Cookie Policy
What the website and the console store in your browser, what each item is for, and how to remove it.
Last updated 26 September 2026
The short version. waymail.app sets no cookies unless you accept analytics. If you do, Google Analytics sets two cookies on waymail.app to count visits; if you decline, or never answer, nothing is loaded from Google. The console remembers your selected workspace and setup preferences. Waymail's identity service sets a secure cookie for your sign-in. Nothing is used for advertising or to follow you across other sites.
1. What this policy covers
This policy covers cookies and similar browser storage — session storage and local storage — set by waymail.app, including the documentation, and by the Waymail console at console.waymail.app. It supplements the Privacy Policy, which says what we do with the data these items hold.
It does not cover the email our customers send through Waymail. Section 6 says where that is covered instead.
2. The website: waymail.app
The website and the documentation are static pages. The web host, Amazon CloudFront, keeps no access log of your visit. Unless you accept analytics, the pages set no cookies and load no scripts, fonts or other content from third parties.
Analytics, only if you accept. To learn which pages are read and how people find them, the website can use Google Analytics 4, loaded through Google Tag Manager. When it does, a banner asks you first, with accepting and declining side by side. Accept, and the page loads both from Google. Decline, or leave the banner unanswered, and nothing is loaded from Google. If the website has never asked you, analytics is not running.
If you accept, Google Analytics records the pages you view, the site or campaign that brought you, how far you scroll, the links you follow to other sites, the kind of device and browser you use, your approximate location — country and city, worked out from your IP address, which Google Analytics does not store — and whether you joined the waiting list. We never send it your email address or anything else that names you. Google signals and advertising features are switched off.
waymail.consent |
Local storage, set by waymail.app when you answer the banner. Your answer and when you gave it, so the website does not ask on every page. Strictly necessary to remember your choice. After six months the website asks again. |
|---|---|
_ga |
Cookie, set by Google Analytics, only if you accept. A random identifier that lets it count a returning visitor once. Set for waymail.app alone, so it is not sent to the console or the API. Expires 13 months after your last visit. |
_ga_… |
Cookie, set by Google Analytics, only if you accept, with a name ending in our Google Analytics measurement id. Keeps track of your current visit. Set for waymail.app alone. Expires 13 months after your last visit. |
The only other thing a page does in your browser is note, for its own styling, that scripts are running and whether you have asked your operating system for reduced motion. Neither is stored anywhere.
3. The console: console.waymail.app
The console needs to remember a few things to work at all. Its regular browser storage and sign-in cookies are listed here. Session storage belongs to one tab and is emptied when that tab closes; local storage lasts until you clear site data or the application removes an item.
waymail.console. |
Session storage. The credential you pasted to sign in — an API key, or a session token when running the console locally — so it is available on each request and no longer than the tab. If you sign in with a Waymail account, this entry is not used: the console asks Waymail's identity service for a short-lived token on every request. |
|---|---|
waymail.console. |
Session storage. Which region your workspace lives in, so the console talks to that region's API and your data does not cross to another. An API key carries its own region, so it is only needed for account sign-in. |
waymail.console. |
Session storage. Which workspace you are acting in, when you belong to more than one. |
waymail.console. |
Session storage. The setup step you last viewed in this tab, so a reload returns to it. |
waymail.console. |
Local storage. Remembers that you finished or skipped the optional setup guide; you can replay it. |
waymail.console. |
Local storage. Remembers that you dismissed the setup checklist for a workspace. |
waymail. |
Local storage. Holds a random retry key while a workspace is being created, so an interrupted request cannot create it twice. Removed after a confirmed success. |
| Waymail session cookie | Secure, HttpOnly cookie on auth.waymail.app. Holds a signed session identifier for up to seven days, refreshed with activity. It is removed when you sign out. |
| Temporary sign-in cookies | Waymail's identity service may set short-lived cookies for an authenticator or OAuth sign-in flow. They are used to complete and protect that flow, then expire or are removed. |
The session cookie, region and workspace selection, and setup retry key support sign-in and the actions you request. The guide and checklist entries are written when you finish or skip the guide, or dismiss the checklist. They remember those choices on this device; they are not needed to sign in or send email. None is used to track you, and none is shared with an advertiser or analytics service. The console runs no analytics.
4. Consent
The EU ePrivacy rules, and Norway's implementation of them in the Electronic Communications Act, require consent before anything is stored in your browser — except what is strictly necessary to provide a service you asked for. The console stores authentication and workspace information to provide that service. It also remembers the optional guide and checklist choices described above on this device; you can remove them using the instructions below. The website records your answer to its analytics question. Google Analytics is separate, which is why the website asks before loading it and loads nothing from Google until you accept.
Whenever the website offers analytics, Cookie settings in its footer lets you change your answer at any time. Declining removes Google Analytics' cookies from your browser, and a page that had loaded it starts again without it — in every tab you have open. There are no advertising cookies and no third-party tracking for advertising.
5. How to clear them
- Close the tab. Session storage is emptied with it, so your pasted credential, region and workspace choice are gone. Signing out clears them straight away as well.
- Sign out. Signing out of the console ends your Waymail identity session. Its cookies can also be removed through your browser's settings, under the site data for auth.waymail.app.
- Clear console choices. In your browser's site-data settings, remove the data for console.waymail.app. This clears the guide, checklist and workspace-creation retry entries listed above, along with that site's session storage. It does not remove the separate auth.waymail.app sign-in cookie; use Sign out for that.
- Change your analytics answer. Use Cookie settings in the website's footer. Clearing the site data for waymail.app in your browser removes both your answer and any Google Analytics cookies, and the website asks again on your next visit.
- Block them. You can block storage for console.waymail.app or cookies for auth.waymail.app in your browser. Blocking Waymail's authentication cookies means you cannot stay signed in; blocking session storage means the console forgets your region and workspace on every reload, and may ask for your credential again.
6. Email you receive from our customers
If a Waymail customer emails you, their message may contain an open-tracking image or click-tracking links. Those belong to the sender, are off unless the sender switches them on, and set nothing in your browser through this site. They are described in the Privacy Policy under Email sent through Waymail, which is the policy that covers them — not this one. The organisation that sent the email is the one to ask about it.
7. Changes
When this policy changes, we update the date at the top. If we add analytics or other optional tracking storage, we describe it here and ask for consent before setting it.
8. Contact
Questions about cookies or browser storage: hello@waymail.app. Our legal identity and postal address are on the Company Details page.