Cookies, without guesswork.

Your optional analytics choice

Google Analytics is off unless you accept it. Before acceptance, or after rejection, we do not load the Google Analytics tag, send cookieless Analytics pings or set Analytics cookies. No advertising cookie or pixel is introduced by this configuration.

The first-party cookies _ga and _ga_<stream identifier> distinguish browser visits and maintain measurement session state. We configure a maximum lifetime of 90 days without renewing that lifetime on each visit. Browser controls may shorten it. These random identifiers are sent to Google only after analytics consent.

The local-storage entry wildryn.analytics-consent.v1 remembers only your accepted/rejected choice, its version and timestamp. The choice is valid for up to 90 days; an expired or invalid entry is removed when this website next checks it. The entry can remain in a closed browser until your next visit or until you clear browser data. It contains no email address or tracking identifier. This preference is separate from the form’s launch-email permission. Missing, invalid or expired choices keep analytics off.

Use Cookie settings in the footer to change your choice. Rejecting removes this installation’s Analytics cookies and stops collection. Clearing your browser storage also removes the remembered choice. You do not need to accept analytics to use the waitlist. More about Analytics processing.

Waitlist and provider pages

The waitlist requests your email only when you submit the form. Analytics choice is separate from launch-email permission; we do not send your address or Klaviyo confirmation token to Analytics. No Klaviyo tracking SDK or advertising pixel is installed on this website.

Confirmation and unsubscribe links open Klaviyo-hosted services, which have their own technical security and diagnostic processing. In our isolated confirmation test on 15 October 2026, Cloudflare’s __cf_bm cookie was observed on .kmail-lists.com, expiring after 30 minutes of inactivity. Klaviyo’s provider page also used its consent-page scripts, Google Fonts and Sentry diagnostics. This test is not a guarantee about every provider feature or future change. See Klaviyo’s cookie policy, its subprocessors and Cloudflare’s cookie description.

Questions about your choices: hello@wildryn.dog. Administrator authentication and requested security checks are distinct from optional audience measurement.

First-party anti-spam protection

When you press Join waitlist, our website runs a short automated proof-of-work check using the self-hosted, open-source ALTCHA library. The code and challenge are served by WILDRYN. We do not use ALTCHA Cloud, contact an ALTCHA service, or load Cloudflare Turnstile for this form. The check does not set cookies, save browser identifiers, fingerprint your device or grant permission for analytics.

Our server signs a challenge, ties it to the requested email using a keyed hash, and checks the solution before contacting Klaviyo. Challenges expire after five minutes. Upstash Redis holds short-lived random challenge identifiers, keyed hashes of email addresses and IP addresses, and request counters to reject reused checks and limit repeated submissions. We do not send raw form email addresses or visitor IP addresses to Upstash in these records. Keyed hashes are pseudonymous information, not a claim of anonymisation. These security records expire automatically within ten minutes.

The Redis database is configured in London. Upstash, Inc. is a US provider; support, security logs, backups and subprocessors may involve international processing. See its privacy policy and data processing addendum for processing and transfer safeguards. Vercel still receives connection information when hosting the website. We rely on our legitimate interest in securing the requested signup service for this limited anti-spam processing, not on optional advertising or analytics consent.

No extra security checkbox is required. If the check cannot complete, you can retry or email hello@wildryn.dog to request launch emails instead. We do not log raw email addresses, proof payloads, connection addresses or private keys in the website’s application logs.