Privacy-First

Cookie & Storage Policy

The full inventory, key by key. Only essential cookies for authentication and security, plus your browser's storage for your preferences and encrypted data. No tracking, no third-party analytics, no advertising.

Our Commitment to Privacy

WIGGWIGG is built on zero-knowledge architecture. We use the bare minimum needed for security and for the service to work. This page lists all of it, including the corners most policies quietly skip: IndexedDB, the service worker cache, and what the marketing site itself writes. If you spot something missing, tell us and we'll fix it.

Cookies We Use

Four cookies for the app, plus three signing cookies issued by our CDN the moment you open an attachment. None are advertising cookies, none are for tracking, and none belong to a third party.

Session Authentication Token

wiggwigg_session_token
Purpose: Keeps you signed in to your WIGGWIGG account
Duration: 7 days to start, then a sliding idle window that extends up to 30 days as you keep using the app. Hard ceiling of 90 days from sign-in, after which you sign in again.
Type: HttpOnly, Secure, SameSite=Lax
Scope: Domain: .wiggwigg.ca (shared with the app's subdomains), path: /
Security: Not readable by JavaScript (script-injection protection)
Required: No. Required for authentication.

Refresh Token

wiggwigg_refresh_token
Purpose: Renews your session without asking for your password again
Duration: Up to 30 days, sliding as you use the app, under the same 90-day ceiling. It's replaced (and the old one invalidated) on every renewal.
Type: HttpOnly, Secure, SameSite=Lax
Scope: Domain: .wiggwigg.ca, path: /
Security: Not readable by JavaScript (script-injection protection)
Required: No. Required for session management.

New Tab Authentication Mode

wiggwigg_new_tab_auth_mode
Purpose: Remembers which mode you picked for opening a new tab: seamless access, or maximum security
Duration: Matches your "Max session age" setting (7 days by default)
Type: Secure, SameSite=Strict
Scope: Path: /
Security: Deliberately readable by JavaScript: the app has to know your choice before it unlocks anything. It holds nothing but the word "seamless" or "maximum_security", never sensitive data.
Required: Yes. It's only written when you pick a mode in Settings, Security.

Preferred Language

preferredLang
Purpose: Remembers whether you want the site and app in French or English
Duration: 1 year
Type: SameSite=Lax
Scope: Path: /
Security: Neither HttpOnly nor Secure, because it holds nothing but a language code ("fr" or "en") that both the browser and the server read. No identifier, no personal data.
Required: Yes. It's only written if you change languages with the switcher.

Attachment Delivery Cookies

CloudFront-Policy, CloudFront-Signature, CloudFront-Key-Pair-Id
Purpose: Let your browser download your own attachments (voicemail, picture messages) from our delivery network
Duration: 1 hour, then reissued on demand
Type: HttpOnly, Secure, SameSite=Lax
Scope: Domain: .wiggwigg.ca (to reach the media subdomain), path: /
Security: They carry no data: only a signed, time-limited authorization scoped to your own files. Another account can't do anything with them.
Required: No, but they're only issued when you open an attachment.

What We Don't Use

Analytics cookies (e.g., Google Analytics)

Advertising or marketing cookies

Social media tracking pixels

Third-party tracking cookies

Behavioral tracking of any kind

Performance monitoring cookies

A/B testing cookies

A consent banner designed to wear you down: there's nothing here to refuse

Performance measurement: optional, off by default

If you turn it on yourself in Settings, Account, the app sends page-speed measurements (load time, responsiveness, layout stability) to our own observability server. It uses no cookies, attaches no user or session identifier, and page addresses are normalized to strip identifiers before anything is sent. Nothing leaves your device until you switch it on.

Session Storage (Cleared When the Tab Closes)

Session storage holds temporary data for the current tab. All of it is deleted automatically when you close the tab, and signing out wipes it immediately. Nothing survives from one session to the next.

Session Management

Session Token Expiry Time

wiggwigg_token_expiry
Purpose: Stores when your session token expires, for display only. The token itself lives in an HttpOnly cookie.
Contains: ISO timestamp string
Security: Non-sensitive metadata

Refresh Token Expiry Time

wiggwigg_refresh_expiry
Purpose: Stores when your refresh token expires, for display only
Contains: ISO timestamp string
Security: Non-sensitive metadata

User ID

wiggwigg_user_id
Purpose: Stores your user ID for requests to the API
Contains: Your unique identifier
Security: Technical identifier, no personal data

Account ID (Username)

wiggwigg_account_id
Purpose: Stores your username for the anti-phishing display
Contains: Your WIGGWIGG username
Security: Used by a security feature (anti-phishing)

Current Session ID

wiggwigg_session_id
Purpose: Lets a new sign-in replace your previous session without the server having to fingerprint your device
Contains: Session identifier
Security: In seamless mode it lives in local storage instead, so your tabs can share it

Lock State

wiggwigg_lock_state
Purpose: Tracks whether your session is locked, so the unlock screen comes back at the right moment after a refresh
Contains: "locked" or "unlocked"
Security: No sensitive data

Session Key (it does not protect your master key)

An important correction to earlier versions of this page: your master key is never written to session storage anymore, not even encrypted. The ciphertext and the key that unlocked it lived in the same place, which offered no real protection against an injected script. That path is gone, along with the attempt counters that went with it: rate limiting is now enforced by the server, where it can't be bypassed from the browser. The session key below only encrypts local caches now.

Session Encryption Key

wiggwigg_session_key
Purpose: Random key that encrypts local caches: search history, number reservation, password health results
Contains: 256-bit AES-GCM key
Security: Generated per tab, cleared when the tab closes. It can't unlock anything in your vault.

Encryption Salt

wiggwigg_encryption_salt
Purpose: Salt used to verify your password at unlock time
Contains: Cryptographic salt (random bytes)
Security: Public value, safe to store

Password Verification Signature

wiggwigg_password_verification_sig
Purpose: Lets us confirm your password is the right one at unlock, without ever storing the password
Contains: HMAC-SHA256 signature
Security: Can't be reversed into your password. In seamless mode a copy also lives in local storage so offline unlock works.

Preferences Cache

User Preferences Cache

wiggwigg_preferences_cache
Purpose: Caches your preferences so the interface renders instantly, before decryption finishes
Contains: Theme, language, onboarding step, audio preferences, and so on
Security: Display preferences, no sensitive data

Anti-Phishing Display Cache

wiggwigg_anti_phishing_cache
Purpose: Caches your anti-phishing settings so they show up on the sign-in screen itself
Contains: Display flags (phrase, colors, avatar, audio)
Security: Display preferences, no sensitive data

Vault: Cache and Password Health

The check on your saved passwords (duplicates, weak ones, known breaches) runs entirely in your browser. The breach lookup uses k-anonymity: your password is hashed on your device and only the first 5 characters of that hash ever leave it, relayed through our own CDN. Neither we nor the breach database sees the password or the full hash.

Decrypted Vault Cache

wiggwigg_vault_entries
Purpose: Keeps your vault entries decrypted across a page reload so the list doesn't have to be fetched and decrypted from scratch every time
Contains: Your vault entries, encrypted with the session key before being written
Security: Expires after 30 minutes, cleared when the tab closes and on sign-out. Unreadable without the session key, which never leaves the tab.

Known-Breach Catalog

wiggwigg_breach_db, wiggwigg_breach_db_ts
Purpose: Caches the public catalog of known breaches (names, dates, what was exposed) so we can explain a result instead of just flagging it
Contains: Public information about breaches that have already been disclosed, plus the time it was fetched
Security: Nothing about you. This is the same public catalog everyone gets, cached so we don't refetch it on every page.

Health Check Results

wiggwigg_ch_store
Purpose: Avoids recomputing everything each time you open the vault
Contains: The verdict per entry (strength, duplicate, breached), encrypted with the session key
Security: Encrypted, cleared when the tab closes and on sign-out

Background Computation State

wiggwigg_ch_worker
Purpose: Resumes the check where it left off instead of starting over
Contains: Computation progress, encrypted with the session key
Security: Encrypted, cleared when the tab closes and on sign-out

Breach Lookup Cache

wiggwigg_ch_breach
Purpose: Avoids repeating the same breach lookups during your session
Contains: Per-entry results, encrypted with the session key
Security: No password and no full hash appears here, or anywhere on the network

Checkout

Temporary data while you're buying something. Expired reservations are cleaned up automatically when the app loads.

Phone Number Reservation

wiggwigg_phone_reservation
Purpose: Holds the number while you complete payment, so nobody else claims it in the meantime
Contains: Reserved number, expiry time, plan details
Security: Encrypted with the session key as soon as a session exists. During sign-up, before a session is established, it's in the clear. Deleted automatically at expiry.

Pending Credit Refill

wiggwigg:pending-refill-intent:v1
Purpose: Remembers the refill you started so the app can pick it back up when you return from the payment page
Contains: The amount and the kind of refill you chose
Security: No card details, ever. Payment information goes straight to our payment processor and never touches your browser storage.

Account Recovery

Only during the recovery flow, and only in the tab where you're running it.

Pending Recovery Request ID

pending_recovery_id
Purpose: Temporary storage during the account recovery flow
Contains: Recovery request ID
Security: Temporary flow data

Recovery Expiry Time

pending_recovery_expires
Purpose: When the recovery request expires
Contains: ISO timestamp
Security: Non-sensitive metadata

Username Being Recovered

recovery_account_id
Purpose: Remembers which account is being recovered between steps
Contains: Account username
Security: Temporary flow data

Recovery Wrap

recovery_wrap
Purpose: Carries your vault key, re-encrypted for your new password, between two screens of the same flow
Contains: Encrypted material, useless without your recovery key
Security: Cleared as soon as the flow ends and when the tab closes

Recovery Phrase Being Displayed

recovery_mnemonic
Purpose: Holds the recovery phrase long enough for you to write it down and confirm it, across two screens of the same flow
Contains: Your recovery mnemonic phrase
Security: This is the one moment something this sensitive touches browser storage. It never leaves the tab, is never sent to the server, and is erased the moment the flow ends or the tab closes.

Interface State

Small display flags, no personal data. These replaced the old attempt counters, which now live on the server.

Selected Tabs and Filters

ww:filter:<view>
Purpose: Keeps the tab, sort order, and filters you had chosen when you come back to a page
Contains: Tab name, sort order, active filters
Security: Display preferences

Animations Already Seen

wiggwigg:celebrated-notifications, wiggwigg:suppressed-celebrations
Purpose: Avoids replaying the same achievement animation twice
Contains: IDs of notifications already celebrated
Security: No sensitive data

Load Recovery Counter

chunk-recovery:<asset>
Purpose: Counts automatic reloads when a piece of the app fails to download, so a failure can't turn into an infinite reload loop
Contains: A timestamp and a counter
Security: No sensitive data

Session storage is isolated per tab and cleared automatically when you close it. It's also wiped the moment you sign out, without waiting for you to close the browser.

Local Storage (Persists Across Sessions)

Local storage survives closing the browser. We use it for your preferences, for two security protections, and for encrypted session recovery if you've enabled it.

Security Settings

wiggwigg_security_settings
Purpose: A local copy of your security settings (session persistence mode, auto-lock timeout, new-tab mode) so the app can apply them before it has even reached the server
Duration: Until manually cleared
Contains: Your security preferences, no sensitive data
Security: The same settings are also synced, encrypted, with your account
Clear: Yes, in Settings, Security, Session Security

Encrypted Persisted Session

wiggwigg_persisted_session
Purpose: Keeps your vault key encrypted so you can pick your session back up in another tab or after a restart, only if you turn on "Remember me"
Duration: Based on your max session age setting (1 to 365 days, 7 by default)
Contains: Encrypted key, cryptographic nonce, authentication tag, salt
Security: Encrypted with a key derived from your password. It only opens with that password, and attempts are rate-limited by the server.
Optional: Yes, turn off "Remember me" in your security settings

Session Version Number

wiggwigg_session_version
Purpose: A counter that invalidates every persisted session at once when it goes up, for instance after a password change
Duration: Until manually cleared
Contains: An integer
Security: Public counter, non-sensitive

Username Shared Across Tabs

wiggwigg_account_id_shared
Purpose: Enables the anti-phishing display in a new tab, only if you've turned on seamless access
Duration: Until manually cleared
Contains: Your WIGGWIGG username
Optional: Yes, switch to maximum security mode in your security settings

Offline Verification Signature

wiggwigg_offline_verification_sig
Purpose: Lets us verify your password to unlock the app with no network, after a browser restart
Duration: Until you sign out
Contains: HMAC-SHA256 signature
Security: Can't be reversed into your password: it's derived at the same computational cost as your vault key, so attacking it is no cheaper than attacking the vault directly.
Optional: Yes. In maximum security mode it's never written here.

Downgrade Guards

wiggwigg_vault_manifest_hwm_<account>, wiggwigg:kdf-version:<account>, wiggwigg:auth-scheme:<account>
Purpose: Remember the strongest thing this browser has already seen from us: the highest vault version, the strongest key derivation, and the strongest sign-in scheme. If a server ever offers you something weaker, your browser refuses instead of quietly accepting it.
Duration: Deliberately kept after you sign out
Contains: Three counters per account. No data, no keys, no content.
Security: These protect you from us, which is exactly why they outlive your session. Clearing them on sign-out is how the guard would be defeated: force a re-login, and the floor resets. So we leave them in place. You can still clear them by deleting site data in your browser.
Clear: Yes, through your browser's site data

Session Renewal Lock

wiggwigg_refresh_lock
Purpose: Stops several open tabs from renewing the session at the same time and signing each other out
Duration: A few seconds, for the duration of the renewal
Contains: A tab identifier and a timestamp
Security: No sensitive data

Recent Search History

wiggwigg_recent_searches
Purpose: Offers your last searches so you can jump back to them. They're never sent to the server.
Duration: 7 days, 10 searches maximum. Cleared automatically when you sign out.
Contains: Search queries, timestamps, search type
Security: Encrypted with the session key: outside a session it's unreadable and gets purged automatically
Clear: Yes, cleared automatically when you sign out

Phone Search Preferences

wiggwigg_phone_search_prefs
Purpose: Remembers your filters and sort order in phone number search
Duration: Until manually cleared
Contains: Search filters, sort order
Clear: Yes, reset the filters in phone number search

Interface Flags

wiggwigg_push_prompted, push-banner-dismissed, webrtc-signaling-enabled, wiggwigg.brand-icons-hint.decided, wiggwigg.callerVerificationWarnings, sidebar-collapsed
Purpose: Remember that you've already answered a prompt (push notifications, install banner, service icons in the vault), whether you've enabled receiving calls in the browser, whether you want caller verification warnings, and whether your sidebar is collapsed
Duration: Until manually cleared
Contains: True or false flags
Security: No personal data

Encryption Upgrade Tracking

wiggwigg:kdf-pin-needed:<account>, wiggwigg:kdf-rotation-attempts:<account>
Purpose: Tracks your account's migration to a stronger key derivation so it resumes where it stopped instead of restarting at every sign-in
Duration: Until the migration completes
Contains: A flag and an attempt counter
Security: No keys, no passwords

How to clear all local storage:

Clear everything: Browser Settings, Privacy, Clear site data, Cookies and site data.

Local storage is isolated per domain. WIGGWIGG can't read other sites' data, and other sites can't read WIGGWIGG's. Signing out already clears nearly everything above, with the single exception of the rollback guard, which is a protection rather than a convenience.

IndexedDB, Offline Cache, and Shared Worker

Your browser has three more storage areas beyond cookies and key-value storage. We use them, so here they are. This is the part most cookie policies leave out.

Vault Keys (seamless mode only)

IndexedDB: wiggwigg_vault_keys
Purpose: Brings your session back after a refresh or a browser restart without asking for your password again
Duration: Until you lock, sign out, or exceed your auto-lock timeout
Contains: Non-extractable key handles. The browser can use them to decrypt, but neither JavaScript nor we can read their bytes.
Security: Only written if you chose seamless mode. Also cleared as soon as your session version changes, for instance after a password change or a sign-out from another device.
Optional: Yes. In maximum security mode nothing is ever written here.

Offline Data Cache

IndexedDB: wiggwigg_query_cache
Purpose: Keeps already-loaded data around so the app stays readable when the network drops
Duration: Until you sign out
Contains: The app's cache, encrypted before it's written
Security: Encrypted in a dedicated worker with your vault key. Nothing is written until that key is available, and everything is deleted on sign-out.

Offline App Cache

Cache Storage (service worker)
Purpose: Stores the app's files (code, icons, offline page) for fast startup and offline use
Duration: Until you sign out or the app updates
Contains: Static assets and cached responses
Security: Emptied on sign-out, so a shared device keeps nothing from your visit

Key Sharing Across Your Tabs

Shared Worker (memory)
Purpose: Lets your tabs share one unlocked session without writing the key back to disk
Duration: As long as tabs stay open
Contains: Nothing on disk. The key lives in memory, as a non-extractable handle.
Security: Emptied on lock and sign-out. Some browsers, Safari among them, shut this worker down as soon as the last tab closes: that's why seamless mode also leans on IndexedDB.

This Website

The marketing site you're reading right now is separate from the app. It doesn't sign you in and loads no third-party scripts. It stores four things: three display preferences in local storage, and campaign parameters in session storage when a link brought you here with them.

Light or Dark Theme

theme

Remembers the theme you picked so the page doesn't flash on the next load

Menu Side

menuHandSide

Remembers whether you prefer the menu on the left or the right, for one-handed use

Notice Dismissed

cookie-notice-dismissed

Remembers that you closed the banner at the bottom of the page, so we stop showing it

Campaign Parameters

wiggwigg_utm_source, wiggwigg_utm_medium, wiggwigg_utm_campaign

If you arrived through a link carrying utm_source, utm_medium, or utm_campaign, we keep those three values for the length of your browser tab so we know which post or link brought you here.

Being straight with you, since this is the one entry here that isn't a display preference: these come from the link you clicked, not from watching you, and they're read only if you then subscribe to the newsletter or create an account, in which case they're saved with that signup so we can tell what's working. If you arrived at this page with no such parameters in the address bar, nothing is written at all. They're gone when you close the tab. We don't build a profile, we don't follow you to other sites, and no third party is involved.

The only cookie this site can write is preferredLang, described above, and only if you change languages with the switcher.

Zero-Knowledge Architecture

Your encryption key is never written in the clear, anywhere. Here's the exact path:

Your master key is derived from your password at sign-in, inside your browser

It unlocks your vault key, then it's wiped from memory

The active keys live in memory as non-extractable handles: the browser can encrypt and decrypt with them, but JavaScript can't read their bytes

Your tabs share them through a Shared Worker, with nothing written to disk

In seamless mode those same non-extractable handles are kept in IndexedDB so they survive a refresh. In maximum security mode nothing is kept.

If you turn on "Remember me", a copy encrypted with your password is written to local storage, and it only opens with that password

WIGGWIGG's servers never see your master key or your vault key

Your data is encrypted in your browser before it's sent

Someone who copied your browser storage cold would find nothing usable without your password. Let's be straight about the limit, though: none of these layers protects against a malicious script injected into the page while your session is unlocked, because at that point the browser can use the key. That's the same threat model as every vault product out there, and it's why auto-lock and maximum security mode exist.

Your Privacy Controls

You decide what's kept. Signing out already clears the bulk of it: session storage, caches, IndexedDB, offline cache, and the key shared across tabs.

Session Persistence

Turn "Remember me" on or off

Settings, Security, Session Security

New Tab Mode

Seamless access across tabs, or maximum security that keeps nothing

Settings, Security, Session Security

Auto-Lock Timeout

Choose how long you can be idle before your session locks

Settings, Security, Session Security

Performance Measurement

Off by default. Yours to turn on if you want to help us measure page speed.

Settings, Account

Export or Delete Your Data

Get a copy of your data, or delete your account

Settings, Privacy & Data

Clear Everything

Clear cookies, session storage, local storage, IndexedDB, and the cache

Browser Settings, Privacy, Clear site data

Read Full Privacy Policy

Our complete privacy policy: data collection, usage, and your rights

Read Policy

Learn About Our Security

A deeper look at WIGGWIGG's zero-knowledge encryption and security architecture

Learn More

Contact Us

Questions about cookies or privacy? Get in touch

Contact Us

Last Updated: August 4, 2026