What this site collects, and what it does not.
This page describes what werun.dev actually does, read out of the code that runs it. There is one form, one cookie, and two files loaded from somebody else's server.
What the brief form stores.
The form on the contact page sends the fields you can see, and they are written to our own PostgreSQL database:
- Name and work email: required, so we can reply.
- Company, platform and budget range: optional context.
- Your brief: the free-text description of what you need.
- The language you wrote it in, so the reply comes back in the same one.
- A keyed hash of your IP address, used only to stop the same address submitting the form repeatedly. It is an HMAC, not the address: we store the hash and cannot recover the address from it.
Three more things are recorded alongside it. None of them is anything you typed, and all of them exist so that a reply lands well and so we can tell which of our pages actually brings people here:
- How you reached us: the search engine, link or campaign that brought this visit, the first page you landed on, the page the form was on, and how many times you had been here before. Your browser works this out from the address you arrived at and from two entries it keeps for itself (
wr.visitandwr.session); block them and the brief still sends, with those fields empty. - Your browser and operating system, read from the user-agent string every request carries, and the language your browser asks for, so we reply in the one you actually read in rather than the one the page happened to be in.
- The first half of your IP address and the country our host reports, shown as
190.191.xx.xx · AR. The last two numbers are the part that identifies a household and they are dropped before anything is written down; the full address is never stored.
That is the whole list. There is no fingerprinting script and no profile built across sites, and nothing you type in the form reaches an advertising platform: Google Ads hears that a brief was sent, never what it said. We use what you send to answer you, to scope the work you described, and to know which of our own pages is worth writing more of.
Four, and two of them are Google’s.
werun_session holds a signed sign-in token for the werun.dev admin area and the project tracker. It is httpOnly (JavaScript cannot read it), SameSite=Lax, and it is only ever set when somebody on our team or a client signs in. Reading the public site never sets it.
wr_lang remembers which language the admin area and the project tracker are shown in. It is set when a signed-in person switches language, holds nothing but the two-letter code, and the public site never sets it: the public site's language is in the address.
Google Analytics 4 runs on the public pages and sets its own _ga cookies to tell a returning visitor from a new one. We use it to see which pages get read, which buttons get pressed and whether the brief form gets finished, and nothing more. It does not run on /admin or on dashboard.werun.dev: a client's use of their own project tracker is not something we measure.
Google Ads shares the same tag. It sets _gcl_au, and _gcl_aw when you arrive from one of our ads, so that a click on that ad can be matched to a brief sent afterwards. It is configured not to build remarketing audiences, and like Analytics it does not run on /admin or on dashboard.werun.dev.
Two entries are kept in your browser's own storage rather than in a cookie: wr.session, which lasts until you close the tab and holds the link or search that brought this visit, and wr.visit, which holds a count of how many times you have been here. Nothing is sent anywhere until you submit the brief form; if you never do, they are never read. Clearing site data removes both.
No ads are shown on this site, there is no remarketing and no session-replay script, and Google Ads only measures our own campaigns.
The WelcomeAI assistant described below runs inside your browser. Any storage it creates is its own, governed by WelcomeAI, and we do not read it.
When the brief form is sent we tell Analytics and Google Ads that a brief was sent, along with what you picked from the dropdowns: the platform and budget range, or on an industry page what you need first. Your name, your email address and the brief itself are never sent to Google: they go to our own database and to our own inbox, and nowhere else.
The two things we load from elsewhere.
- WelcomeAI (
cdn.welcomeai.dev): the assistant launcher and the search box on the home page. It is our own product, embedded here the same way our clients embed it. Anything you type into it is handled by WelcomeAI. - Font Awesome (
cdnjs.cloudflare.com): the icon stylesheet and its webfonts, on the signed-in screens only (the project tracker, the admin area and shared task links). The public pages carry their own copy of the icons, served by this site.
Loading a file from another server means that server sees the request: your IP address, your browser's user agent, and which page asked for it. That is true of every third-party file on every website, and it is the reason this list is short.
Everything else is served by this application. Article images come out of our own database through this site's own URLs: there is no image CDN, no font host beyond the one named above, and no embedded video, map or social widget.
Getting your brief removed.
Write to hello@werun.dev and ask for a copy of what we hold about you, or for it to be deleted. The contact form is the only place this site collects anything, so in practice that means the brief you sent and the reply thread it started.