If you want measurement back, the preferences dialog turns it on, or turn the browser setting off.

The signal takes precedence over an earlier acceptance. If you once allowed something and later switch the setting on, it stays off for as long as your browser keeps sending it.

On this site, "Cookie preferences" in the footer of every page reopens the same three-category chooser. In the application it is under Settings, then Privacy.

Withdrawal is real, not cosmetic. Turning product analytics off stops capture immediately, clears the identifier, and removes the stored ph_ entries, _ga, _ga_VLWTSPNW0W, ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_posthog, ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_session_registered_properties, ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_window_id and ph_phc_BVbjWYHVWPLrR2tMWkgxp8Kk5aRY9qjZjN5acYh3WTHr_primary_window_exists from your browser. There is nothing left running in the background afterwards, and nothing to opt back into unless you choose to.

The choice lives in your browser rather than in your account, so it is set separately on each device and browser you use, and clearing your cookies clears it. Your browser's own controls work too, though blocking the sign-in cookies will stop you from being able to sign in.

Three things measure how the site is doing without putting anything on your device, so they sit outside the consent question rather than being quietly exempted from it. Anything that does put something on your device is in the list above and behind a switch.

Vercel Web Analytics counts page views for us. It sets no cookie, writes nothing to your browser's storage, and builds no profile across sites.

Vercel Speed Insights measures how quickly pages load and respond, using figures your browser records about its own rendering. It sets no cookie, writes nothing to your browser's storage, and builds no profile across sites.

We also record a small number of events on our own servers, from our own code, when you deliberately do something: joining the waitlist, downloading a sample, or requesting a template. That happens after your request reaches us, so nothing is stored on your device and there is nothing to consent to under the cookie rules. What is collected and how long we keep it is covered by our privacy policy. The answer you give on the cookie notice is counted the same way, as one more in a daily total of how many times the notice was shown, accepted, rejected or customized, with no identifier, address, page or time of day attached, so we can tell whether the notice is working. It is a record of the notice, not of you, and it is kept whatever you answer.

Any new cookie, any new processor, and any new tracking technology is described here before it is switched on, and the effective date at the top is revised. Changes that a reasonable person would want a say in also raise the policy version recorded in your consent cookie, which asks you again rather than treating an old answer as covering something new.

That is not a promise anybody has to remember to keep. The list above and the section that follows it are generated from the same registration a tracker has to carry in our code before it is allowed to load at all, so a tool that is not described on this page cannot run, and one that is described wrongly fails our tests rather than our visitors.

One rule survives every version and every expiry: a refusal carries forward. If you turned something off, neither raising the version nor the passage of time turns it back on. Only you can.

WarehouseSOP is operated by Sales Xceleration Strategies LLC, a Colorado limited liability company, and that company is the controller of the storage described on this page. Questions about this policy go to support@warehousesop.com. Our privacy policy covers everything else we collect, why, and who processes it.