Cookie policy | worldgovdata

01

The short version

A signed-out visitor to worldgovdata receives no cookies at all. You can browse every country page, ranking, chart and export without one being set.

Signing in sets two: one that holds your session, one that carries a token proving a form submission came from our own page. Both are strictly necessary for a service you asked for. There is no third cookie waiting to be switched on.

02

The cookies we set

Both are first-party, both are set only after you sign in, and both disappear when you sign out.

Every cookie worldgovdata sets, with its purpose, lifetime and attributes.
Name	What it does	Lifetime	Attributes
__Host-wgd_session	Holds an opaque session token so the server knows you are signed in. The token is random; we store only its SHA-256 hash, so the cookie is the only copy that exists in usable form. It carries no information about you.	30 days sliding, 90 days maximum	HttpOnly · Secure · SameSite=Lax · Path=/
__Host-wgd_csrf	A double-submit token. Every state-changing request must send the same value back in a header or a form field, which is what stops another site submitting a form as you. It must be readable by our own scripts, so it is not HttpOnly — and it is useless to anyone who cannot already read it.	Session	Secure · SameSite=Lax · Path=/

The names change on a local development server

The __Host- prefix is a browser-enforced hardening measure that requires the cookie to be Secure, which plain http://localhost is not. On such a server the same two cookies are named wgd_session and wgd_csrf. On the live site you will always see the prefixed names.

03

Preferences kept on your device, which are not cookies

Two settings are remembered in your browser’s local storage. They are not cookies: they are never attached to a request, so they never reach our servers, and we could not read them if we wanted to.

Browser local-storage keys, what they hold, and why they are not cookies.
Key	What it holds	Why
wgd-theme	Your theme choice: system, light or dark.	So the page does not flash the wrong palette on every load. Set only when you pick one.
wgd-docs-lang	Which language the documentation code samples show — cURL, JavaScript, Python, R or Go.	So you do not re-pick your language on every documentation page.

Clearing site data in your browser removes both. Nothing breaks: the theme returns to following your system setting and the samples return to cURL.

04

We count page views with PostHog so we can see which parts of the portal are useful. It is deliberately configured so that it cannot recognise you:

In-memory persistence. No cookie, no local storage, no device identifier. Anything it holds is gone when the tab closes.
Pageviews only. Autocapture, session recording and page-leave tracking are switched off. One event, carrying a path.
Do Not Track honoured. If your browser sends the signal, nothing is captured.
Optional entirely. A deployment with no analytics key configured collects nothing.

The cost of this is real: we cannot tell a returning reader from a new one, and our numbers are rougher than a tracking-based product’s would be. That is a trade we made on purpose. PostHog and the safeguards around it are named on the subprocessors page, and the legal basis is in the privacy policy.

05

Third parties that could set their own

We embed no social widgets, no comment systems, no advertising tags, no fonts loaded from somebody else’s server and no video players. Two exceptions exist, and both are narrow:

The payment checkout. When you open the checkout on account billing, the payment provider’s script loads and may set cookies within its own flow, under its own privacy notice. It loads on that one page and nowhere else, and it never loads for a visitor who is not buying credits.
The CDN. Our content delivery network may set a strictly-necessary cookie of its own to tell automated traffic from human traffic and to keep the site available under attack. It is not used for advertising and not used for cross-site tracking.

06

Controlling them

Your browser controls cookies, and we do not override it. Every major browser lets you view, block and delete them per site.

Deleting the session cookie signs you out. Nothing else is lost — sign in again and your account, keys, balance and history are exactly where they were.
Blocking cookies for this site means you cannot sign in at all: without a session cookie the server has no way to recognise you between two requests. Everything that does not need an account keeps working.
Signing out deletes both cookies immediately, and revokes the session on the server so a copy of the cookie is worthless.

The API itself uses no cookies at all. It authenticates with a bearer key on each request, so anything you build on it is unaffected by any of this.

07

Changes

If we ever needed to set a cookie that is not strictly necessary, we would ask for consent first — properly, with a real refuse option — and this page and the privacy policy would say so before it happened. Any change here bumps the version stamp at the top of the page. Questions: connect@worldgovdata.com.