Cookie and Local Storage Policy
Last updated: 2 September 2026
This policy explains which cookies and browser storage mechanisms the WeHub service uses, and why. It complements the Privacy Policy.
1. Our approach
WeHub is a business tool, not an ad-funded content site. Therefore:
- No advertising cookies, no ad networks, and no third-party marketing trackers.
- No sale or sharing of browsing data with advertisers.
- The default is strictly necessary cookies only. Analytics will be enabled only if and when we decide to introduce it, and then an explicit consent request will be shown, with the ability to decline without losing functionality.
2. Cookie table
| Name | Type | Purpose | Duration | Party |
|---|---|---|---|---|
| `wehub.token` | Strictly necessary | The session token that identifies the signed-in user and enables secure access to the Service | Until sign-out, and at most 30 days from last sign-in (12 months in the mobile app) | First |
| `wehub.tenant` | Strictly necessary / functional | Remembers the selected active business, so that switching businesses and refreshing a page do not lose context. It is not a source of authority: permission is validated on the server on every request | 30 days | First |
| `wehub.theme` | Preference | Stores the chosen theme (light, dark or system) | 12 months | First |
| `wehub.locale` | Preference | Stores the interface language (Hebrew or English) and text direction | 12 months | First |
| `wehub.csrf` | Strictly necessary | Protects against cross-site request forgery in forms and sensitive actions | Session | First |
| `[wehub.analytics]` | Analytics, not active by default | Aggregate usage measurement to improve the product. Will be set only after explicit consent | [to be completed] | [to be completed] |
Session cookies are marked `HttpOnly`, `Secure` and `SameSite=Lax` or stricter, and are transmitted over HTTPS only.
3. Local storage in the browser and the app
In addition to cookies, we use `localStorage`, `sessionStorage` and encrypted storage on mobile devices, for operational purposes only:
| Key | Purpose | Note |
|---|---|---|
| Message drafts | Preserves typed but unsent text so it is not lost on refresh | Cleared on send |
| Last desk filters and sorting | Restores the working view | Local only |
| Cached workspace list and counters | Speeds up switching between businesses | Cleared on sign-out |
| Display preferences (density, text size, open panels) | Working comfort | Local only |
| Device push token (mobile) | Receiving notifications | Also stored on the server, linked to the user rather than to a business |
This information is stored on the device. Signing out clears session data and caches.
4. Third-party cookies
- Payment providers (HYP, Stripe): the payment page is hosted by the provider and may set its own cookies for security and fraud prevention. Those are governed by the provider's policy.
- Meta and our telephony and email providers: used server-side and do not set cookies in our interface.
- Cloudflare: used as an infrastructure and security layer and may set an operational cookie to prevent abuse.
5. Managing cookies
- Cookies can be deleted or blocked in browser settings. Blocking strictly necessary cookies prevents sign-in and use of the Service.
- Theme and language preferences can be changed at any time in the profile screen.
- If analytics is introduced, a consent banner will be shown with an option to decline and to change the choice later.
6. Updates
We will update this document when a cookie is added or its purpose changes. The version number and date at the top of the document will change accordingly.
Questions: [email protected].
---