Cookie Notice
Every cookie and storage item WhichFlagToFly sets, what it does, who sets it and how long it lasts, and how to change your choice.
What this notice covers
This notice lists every cookie and similar browser storage item that WhichFlagToFly sets, what each one is for, who sets it and how long it lasts. It also explains how we ask for your choice and how to change it. "Cookies" here includes browser storage (localStorage and sessionStorage), because your choice covers both.
WhichFlagToFly is operated by WhichFlag LLC, 32 N Gould St, Ste R, Sheridan, WY 82801, United States.
How we ask
European Economic Area, United Kingdom and Switzerland, or if we cannot tell where you are: only strictly necessary cookies are set until you choose. The banner offers Accept all and Reject non-essential as equal choices, and Cookie settings lets you choose category by category. Ignoring or closing the banner is treated as a refusal.
Everywhere else, including the United States: analytics runs unless you turn it off, and a short notice says so on your first visit. You can turn it off at any time from Cookie settings or Do Not Sell or Share My Personal Information in the footer. Both open the same panel.
Global Privacy Control. If your browser sends the Global Privacy Control signal, we treat it as a refusal of every optional category and as an opt-out of sale and sharing, wherever you are. While the signal is on, no analytics runs at all and the optional switches stay off.
Strictly necessary
These make the site work or record your privacy choice. They cannot be switched off in the panel.
| Name | Type | Set by | What it does | How long |
|---|---|---|---|---|
| wf_consent | Cookie | WhichFlagToFly | Records your cookie choice and when you made it | 6 months |
| wf_regime | Cookie | WhichFlagToFly | Records which consent rules apply where you are (opt-in or opt-out). Holds no identifier | 24 hours |
| wftf.recommend.sessionToken | sessionStorage | WhichFlagToFly | Keeps your inquiry form in progress if you refresh the page | Until you submit the form or close the tab |
| sb-(project)-auth-token | Cookie | WhichFlagToFly | Keeps our own staff signed in to internal tools. Not set for visitors | Up to 400 days, or until sign-out |
| flagstack.admin.sidebar.collapsed | localStorage | WhichFlagToFly | Remembers a layout setting in our staff tools. Not set for visitors | Until cleared |
Functional
| Name | Type | Set by | What it does | How long |
|---|---|---|---|---|
| fs_rotation | Cookie | WhichFlagToFly | A random value set only if you allow Functional cookies and open an old listing address. Nothing on the site reads it now | Until you close the browser |
Analytics
We use two analytics services, both based in the United States:
- PostHog. Requests go to WhichFlagToFly's own domain and are forwarded from there. In the opt-in regions until you allow analytics, and anywhere after you turn it off, PostHog runs in a mode that stores nothing on your device: it counts page views, clicks and page speed against an identifier held only in the page's memory, so separate visits cannot be linked.
- Google Analytics 4. Loaded only when analytics is allowed, with advertising storage and ad personalization turned off.
When analytics is allowed, these are set:
| Name | Type | Set by | What it does | How long |
|---|---|---|---|---|
| ph_(project key)_posthog | Cookie and localStorage | PostHog, first-party | A random visitor ID and session ID, so a return visit is recognized | Cookie: 1 year. localStorage: until cleared |
| ph_(project key)_posthog, ph_(project key)_window_id, ph_(project key)_primary_window_exists | sessionStorage | PostHog, first-party | Session state, and telling browser tabs apart so a session replay is not mixed up | Until you close the tab |
| _ga | Cookie | Google Analytics, first-party | A random visitor ID | 2 years |
| _ga_(measurement ID) | Cookie | Google Analytics, first-party | Keeps the current session's state | 2 years |
With analytics allowed, PostHog may also record a session replay: a reconstruction of the page and pointer movement, used to find pages that confuse people. Every form field you type into is masked in your browser before anything is sent, so what you type is never captured. Replays never run in staff or firm areas.
If you withdraw consent, PostHog goes back to the no-storage mode and deletes its cookie and localStorage entry. Google Analytics stops the next time a page fully loads (for example, when you reload or come back to the site). Google Analytics cookies already set stay until they expire or you delete them in your browser.
No advertising. We run no advertising cookies, pixels or tags, we build no advertising profiles, and we do not sell personal information or share it for cross-context behavioral advertising.
Server logs
Separately from cookies, our servers record pages served and steps in the inquiry form (for example, that a form was started or submitted). These records set nothing on your device and hold no name, email address or text you typed.
Changing your choice
Use Cookie settings in the footer of any page. Your choice is kept for six months, and we ask again sooner if we add a cookie that your earlier answer did not cover.
You can also block or delete cookies in your browser settings, usually under Privacy. If you block all cookies we cannot remember your choice, so the notice will appear on every visit.
Contact
Questions about this notice: info@whichflagtofly.com. How we handle personal information generally is in the Privacy Policy.
Effective 22 September 2026.
Informational only, not legal, tax or financial advice.