WOR COMPANION · Your inventory, your session.
Only what the tool needs.
Last updated: 11 October 2026
Necessary session cookie
wor_session identifies the temporary optimizer session. It is first-party, HttpOnly, Secure over HTTPS and SameSite Strict. It contains an opaque session identifier, not your inventory. It is a browser-session cookie; server data expires after 30 minutes of inactivity. It is required for imports, calculations and reservations, and is exempt from prior consent for this requested service.
Private administration
The private administration area uses wor_admin solely for its login and security checks. This HttpOnly, Secure, SameSite Strict cookie is limited to /admin and expires after 30 minutes without activity. No administrator cookie is set on the public homepage or optimizer. It is necessary for the requested private administration service.
Language and local settings
The selected language is in the page URL: no language cookie is needed. The optimizer may keep your selected hero and form settings in this tab’s sessionStorage so a reload keeps your choices. This does not store the inventory or send data to third parties. Clear my session also removes these settings. No advertising or analytics cookies are used, so there is no consent banner to accept.
Cloudflare security
Depending on the enabled protections, Cloudflare may set security cookies such as cf_clearance or __cf_bm. Their purpose and lifetime depend on the configuration; cf_bm expires after 30 minutes of inactivity. Only necessary security features are intended. See Cloudflare’s cookie documentation.