PRIVACY AND TRANSPARENCY
Cookies and similar technologies
Consent schema version 5 · Diagnostics introduced 13 October 2026 · Text revised 14 October 2026
Who operates this site
Wine Sharing is operated by Wish Srl, Piazza UnitĂ 10/a, 33018 Tarvisio, Italy. Italian tax code and VAT number: 03227020306. Contact: privacy@winesharing.app. This notice covers browser storage and optional services on the public website. Community visibility settings are separate.
How these technologies work
Cookies store data in your browser and send it with requests to the relevant domain. Local storage keeps data on your device without automatically sending it with each request; session storage lasts for the open tab. Necessary storage supports language, sign-in and requested features. Google Maps, Google Analytics and PostHog are optional and do not load before the corresponding consent.
Google Analytics and PostHog have separate choices. No Google Tag Manager or advertising pixels are enabled; advertising storage and personalization signals remain denied.
Necessary storage
Necessary storage supports requested functions and remembers choices. Blocking or deleting it can prevent sign-in or other features from working.
| Name / type | Purpose | Duration |
|---|---|---|
| wine_locale, ws-locale · first-party cookies | Interface language | Up to 12 months after setting or updating the cookie |
| ws-cookie-preferences · local storage | Maps, Google Analytics, PostHog and separate diagnostic choices, schema version, saved and expiry dates | Valid for six calendar months. Expired records are ignored but remain in storage until replaced or removed. |
| sb-…-auth-token · local storage | Supabase sign-in session and refresh | Until sign-out or removal; token validity is controlled separately by authentication. |
| ws-active-user-id, ws-authenticated-customer, ws-active-…-id, ws-business-authenticated, ws-business-area, ws-role · local storage | Customer/business interface and selected account area | Until sign-out where supported, replacement or deletion; no automatic local-storage expiry. |
| ws-visitor-id, ws-visitor-favorite-wines, ws-visitor-favorite-restaurants · local storage | Visitor identifier and favourites chosen without sign-in | Until transferred to the signed-in profile, removed by the user or browser storage is deleted. |
| ws-pending-booking-referral · local storage | Keep an invitation reference during sign-in and booking | Until removed at the end of the flow or site data is deleted. |
Separate administrator and partner portals have their own authentication. This website does not automatically share its consent choice with those portals.
Google Analytics — optional statistics
If you consent, we load Google Analytics 4, measurement ID G-MZYPFGTY50, to measure visits and use of the website. The tag may store first-party cookies such as _ga and _ga_MZYPFGTY50 to distinguish visitors and sessions. The actual cookie lifetime depends on the service and browser settings. Advertising storage, advertising user-data and personalization signals remain denied.
When you withdraw this choice, the site disables the Google Analytics tag for this measurement ID and sends a denied analytics-storage signal. This does not remove data already delivered or every cookie previously set by a provider. See Google Analytics cookie documentation and Google’s privacy notice.
PostHog — optional analytics and session recordings
If you consent, the site loads PostHog for product analytics and masked session recordings. Product events include viewed pages, searches, venues and wines, favourites, booking activity and Community activity. Device and browser information and an existing PostHog identifier accompany analytics. Before sign-in this identifier is pseudonymous; after sign-in, browsing is linked to the internal account identifier, together with first name, city, preferred language, registration date and internal/test-account indicators. The application does not send email or phone as person properties. Sign-out resets the identity.
Session recordings reconstruct interactions with pages. The implementation masks form inputs, email addresses and phone-only text, blocks marked content and iframes, and does not record cross-origin payment iframes. This masking is a technical safeguard; avoid entering unnecessary sensitive information into the service. Automatic click capture, console recording, performance capture and automatic SDK exception capture are disabled.
PostHog requests use this website’s /ingest proxy and are forwarded to PostHog’s EU ingestion cluster. The SDK uses local storage and the first-party ph_…_posthog cookie, configured for Wine Sharing subdomains with a nominal 365-day cookie lifetime. Consent is stored separately per browser origin: a choice on one hostname is not automatically a choice on another, although the identifier cookie may be shared across subdomains.
The site does not set the provider’s server-side retention periods. You can request the applicable event and recording retention periods from Wish Srl. Consult PostHog’s privacy notice, data processing agreement and subprocessor list for provider information; hosting in the EU does not by itself exclude processing outside the EEA.
Separate PostHog diagnostics — errors and sign-in outcomes
Only if both PostHog and “Errors and sign-in outcomes” are enabled do we measure sanitized application-error categories and whether explicit sign-in attempts succeed, fail or are interrupted. The events use the existing PostHog browser or account identifier. They do not include original error messages, stacks, URLs, email, credentials or form contents.
Diagnostic events use a consent-controlled transport without persistent queues, batching, automatic retries or unload beacons. Withdrawing diagnostics discards callbacks still waiting to send and aborts diagnostic requests still in progress. A new consent cannot restart old diagnostic work. A request that already reached the provider cannot be recalled.
Diagnostics currently require the broader PostHog choice, which also covers session recordings. You can leave diagnostics off while allowing the existing PostHog analytics and recording scope.
Google Maps — only if you choose it
If enabled, venue pages may embed Google Maps. Google receives request data including IP address and browser information, and may use cookies under its own settings and notices. Cookie names and lifetimes depend on Google, browser settings and any signed-in Google account. Without consent, the embed is blocked; you can still read the venue address or follow a link to Google Maps, where Google’s own rules apply. See Google’s privacy notice and cookie information.
Other requested functions
Vercel hosts the website and Supabase provides application and authentication services. Opening Explore loads OpenStreetMap tiles, which involves communicating technical request data. Using your position requires a separate browser permission. Booking flows may open Stripe for payment or a guarantee. Optional consent choices do not control necessary functions or websites opened externally.
Provider notices: Vercel, Supabase, OpenStreetMap Foundation, Stripe.
Choose, refuse and withdraw
“Necessary only” rejects every optional choice. “Accept all” enables Maps, Google Analytics, PostHog analytics and recordings, and diagnostics. “Customize” lets you choose separately within the current categories. Closing the initial banner with × means necessary storage only; scrolling does not grant consent. Closing preferences without saving leaves the current choice unchanged.
You can reopen “Cookie preferences” using the button in this notice or in Account, without signing in. Withdrawing PostHog stops new events and recordings and removes its browser identifiers. Previously delivered data and third-party cookies cannot be recalled or deleted by this control; contact Wish Srl for data-rights requests.
Valid version-4 choices keep their original settings and expiry. People who already allowed PostHog are asked only about the new diagnostics; a previous PostHog refusal is kept. Answering only the diagnostic question does not extend existing consent. Preferences are valid for up to six calendar months per browser and website, without attaching the preference record to an account. We may ask again after expiry, deletion of site data or a material change of purpose. If storage is blocked, the choice is kept in memory for the current page and a message explains that it could not be saved.
Contact and rights
Contact privacy@winesharing.app for access, correction, erasure, restriction, portability, objection or withdrawal where applicable. You can complain to the Italian data protection authority or the competent supervisory authority. See the privacy notice (Italian) for information about other service functions.