WinWinLabs
A cookie is a small file a website asks your browser to keep. We use them to sign you in, to remember the invite link you arrived through, and — if you allow it — to count how many people use which pages. On the free daily hunt's play pages, Google AdSense sets its own for the ads between steps. If you allow personalized ads, Google Ads may set its own on pages we advertise, to tell us whether people who came from our ads went on to apply or donate.
Two of the things we store are not cookies. Our own analytics keeps its ids in your browser's local and session storage instead, which a cookie inspector will not show you. They do the same job, they are listed here with everything else, and the same switch turns them off.
Everything we set is listed below, by category — cookies and browser storage alike. You can change your mind about the optional categories at any time.
Right now: strictly necessary, functional. You have not made a choice yet, so only the categories that need no permission are running.
Signing in, staying signed in, getting back to the page you came from, and showing you whether a payment went through. The site does not work without these.
| Name | Set by | Lasts | What it is for |
|---|---|---|---|
ci_session
|
CodeIgniter session | Until you close the browser | Keeps you signed in for the length of a visit. On the development slots the port number is appended to the name so two slots do not sign each other out. |
wwl-token / wwl-refresh
|
libraries/Wwl_auth.php | Access token minutes; refresh token weeks | Signs you in once across winwinlabs.com and winwinlabs.org instead of once per site. |
bStatus
|
controllers/Buycredits.php | 10 to 20 seconds | Carries the result of a card or bank payment across the redirect back from the processor, so the page can tell you whether it worked. |
s / rval
|
assets/js/gsdk-bootstrap-wizard.js | Until you close the browser | Holds the state of the multi-step sign-up form between steps. |
wwl_consent
|
helpers/consent_helper.php | 12 months | Remembers the choice you made on the cookie banner. Without it we would have to ask on every page. |
wwl_debug_mode
|
controllers/Admin.php | 30 minutes | Staff only, and cryptographically signed. Turns on diagnostic output for one administrator for half an hour. |
wwl_has_account
|
views/layouts/nav.php | 12 months | Remembers that someone has signed in on this device, so once signed out the header offers Login rather than Register. Holds only "1", nothing about who. |
Remembers the invite or campaign link you arrived through, so the right person is credited and the right page is shown. First-party only -- nothing leaves WinWinLabs.
| Name | Set by | Lasts | What it is for |
|---|---|---|---|
referral
|
helpers/campaign_helper.php | 7 days | Remembers the invite code you arrived with, so the person who invited you is credited when you finish signing up. |
wwl_vid
|
libraries/Landing_experiment.php | 30 days | An anonymous id for this browser, so that if we are trying two versions of a page you keep seeing the same one, and so we can tell whether it worked. Not linked to your name, and never sent to anyone else. |
wwl_campaign_ctx
|
controllers/Home.php | 7 days | Remembers which campaign link brought you here, so the sign-up page shows the cause you clicked on rather than a generic one. Survives the gap between signing up, verifying your email, and first signing in. |
How the site is used. Our own tracker, which records the pages you open, what you click and how far you scroll, and stays with us; plus Google Analytics, which sends your IP address and browsing to Google.
| Name | Set by | Lasts | What it is for |
|---|---|---|---|
_wvid
Not a cookie — stored in your browser's localStorage |
assets/js/wwl-tracker.js | 30 days | Our own analytics. An anonymous id for this browser, so a returning reader is not counted as a new one. Stays on your device and is sent only to us. |
_wsid
Not a cookie — stored in your browser's sessionStorage |
assets/js/wwl-tracker.js | Until you close the tab | Our own analytics. Groups the pages you view in one sitting so a visit can be read as a visit. |
_ga
|
Google Analytics 4 (G-0HY2TZ0GEL), loaded by Google Tag Manager GTM-KSLM9S7 Third party |
2 years | Google Analytics. Distinguishes one visitor from another so a returning reader is not counted twice. |
_ga_0HY2TZ0GEL
|
Google Analytics 4 (G-0HY2TZ0GEL), loaded by Google Tag Manager GTM-KSLM9S7 Third party |
2 years | Google Analytics. Holds the state of your current session for this specific property. |
The free daily hunt shows a short ad between steps, served by Google AdSense, and no other page shows ads. With this on, Google may choose the ad from what it knows of your browsing. With it off you still see ads there, but chosen from the page and not from you; Google still sets cookies to limit how often an ad repeats and to stop fraud. With this on, pages we advertise with Google Ads may also load Google's ad measurement code, which tells us whether people who came from our ads went on to apply or donate. With it off, that code is not loaded at all.
| Name | Set by | Lasts | What it is for |
|---|---|---|---|
__gads / __gpi / __eoi
|
Google AdSense (adsbygoogle.js), on the daily hunt play pages only Third party |
Up to 13 months (__eoi: 6 months) | Google AdSense. Count how often you have seen an ad, stop fraud and, if personalized ads are on, choose ads for you. |
IDE
|
Google AdSense, on the daily hunt play pages only Third party |
Up to 13 months in Europe, 24 months elsewhere | Google AdSense, on doubleclick.net. Used to show personalized ads and measure them. |
_gcl_au / _gcl_aw
|
Google Ads code, on pages we advertise only Third party |
90 days | Google Ads measurement. Remembers that you came from one of our ads, so a later application or donation can be counted for that ad. |
If your browser or an extension sends the Global Privacy Control signal, we treat it as you telling us not to share your information with third parties: analytics is switched off before anything loads, and the daily hunt's ads are not personalized, without you having to click anything.
It keeps working even if you have said yes here before. A choice you made last month cannot be an answer to a signal your browser is sending today, so while it is being sent, analytics and personalized ads stay off whatever the switches say. Everything first-party still follows your own choice, and analytics and personalized ads follow it again as soon as your browser stops sending the signal.
We do not sell personal information. The only ads are on the free daily hunt's play pages, and they are personalized only if you allow personalized ads. The control is in the footer of every page; it opens your choices, where personalized ads and analytics can be switched off.
Every browser can block or delete cookies, and you do not need our permission. Be aware that blocking the strictly necessary ones will stop you being able to sign in, because the sign-in session is a cookie.
Our Google Tag Manager container holds exactly two tags, both Google Analytics: the base tag and one event that records when somebody opens the campaigns page. If that ever changes, this page changes with it.
How cookie data fits into everything else we hold is in the Privacy Policy.
Questions about this page? Email [email protected]. WinWinLabs is a 501(c)(3) non-profit; our IRS number is 84-4720243.
Legal notices and anything in writing: WinWinLabs, 11961 Amherst Ct, Plymouth, MI 48170.