Cookie Policy

A cookie is a small piece of text a website asks your browser to hold onto and send back on later requests. WS Ledger uses a small number of them, and none for advertising or tracking. All but one are strictly necessary — the site cannot function without them. The exception, wsl_theme, exists only if you choose a dark theme or “match my device”, and remembers that choice and nothing else. So there is no cookie banner asking you to opt in: under Maldivian and most other privacy law, consent is not required for cookies that only make the service you asked for work, or that remember a choice you made yourself.

The cookies we set

All of them are httpOnly (invisible to any script running on the page, including one injected by an attack) and, outside local development, Secure (sent only over https). None of them is readable by, or shared with, any other website.

• wsl_session — keeps you signed in. Set when you sign in, removed when you sign out, and expires on its own after a period your organisation’s administrator configures (12 hours by default). Signing in again always replaces it, so it is never reused across devices or sessions.
• wsl_2fa — set for the few minutes between entering your password and entering your two-factor code, so the second step knows which sign-in it belongs to. It holds a random token, never your password or your code, and expires after 10 minutes or as soon as you finish signing in, whichever comes first.
• wsl_webauthn_reg, wsl_webauthn_pwless and wsl_webauthn_2fa — set only while a passkey prompt (Face ID, Touch ID, Windows Hello or a security key) is open, so your device’s answer can be checked against the question we asked it. Each expires after 5 minutes.
• wsl_theme — set only when you pick a theme other than the default light one, from the menu under your name. It holds “dark” or “system” (match your device) and nothing about you; it lasts a year, and choosing light again removes it.

What we do not use

No advertising cookies, no analytics or behavioural-tracking cookies, and no cookies set by a third-party service embedded in the page — WS Ledger does not embed any. We do not use your browser’s local storage or session storage either; everything about your account lives on our servers, not in your browser.

When something breaks, an error report can be sent to our error-monitoring service (Sentry). It is sent through WS Ledger’s own address rather than from your browser to a third-party site, sets no cookie, and is configured not to collect personal data by default. It is described in the Privacy Policy.

The mobile app

The iPhone and Android app is not a browser and does not use browser cookies. It signs in to the same account and keeps the resulting session for up to 30 days, or until you sign out, in the phone’s own network layer. It uses no advertising or analytics software.

Controlling cookies

Because every cookie here is necessary for signing in, blocking them means you cannot use WS Ledger — the same as any site that requires an account. You can still clear them at any time from your browser’s settings; you will simply be asked to sign in again. Signing out, or using “Sign out of all devices” from your profile, removes the session cookie immediately rather than waiting for it to expire.

Changes to this policy

If the cookies WS Ledger sets change — a new one is added, or an existing one’s purpose changes — this page is updated and the date at the top moves. It is part of our Privacy Policy, which explains how we handle the wider set of data behind your account.

Questions

Write to [email protected].