Cookie Policy
Last updated: July 15, 2026
We use cookies to keep the service secure and to remember that you are logged in. We do not run analytics without your consent, and we do not keep your language or theme in cookies. Below is exactly what, why and how to manage it.
1. Introduction
This Cookie Policy sets out how Wombato (the “Service”) uses cookies and similar technologies. It complies with:
- Regulation (EU) 2016/679 (GDPR),
- the Polish Personal Data Protection Act of 10 May 2018,
- the Polish Telecommunications Act of 16 July 2004 (Art. 173).
2. What cookies are
Cookies are small text files saved on your device while you use the Service. They let us recognise a device and remember selected information - for example that you are logged in.
Alongside cookies we also use browser storage (localStorage) to remember your chosen theme (light/dark). That is not a cookie and is not sent to anyone.
3. Data controller
The controller of personal data processed in connection with cookies is Kamil Grabowski, operating at: ul. Bydgoska 6, 30-056 Kraków, Poland, NIP: 6612220368, REGON: 260231175. Contact regarding data: support@wombato.com.
4. Types of cookies we use
4.1. Essential cookies
Basis: Art. 6(1)(b) and (f) GDPR.
Necessary for the operation and security of the Service. They cannot be turned off and do not require consent. They are used to:
- keep the logged-in user's session,
- protect login and registration forms against abuse and bots,
- remember your cookie consent choice.
4.2. Analytics cookies
Basis: Art. 6(1)(a) GDPR (consent).
They help us understand how you use the Service (traffic, performance, UX). We enable them only after your explicit consent and you can refuse without losing any features. We use: Google Analytics (USA, transfer under SCC), our own Umami instance hosted in the EU, PostHog (EU region) and Microsoft Clarity (USA, transfer under SCC, session recordings and heatmaps).
Analytics is disabled for now. Until the consent banner is in place, the Service uses only essential cookies. This section describes the state once consent is enabled.
5. Detailed list of cookies
| Purpose | Provider | Category | Duration |
|---|---|---|---|
| Keeping you logged in | Wombato | essential | Session duration |
| Protecting the session against abuse | Wombato | essential | Session |
| Anti-bot verification (login forms) | Wombato | essential | Short-lived |
| Remembering your consent choice | Wombato | essential | 12 months |
| Traffic analysis | Google Analytics | analytics | up to 2 years |
| Anonymous traffic analysis | Umami (self-hosted EU) | analytics | up to 12 months |
| Product analytics (EU region) | PostHog | analytics | up to 12 months |
| Session recordings, heatmaps | Microsoft Clarity | analytics | up to 12 months |
Analytics cookies appear only after you give consent; their exact lifetimes may vary depending on the provider's configuration. You can see the names of individual cookies in your browser settings.
6. What we deliberately do not do
- We do not use advertising cookies, social network pixels or cookies for ad profiling.
- We do not sell cookie data and do not pass it to data brokers.
7. Consent and its withdrawal
Essential cookies work on the basis of Art. 6(1)(b) and (f) GDPR and do not require consent. We enable analytics cookies only after your explicit consent given in the banner.
You can change or withdraw consent at any time through:
- the cookie settings panel (link in the Service footer),
- your browser settings (deleting or blocking cookies).
Withdrawing consent does not affect the lawfulness of processing before its withdrawal.
8. Managing cookies in your browser
- Chrome: Settings › Privacy and security › Cookies
- Firefox: Settings › Privacy & Security › Cookies and Site Data
- Safari: Settings › Privacy › Manage Website Data
- Edge: Settings › Cookies and site permissions
Blocking essential cookies may prevent you from logging in and using some features.
9. Transfers of data outside the EEA
The Google Analytics and Microsoft Clarity analytics cookies may involve transferring data to the USA (Google LLC, Microsoft Corporation) based on Standard Contractual Clauses (SCC) approved by the European Commission.
Umami runs on our infrastructure in the EU and PostHog in the EU region - in those cases data does not leave the European Economic Area.
10. Retention period
The lifetimes of individual cookies are given in the table in section 5. They count from your last use of the Service; once they expire, the cookies are deleted or anonymised.
11. Your rights
As regards personal data processed through cookies you have the right to: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and withdrawal of consent at any time (Art. 7(3) GDPR). See the Privacy Policy for details.
12. Changes to the policy
We may update this Policy from time to time. We will announce significant changes through a banner in the Service and, for logged-in users, also by e-mail.
13. Contact
Questions about cookies and privacy: support@wombato.com. A real person replies, within 1-2 business days.