WebberUI Cookie Policy

1. Who We Are and What This Policy Covers

1.1 WebberUI (the "Site", available at webberui.com) is a service operated by Teyra LLC ("we", "us", "our"), a limited liability company formed in Wyoming, United States, with its registered business address at 30 N Gould St Ste N, Sheridan, WY 82801, United States. This Cookie Policy explains which cookies and similar technologies the Site uses, why we use them, and how you can control them.

1.2 This policy covers the Site only. It does not — and cannot — cover components you install from our registry into your own projects, because installed components contain no cookies, no beacons, and no tracking of any kind. They never contact our servers, never report anything back, and can never be remotely disabled. That is a core promise of our License Agreement (/license) and Privacy Policy (/privacy), and we repeat it here.

1.3 Companion documents: Privacy Policy (/privacy), Terms of Service (/terms), License Agreement (/license), Refund & Billing Policy (/refunds), and our Subprocessors list (/subprocessors). This page lives at /cookies.

2. What Cookies and Similar Technologies Are

2.1 "Cookies" are small text files a website stores in your browser. A "session" cookie is deleted when you close your browser; a "persistent" cookie stays until it expires or you delete it.

2.2 "Local Storage" is a separate storage area in your browser. Unlike cookies, its contents are not automatically attached to requests sent to a server — a page's own code has to read it. We use Local Storage for one analytics identifier (Section 3) and for several purely local conveniences that never leave your browser (Section 4).

2.3 We keep the list deliberately short. If a technology is not listed on this page, we do not use it.

3. The Complete List of Cookies We Use

3.1 Our own application code sets no cookies at all. Every cookie on the Site comes from one of four systems: Clerk (our sign-in provider), PostHog (our analytics tool), Google (Google Analytics 4 and advertising, shown only to non-Pro visitors — see Sections 3.6 and 3.7) and, on the checkout page only, Paddle (Section 3.8). A third measurement service, Cloudflare Web Analytics, also runs on the Site but sets no cookies whatsoever — see Section 3.5.

3.2 Clerk sign-in cookies (strictly necessary). Clerk cookies exist only so that signing in works. Signing in is never required to browse the Site or to install free-tier components — the free tier needs no account, and therefore no sign-in cookies. When sign-in is enabled, the Clerk SDK manages its own cookies; some may be set when the sign-in system loads, before you actually sign in. They are used solely for authentication and session security.

3.3 PostHog analytics — exactly how it is configured.

• If our analytics key is not configured in a deployment, no analytics code runs at all: no requests, no cookie, no Local Storage entry.
• The identifier is random and pseudonymous. We never call PostHog's "identify" function anywhere in our code, so the analytics ID is never linked to your Clerk account, your name, or your email — not at sign-in, not ever.
• Session recording (replay) is disabled. Autocapture is disabled. In-app surveys are disabled. "Dead click" capture is disabled. Pageviews are sent manually by our own code; page-leave events are enabled.
• The events we capture are a fixed, named list: pageview; component viewed; install command copied; composer opened; pricing page viewed; pricing scope switched; checkout clicked; email subscribed (this event records only which page the form was on — never the email address itself); documentation scrolled to 75%; a Pro item returning a 401; and Web Vitals performance metrics.
• Event details are limited to things like component, template, or documentation slugs, page type, referrer, and performance numbers. They never include your email, name, or account identity.
• Analytics data is processed on PostHog's servers in the United States. See the Privacy Policy (/privacy) and Subprocessors (/subprocessors) for cross-border transfer details.

3.4 Hosting. The Site runs on Cloudflare. Nothing in our own code or configuration sets Cloudflare cookies. Whether Cloudflare's edge sets an operational cookie of its own (for example, a bot-management cookie) depends on account-level settings outside our codebase. As configured on 2026-08-13, Cloudflare Bot Fight Mode is turned off on webberui.com and we subscribe to no bot-management product, so no __cf_bm cookie is set. Should we enable such a feature later, any cookie it sets would serve security and abuse prevention only, would be set by Cloudflare rather than by our code, and we would not use it for tracking.

3.5 Cloudflare Web Analytics — cookieless, and listed here for completeness. Our Cloudflare zone serves a traffic and performance beacon (static.cloudflareinsights.com/beacon.min.js) that reports to a first-party endpoint on our own domain. It sets no cookie, writes nothing to Local Storage or Session Storage, and assigns you no identifier — it is cookieless by design and cannot recognize you across visits or across sites. It appears in this policy not because it stores anything on your device, but because you should know everything that runs on the page. Content blockers block it, and the Site works fully without it.

3.6 Google advertising (AdSense) — non-Pro visitors only. Pages that show ads load Google's AdSense script. Google, not our code, may then set or read advertising cookies and similar identifiers to select, deliver and measure ads and to protect against invalid traffic. Names and lifetimes are controlled by Google and can change; see https://policies.google.com/technologies/partner-sites. These cookies are not set for signed-in Pro subscribers. In the EEA, the UK and Switzerland, advertising storage and personalisation default to denied and Google's consent message (a Google-certified consent management platform) asks for your choice before cookies or identifiers are used for personalised ads or measurement. Elsewhere, advertising defaults to allowed; in US states with privacy laws you can opt out of the sale or sharing of personal information through Google's US state regulations message or by sending a Global Privacy Control signal, which makes our pages request non-personalised ads. For advertising, we do not receive this data or send Google account or PostHog identifiers. Google Analytics is described separately in Section 3.7.

3.7 Google Analytics 4. After you allow analytics, we load Google Analytics to measure page visits and traffic sources. It uses first-party _ga and _ga_2YQEYRRC5J cookies, configured to expire after one year (renewed on activity). Our Google tag uses Consent Mode v2: analytics storage defaults to denied everywhere, and allowing analytics grants only analytics storage. Our analytics choice never changes advertising consent, which follows Section 3.6. Depending on the enabled GA4 enhanced-measurement settings, Google may also measure scrolls, outbound clicks, searches, video, downloads and form interactions. Google signals and advertising personalization are disabled in our tag. We do not send account IDs or email addresses. Rejecting or withdrawing analytics disables this stream and removes its cookies; DNT/GPC also blocks it. Previous PostHog-only permission does not enable Google Analytics: we ask again, while preserving previous rejections. Google’s data practices are described at https://policies.google.com/technologies/partner-sites.

3.8 Paddle checkout (strictly necessary for payment). The checkout page loads Paddle.js, the script of our merchant of record, Paddle.com Market Limited, to display the payment form. Paddle.js and its checkout are set up and operated by Paddle; it may store or read cookies and similar identifiers needed to process the payment, prevent fraud and comply with tax rules. These are strictly necessary for completing a purchase and are governed by Paddle’s own privacy and cookie notices; their names and lifetimes are set by Paddle and may change. Paddle.js is not loaded on other pages, and no payment cookie is set unless you open checkout.

3.9 Cloudflare Turnstile. The early-access email form (currently closed) embeds Cloudflare Turnstile, a bot-detection challenge run by Cloudflare. Our code sets no cookie for it; any storage Turnstile uses is controlled by Cloudflare under its own policy.

4. Local Storage That Never Leaves Your Browser

4.1 The Site keeps a few conveniences in Local Storage. These are stored only on your device. Our servers never receive them, and we keep no server-side copy:

4.2 Playground parameters. Settings you adjust in component playgrounds are held in memory only. They are not written to cookies or Local Storage, and they disappear when you leave the page. Nothing is stored, locally or on our servers.

4.3 You can remove the saved-items keys with one click on the account settings page ("clear local saved items"), or clear everything through your browser's site-data settings. Doing so affects nothing except your own local lists and theme.

5. What We Do Not Do

5.1 To be explicit, on the Site there are:

• No advertising cookies, pixels, or tags of our own. The only advertising technology on the Site is Google AdSense (Section 3.6), shown to non-Pro visitors and never to Pro subscribers.
• No cross-site tracking or profiling by us. Google may use its advertising cookies as described in Section 3.6, subject to your consent choices where Google's consent message applies.
• No data exchange with advertising networks beyond what Google AdSense collects directly from your browser when an ad is requested; we send Google no data about you and receive none from it.
• No selling, renting, or trading of any data collected through cookies or Local Storage.
• No session recording or replay.
• No linking of the analytics identifier to your name, email, or account.
• No cookies, beacons, telemetry, or "phone home" mechanisms in installed components. Code you install from WebberUI runs entirely inside your own project and never reports back to us.

6. How to Control Cookies

6.1 Browser settings. Every major browser lets you block or delete cookies, per site or globally, and clear Local Storage under "site data".

6.2 Content blockers. Ad and tracker blockers typically stop the PostHog analytics cookie, the Google advertising requests and their cookies entirely. You can also manage ad personalisation at https://adssettings.google.com/, or subscribe to Pro to remove ads. This does not break the Site: every feature works with analytics blocked.

6.3 Do Not Track and Global Privacy Control. Consistent with our Privacy Policy, we treat your browser's "Do Not Track" (DNT) and Global Privacy Control (GPC) signals as an opt-out from analytics. Both signals are checked before any analytics script is initialized.

6.4 Changing your analytics choice. Use the "Analytics cookie settings" control in the Site footer at any time. Rejecting analytics stops capture immediately and removes this PostHog project's cookie and browser-storage identifiers. You can also clear the Site's data in your browser.

6.5 Clearing Local Storage. Use the "clear local saved items" button on the account settings page, or your browser's site-data controls.

6.6 What happens if you block things.

• Blocking the analytics cookie: nothing breaks. All features keep working.
• Blocking Clerk's cookies: you will not be able to sign in or stay signed in. Sign-in matters only for Pro access and account features; free-tier components require no account, no sign-in, and therefore no cookies at all. Command-line installs authenticated with a Pro license key send the key in an Authorization header, not in a cookie, so they are unaffected by cookie settings.
• Blocking Local Storage: saved items, your custom theme, and your light/dark preference will not persist between visits. Everything else works.

We also store webberui:search-intro:v1 in Local Storage after you dismiss the search introduction or open search, so the introduction does not repeat. This preference is not an analytics identifier. Search names and descriptions are matched locally in your browser; these queries are not sent to an AI service.

7. Your Consent Choices

7.1 When analytics is configured, first-time visitors in every country are asked to choose whether to allow analytics. PostHog stays disabled until they affirmatively consent. If the browser sends a DNT or GPC signal, we honor it as a rejection without asking again.

7.2 Visitors without a saved choice or a DNT/GPC signal see a consent prompt before any PostHog script, request, cookie, Local Storage identifier, or analytics event is created. "Essential only" records a denial and leaves PostHog disabled. "Allow analytics" records consent and then initializes PostHog. The two choices have equal visual prominence, and rejecting analytics does not affect Site functionality.

7.3 A stored choice is honored on later visits. The footer control lets you change it; withdrawing consent stops capture and deletes this PostHog project's identifiers. DNT and GPC override a stored grant and keep analytics disabled. Strictly necessary Clerk cookies are not controlled by this analytics choice because they are used only for the sign-in feature.

8. Changes to This Policy

8.1 When our cookie usage changes, we update this page and the "Last updated" date at the top. Material changes — a new cookie category, a new provider, or a new purpose — will be flagged prominently on this page, and any new cookie-setting provider will also be added to the Subprocessors list (/subprocessors). We will not quietly weaken a promise made here.

9. Contact

9.1 Questions about this policy, or requests concerning your data: official@teyrallc.com. Your rights to access, correct, or delete personal data are described in the Privacy Policy (/privacy).

9.2 WebberUI is a service of Teyra LLC.