Cookies
One session cookie, strictly necessary
Why there is no cookie banner
Because there is nothing to ask you about. Wander sets no advertising cookies, no analytics cookies and no third-party trackers. The cookies below are strictly necessary to authenticate your session, and those do not require consent under the ePrivacy rules or the GDPR.
If that ever changes, a banner will appear, it will default to off, and this page will be updated to say exactly what changed and when.
The cookies we set
| Name | What it does | Expires |
|---|---|---|
| wander.session-token | Signs you in and keeps you signed in between page loads. A cryptographically signed token that identifies your session. httpOnly and Secure, so no script can read it and it is never sent over plain HTTP. | 30 days, or when you sign out |
| authjs.callback-url | Remembers the page to return you to after sign-in, so you land where you were headed. | Session (cleared when the browser closes) |
| authjs.csrf-token | Protects the sign-in form against cross-site request forgery. Set by the authentication library and verified on every sign-in request. | Session (cleared when the browser closes) |
Third parties
If you subscribe, you are redirected to a Stripe-hosted checkout page. Stripe sets its own cookies on that page, which are necessary for the payment flow and are covered by Stripe's own cookie policy. No Stripe cookie is set on wandertrip.org unless you begin a checkout.
Wander does not use Google sign-in or any third-party OAuth provider at this time. If that changes, this section will be updated.
Controlling cookies
Your browser can block or delete any cookie. If you block wander.session-token, you will not be able to sign in, because the site has no other way to know it is still you between two page loads. Every marketing and informational page on the site works without any cookies.
Most browsers let you view and delete cookies by going to Settings, then Privacy or Site Settings. Your browser's documentation has the exact steps.
Questions go to privacy@wandertrip.org. The rest of what we collect is on the privacy page.