Cookie Policy
This page lists every cookie C-NDA sets, by name. There are two, and both are a consequence of something you did: signing in, or choosing a language. We set no advertising cookies, no profiling cookies, no attribution cookies and no cross-site tracking cookies, and there is no analytics of any kind on this site. Nothing is written to your device before you act, which is why this site has no cookie banner: there is nothing to ask you about.
Sign-in cookies: strictly necessary
When you sign in, our authentication provider sets a session cookie in your browser, named after our project reference and ending in “-auth-token” (occasionally split across two cookies when the token is long). It holds the tokens that keep you signed in.
Because sign-in happens in your browser rather than on our server, this cookie is written by JavaScript and therefore cannot be marked HttpOnly. Its lifetime is the default of the authentication library we use, which is considerably longer than a browser session; signing out clears it, and so does clearing site data in your browser.
Without this cookie the platform cannot know who you are, so it cannot be refused while using an account.
Language cookie: strictly necessary once you choose
Choosing a language in the header sets a cookie named “lang”, holding nothing but the two-letter code of the language you chose. It lasts one year, it is readable by the page, and it is set only when you actually pick a language. It is also what tells us which language to use for your invoices and for the message the witness posts in a meeting.
The attribution cookie we used to set, and no longer do
Until 24 August 2026, arriving on the site with a campaign link set a first-party cookie named “cnda_attr”, which recorded campaign parameters, a referral code and the site that referred you. It was not needed to deliver the service, and we never asked before setting it.
We removed it rather than putting a banner in front of you: nothing in the product read what it collected. If your browser still holds it from an earlier visit, it expires by itself within 30 days and nothing reads it in the meantime. If you signed up before that date, the campaign data captured then is still on your account, and you can see it in the export you can request from your settings, or ask us to delete it.
What our error monitoring does
Our error monitoring provider sets no cookies. It does use your browser's local storage to hold a temporary identifier that ties together the steps of a single failing request. Authorisation headers, cookies, request bodies, meeting links and one-time codes are removed before any report is sent, there is no session replay, and reports are delivered to the provider's EU region.
Your choices
You can clear or block cookies for this site at any time from your browser settings. Clearing the sign-in cookie signs you out; clearing the language cookie means the site follows the language in the address and, where the address has none, the language of your browser.
Questions about this page: hub@witup.ai.
This page describes the service as it works today. If you have read an earlier version and something has changed, the date above tells you when.