Legal
Cookie policy
Which cookies and similar storage WANTED SIX uses in your browser, what for and for how long, which services only load with your consent, which advertising services are prepared but not active, and how to change or withdraw your choice at any time.
Your cookie settings
Grant, change or withdraw your consent here at any time. A withdrawal applies immediately for the future.
Last updated: 9 November 2026
This cookie policy explains which cookies and similar technologies WANTED SIX uses in your browser, what for, for how long and on what legal basis, and how you decide about them. How we process the personal data involved and what rights you have is explained in our privacy policy.
Summary
Without your consent we only store what is technically necessary: your sign-in, the protection of sign-in and password steps, your language, your cookie choice, a note that you have already seen the homepage intro, short confirmations in the member area, the offline page and, on the map, your unit (kilometres or miles) and – only if you create them without an account – your own places, favourites and routes.
Optional and not preselected: Statistics (our own pseudonymised usage statistics and, selectable individually, Google Analytics 4) and YouTube videos. The Marketing purpose only appears when an advertising service is set up, which is currently not the case.
“Necessary only” is just as easy as “Accept all”. Under “Settings” you choose individual purposes and services.
Your choice applies for 180 days. You can change or withdraw it at any time via “Cookie settings” in the footer, in the settings menu of the map or with the button on this page.
Google Analytics 4 is active and belongs to Statistics; it only loads if you consent to it individually. Google Ads, the Meta Pixel and the TikTok Pixel are technically prepared but currently not active. None of these services ever loads without your explicit consent.
Without consent there are no advertising or analytics cookies on WANTED SIX. We do not use fingerprinting.
Who is responsible
WANTED SIX is operated by WKD GmbH, Arthur-Krupp-Straße 1, 3300 Amstetten, Austria, which is responsible for the cookies and storage described here. You can reach us at hello@wantedsix.com or through the contact form. Full company details are in the legal notice.
What cookies and similar technologies are
A cookie is a small text file that a website stores on your device through your browser and reads again on later visits. Browsers also have other kinds of storage that work in a similar way. When this policy talks about cookies, it means all of these technologies:
Cookies: have a name, a value and an expiry time and are sent along with every request to the website that set them. A session cookie ends when you close the browser; a persistent cookie ends when it expires or when you delete it.
Local storage (localStorage): keeps values without an expiry time until the website or you delete them. These values are not sent automatically.
Session storage (sessionStorage): works like local storage but only applies to one browser tab and is deleted when you close that tab.
Service worker and cache: a service worker is a small program of a website that can keep files in the browser, for example so that an offline page appears when you lose your connection.
First-party cookies are set by WANTED SIX under its own address. Third-party cookies are set by other companies under their own address, for example in an embedded video. We have no access to them.
Legal basis
Whether we may store information in your browser or read it from there is governed by section 165(3) of the Austrian Telecommunications Act 2021 (TKG 2021) (opens in a new tab), regardless of whether personal data is involved. As a rule, this requires your consent. The exception is anything strictly necessary for us to provide a service you have explicitly asked to use.
Necessary cookies and storage are set without consent. We base the related processing of personal data on the agreement for using WANTED SIX where you use an account (Art. 6(1)(b) GDPR) and otherwise on our legitimate interest in a working, secure website that remembers your language and your cookie choice (Art. 6(1)(f) GDPR).
Optional cookies and services (statistics, marketing, YouTube videos) are only used with your consent (section 165(3) TKG 2021 and Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future (Art. 7(3) GDPR).
The record of your choice is kept because we must be able to prove whether, and for what, consent was given (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
Where data is transferred to countries outside the EU, such as the USA, our privacy policy explains the legal basis for it.
How your consent works
The cookie notice
On your first visit the notice “Your privacy, your choice” appears at the bottom of the page. Until you decide, nothing optional loads; you can still read the website. The notice has three equally designed buttons on the same level:
Necessary only: only the necessary cookies and storage stay active.
Settings: you choose individual purposes. Where individual providers are listed for a purpose, they are selected along with it when you switch the purpose on; you can deselect each of them separately. You confirm with “Save selection”.
Accept all: you consent to all purposes and all services listed in the settings at that moment.
Nothing is ticked in advance. Reading on or scrolling does not count as consent. The purposes in detail:
Necessary (always on): sign-in, security, language and your cookie choice.
Statistics: our own usage statistics and Google Analytics 4, which appears here as a separate service that you can select individually.
Marketing: measuring our ads on Google, Facebook, Instagram or TikTok and relevant ads from these providers. This purpose only appears when at least one of these services is set up, which is currently not the case.
YouTube videos: loads embedded videos from YouTube (Google).
Wherever a video is embedded, you see a placeholder or a preview image without consent. With “Load video” (in the trailer section of the homepage: “Allow YouTube and play”) you consent right there to that one purpose only: consent to YouTube covers all YouTube videos on WANTED SIX. Your other choices stay as they are. If you have not made a choice in the cookie notice yet, this counts as your choice: only this purpose is switched on, all others stay off, and the notice closes.
Changing or withdrawing your choice
You can change, extend or withdraw your choice at any time, just as easily as you made it:
via “Cookie settings” in the footer of our public pages (in the “Legal” section),
on the map via “Cookie Settings” in the settings menu (gear icon, on phones “More”), or
with the “Open cookie settings” button on this page.
The member area and the sign-in pages have no footer; from there, you can reach the settings through any public page or through this policy. The settings open with your current choice. If you have already decided, press Escape or use the close icon to close them without changing anything.
What withdrawing does
A withdrawal takes effect immediately for the future. Anything done on the basis of your consent before then remains lawful.
Statistics: the w6_aid ID is deleted at once, page views not yet sent are discarded, and your browser stops sending statistics data. Data already recorded is pseudonymised and cannot be linked to you; when we delete it is explained in the privacy policy.
YouTube videos: the player is removed at once and the placeholder returns.
Google Analytics 4 and the prepared services, once one of them is active: it is stopped at once and no longer loaded. If its script is loaded at that moment, we also delete its cookies on our domain (for Google Analytics 4 also w6_conversion) and reload the page once so that no script of the provider keeps running. Cookies it set during an earlier visit can be deleted in your browser at any time.
We cannot delete cookies that third parties have set under their own domain. How to remove them is explained under “Deleting or blocking cookies in your browser”.
Validity and proof
We store your choice for 180 days in the w6_consent cookie. After that we ask you again. If you delete your cookies earlier, the notice appears again on your next visit.
For every choice we also store a record in our database: the version of the notice, the purposes chosen, the services selected and the time. We do not store an IP address or a device fingerprint. If you are signed in, we link the record to your account; it is then also included in your data export under Data & account. We keep records as long as we need to be able to prove consent. Automatic deletion after a fixed period is not yet set up for them; see the privacy policy for details.
Consent only covers the services listed in the settings when you saved your choice. If a new service is added later, it stays off until you explicitly select it, even if you chose “Accept all” before. Choices made with an earlier version of the notice remain valid for our own statistics and YouTube videos; an earlier consent to the external map no longer has any effect, because we no longer embed an external map. Marketing, Google Analytics 4 and the prepared services (Google Ads, Meta Pixel, TikTok Pixel) stay off until you explicitly select them.
Necessary cookies and storage
These cookies and storage items are always active because the website does not work as intended without them. WANTED SIX sets all of these cookies under its own address. They are only sent to our website and processed by our technical service providers solely on our behalf, by our hosting provider Vercel also on servers in the USA; we do not use them for advertising.
Provider | Name and technology | Purpose | Category | Duration | Consent required |
|---|---|---|---|---|---|
WANTED SIX | sb-tkhnompvavhtjniappvx-auth-token (cookie); split into sb-tkhnompvavhtjniappvx-auth-token.0, .1 and so on for large values | Keeps you signed in after you sign in. Contains the session data of our sign-in system (Supabase), including access and refresh tokens and details of your account. Only set when you sign in. | Necessary | Up to 400 days; set again each time the session is renewed and deleted when you sign out | No |
WANTED SIX | sb-tkhnompvavhtjniappvx-auth-token-code-verifier, sb-tkhnompvavhtjniappvx-auth-token-flow-…-code-verifier (… stands for a random process ID) and sb-tkhnompvavhtjniappvx-auth-token-flows-code-verifier (cookies) | Secure signing in with Google and the confirmation links for registration and password resets (PKCE). At most five open processes are stored at the same time. | Necessary | Deleted once the process has completed successfully; for an abandoned process until you next sign out or the cookie expires, at most 400 days | No |
WANTED SIX | w6_recovery (cookie, cannot be read by scripts in the browser) | Only set after you have opened a verified password reset link. Contains your account ID and allows a new password to be set for exactly this account. | Necessary | 30 minutes; deleted once the new password is saved or when you sign out | No |
WANTED SIX | w6_consent (cookie) | Stores your choice in the cookie notice: version, purposes chosen, services selected and time. Contains no ID that identifies you. | Necessary | 180 days | No |
WANTED SIX | w6_locale (cookie) | Remembers your language (German or English) when you switch it or save it in your profile, so that addresses without a language and redirects after sign-in appear in your language. | Necessary | 1 year | No |
WANTED SIX | w6:intro:v1 (localStorage) | Remembers that the homepage intro has already played so that it only appears on your first visit. Contains only the time of that visit and is not sent anywhere. Also set when you have reduced motion turned on and the intro therefore does not play. | Necessary | No expiry, until you delete the site data | No |
WANTED SIX | w6-flash:… (sessionStorage; … stands for the area concerned) | Shows a short confirmation in the member area after saving, even if the page reloads. | Necessary | Deleted when shown and valid for at most 15 seconds; ends at the latest when you close the tab | No |
WANTED SIX | w6-admin-deletion-receipt:… (sessionStorage; … stands for the ID of a deleted account) | Only in the administration area for authorised team members: remembers, after an account has been deleted, which image files still have to be removed by hand. | Necessary | Until the team member dismisses the notice, at the latest until the tab is closed | No |
WANTED SIX | Service worker with the w6-offline-… cache (Cache Storage; … stands for the version) | Stores the offline page and the stylesheets, fonts and brand images it needs, so that a notice appears instead of an error message when you lose your connection. The files are fetched without cookies; personal data, chats and pages from the member area are never cached. | Necessary | Until the next version (the service worker deletes older versions automatically) or until you delete the site data | No |
WANTED SIX | w6.map.personal.v1 (localStorage) | Stores your own places, favourites and routes on the map on this device when you create them without an account. Only set when you save something, and only sent when you move the places into your account yourself after signing in. | Necessary | No expiry, until you delete the places or the site data | No |
WANTED SIX | w6.map.personal.offer.v1 (localStorage) | Remembers that you declined or completed moving this device's places into your account, so the hint does not appear again. Contains only a checksum of the places, no account data, and is not sent anywhere. | Necessary | No expiry, until you delete the site data | No |
WANTED SIX | w6.map.unit.v1 (localStorage) | Remembers your unit on the map (kilometres or miles) when you change it. Not sent anywhere. | Necessary | No expiry, until you delete the site data | No |
Why no consent is needed: you need the sign-in and security cookies to use your account. w6_consent and w6_locale store a choice you made yourself and contain no ID that identifies you. The intro note and the offline cache contain no personal data, never leave your browser and only serve to deliver the website the way you request it. The short notices in session storage only show the result of an action you started yourself. The map's storage items only contain what you create or set there yourself and only serve to provide this function you asked for.
Without consent, your browser only connects to WANTED SIX itself and to our database provider Supabase (data centre in Frankfurt), for example for profile pictures, sign-in, and chat and uploads in the member area. We serve fonts from our own servers. The preview images of the trailers on the homepage are fetched from YouTube by our server and delivered by us; your browser does not connect to Google for them.
Map. The map of Leonida on our map page is part of WANTED SIX. Your browser loads map images, photos and place data from WANTED SIX itself and from our storage at Supabase (data centre in Frankfurt). The map does not include any third-party content, cookies or services; there is therefore no separate consent category for the map any more.
Statistics (optional)
With your consent to “Statistics”, we count which kinds of pages are viewed (for articles, creator pages and creator content, crews, challenges and events also which item), in which language, on which device class, from which external source visitors arrive and whether a registration is started. WANTED SIX runs these own statistics itself, without an external analytics service. Google Analytics 4 is a separate service under “Statistics” that you consent to separately (see “Google Analytics 4 and prepared services”). For our own statistics we set no cookie, only an ID in session storage:
Provider | Name and technology | Purpose | Category | Duration | Consent required |
|---|---|---|---|---|---|
WANTED SIX | w6_aid (sessionStorage, not a cookie) | A random string that only applies in this browser tab. We use it to group the page views of one visit. Only created after your consent. | Statistics | Until you close the tab; deleted at once if you withdraw consent | Yes |
Our server does not store this ID itself, only a hash formed with a random value that changes every day. We delete these random values after two days, so visits cannot be linked across several days. Without consent your browser sends no statistics data. Exactly what is recorded and how long we keep it is explained in the privacy policy.
YouTube videos (optional)
We embed YouTube videos in articles, on creator pages, on the trailers page and in the trailer section of the homepage. The provider is Google. We use YouTube's privacy-enhanced mode (youtube-nocookie.com).
Without consent you only see a placeholder or a preview image that we deliver ourselves. Your browser does not connect to YouTube or Google.
After your consent the player loads automatically on pages with a video, but a video only starts when you click play. The trailer on the homepage only loads when you click play there; it then starts straight away.
In video lists on the trailers page and on creator pages, your browser also loads the preview images directly from YouTube (i.ytimg.com) after your consent.
Provider | Name and technology | Purpose | Category | Duration | Consent required |
|---|---|---|---|---|---|
Google (YouTube) | YouTube player from youtube-nocookie.com in an embedded frame; cookies and local storage inside it as determined by Google | Play videos. Google may create its own cookies or similar storage in the player, at the latest when you play a video. | YouTube videos | Set by Google | Yes |
Google (YouTube) | Preview images from i.ytimg.com | Show preview images in video lists. Google receives technical data such as your IP address. | YouTube videos | Set by Google | Yes |
When the player loads, Google receives technical data such as your IP address, details of your browser and our website address as the origin. We are jointly responsible with Google for embedding the video and this transmission; Google alone is responsible for what it does with the data afterwards. Google may also process data in the USA. More in our privacy policy and in Google's privacy policy (opens in a new tab).
Google Analytics 4 and prepared services
Google Analytics 4 is active and appears in the cookie settings under “Statistics”. Google Ads, the Meta Pixel and the TikTok Pixel are technically prepared but currently not active: they do not appear in the cookie settings, load no script and set no cookies. None of these services loads without your explicit consent.
For Google Analytics 4, and for any other of these services should we switch it on, the following applies:
It appears in the cookie settings as a separate service: Google Analytics 4 under “Statistics”; Google Ads, the Meta Pixel and the TikTok Pixel under “Marketing”. It is not preselected. If you switch the purpose on, it is selected along with it; you can deselect it separately.
It only loads once you have selected the purpose and the individual service. Before that there is no request to the provider and no cookie.
Its script only loads on public pages, and we only report page views from there, except profile, crew and creator pages, search and the pages for resetting a password and confirming an e-mail address; never from the member area. Query parameters of the page address are not passed to the provider, except campaign parameters that show which ad or campaign brought you to us.
We do not pass on your e-mail address, your name or your account ID. We use no automatic matching of personal data (advanced matching), no server-side transmission to the providers and no fingerprinting.
What these services process (Google Analytics 4 active, the others only if activated)
Google Analytics 4 (Google Ireland Limited, as our processor): page views without query parameters (except campaign parameters such as utm_source; on the first page of a visit the domain of the referring website) and selected steps, namely starting, submitting and completing a registration (completed only once the e-mail address is confirmed), a creator application and an event registration. Google technically receives your IP address but, according to Google, does not store it. Google signals stay switched off; retention of event-level and user-level data is set to 2 months (aggregated reports are not affected).
Google Ads (Google Ireland Limited, as an independent controller): measures whether registrations, creator applications and event registrations come from a Google ad, and enables remarketing, meaning ads for people who have visited WANTED SIX.
Meta Pixel for Facebook and Instagram (Meta Platforms Ireland Limited): sends page views, completed registrations, creator applications and event registrations. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR, under Meta's terms for joint controllers); Meta alone is responsible for any further processing.
TikTok Pixel (TikTok Technology Limited, Ireland, and TikTok Information Technologies UK Limited): sends page views, completed registrations, creator applications (as a form submission) and event registrations. We are jointly responsible with TikTok for collecting and transmitting this data. According to TikTok, it stores data on servers in the USA, Malaysia and Singapore and gives companies of its group outside your country of residence limited remote access.
Google and Meta base transfers to the USA on the EU-U.S. Data Privacy Framework and additionally on standard contractual clauses; TikTok relies on standard contractual clauses. Details are in the privacy policy.
Cookies of these services
“Cookie on our domain” means that the provider's script sets the cookie under our address, reads it and sends its content to the provider. Cookies on the providers' own domains are set and read by the providers themselves.
Service (provider) | Name | Where stored | Purpose | Category | Duration according to the provider | Consent required |
|---|---|---|---|---|---|---|
Google Analytics 4 (Google Ireland Limited) | _ga | Cookie on our domain | Distinguishes visitors for statistics | Statistics | 2 years | Yes |
Google Analytics 4 (Google Ireland Limited) | _ga_ followed by the measurement ID | Cookie on our domain | Keeps the state of the current session | Statistics | 2 years | Yes |
WANTED SIX (for Google Analytics 4) | w6_conversion | Cookie on our domain | Hands a confirmed registration over to Google Analytics 4 once (only the step and the way you registered, no identifier). Only set if you have consented to Google Analytics 4, deleted on your next visit to a public page. | Statistics | At most 24 hours | Yes |
Google Ads (Google Ireland Limited) | _gcl_au | Cookie on our domain | Attributes registrations and other steps to the Google ads that brought visitors to us | Marketing | 90 days | Yes |
Google Ads (Google Ireland Limited) | _gcl_aw and related cookies starting with _gcl_ | Cookie on our domain | Stores the click ID when you arrive through a Google ad | Marketing | 90 days | Yes |
Google Ads (Google Ireland Limited) | for example IDE, test_cookie, ar_debug, GCL_AW_P, GCL_AU_P | Cookies on Google domains (doubleclick.net, googleadservices.com, google.com) | Serve and measure ads | Marketing | IDE 13 months, test_cookie 15 minutes, the others 90 days | Yes |
Meta Pixel (Meta Platforms Ireland Limited) | _fbp | Cookie on our domain | Distinguishes browsers for ad measurement and relevant ads | Marketing | 90 days | Yes |
Meta Pixel (Meta Platforms Ireland Limited) | _fbc | Cookie on our domain | Stores the click ID when you arrive through a Facebook or Instagram ad | Marketing | 90 days | Yes |
Meta Pixel (Meta Platforms Ireland Limited) | Meta cookies | Cookies on Meta domains, such as facebook.com | Serve and measure ads, as described by Meta | Marketing | Set by Meta | Yes |
TikTok Pixel (TikTok Technology Limited, TikTok Information Technologies UK Limited) | _ttp | Cookie on our domain | Distinguishes visitors for ad measurement | Marketing | 13 months from the last use | Yes |
TikTok Pixel (TikTok Technology Limited, TikTok Information Technologies UK Limited) | ttcsid and ttcsid_ followed by the pixel ID | Cookie on our domain | Ad measurement | Marketing | 13 months from the last use | Yes |
TikTok Pixel (TikTok Technology Limited, TikTok Information Technologies UK Limited) | ttclid | Cookie on our domain | Stores the click ID when you arrive through a TikTok ad | Marketing | 13 months from the last use | Yes |
TikTok Pixel (TikTok Technology Limited, TikTok Information Technologies UK Limited) | _tt_enable_cookie | Cookie on our domain | Auxiliary cookie the pixel may also set; TikTok does not describe its purpose separately | Marketing | Set by TikTok | Yes |
TikTok Pixel (TikTok Technology Limited, TikTok Information Technologies UK Limited) | _ttp | Cookie on tiktok.com | Ad measurement by TikTok | Marketing | Set by TikTok | Yes |
This information comes from the providers' documentation; providers can change their cookies at any time, and browsers may shorten durations further. Before we switch any of these services on, we will update this policy and the privacy policy.
Third-party cookies on the providers' own domains
The YouTube player runs in an embedded frame under the provider's own address. Whatever is stored there belongs to that provider: it can set cookies or use browser storage under its own domain. Such cookies can also be read on other websites that include content from the same provider. The same applies to the prepared services once they are active, for example cookies from Google on doubleclick.net or from TikTok on tiktok.com. We can neither read nor delete third-party cookies. Whether a provider can set them also depends on your browser; some browsers already block third-party cookies by default.
Information from the providers: Google's privacy policy (opens in a new tab), Google's advertising cookies (opens in a new tab), Meta's privacy policy (opens in a new tab) and TikTok's privacy policy for the EEA (opens in a new tab).
Signing in with Google and linking Steam
When you sign in with Google or link your Steam account, we send you to that provider's own site. Its own cookie and privacy rules apply there, and the provider sets cookies under its own domain. On WANTED SIX this only involves the necessary sign-in cookies described above.
Deleting or blocking cookies in your browser
You can view, delete or block cookies and other site data in your browser at any time. In Chrome, Edge, Firefox and Safari you will find this in the privacy area of the settings, depending on the browser for example under “Privacy and security” or “Cookies and site data”; on an iPhone, Safari's settings are in the Settings app. There you can delete the data of individual websites; the browser usually also removes local storage and the service worker cache. Your browser's help explains the exact steps.
Your browser deletes session storage automatically when you close the tab. You delete third-party cookies the same way; they are stored under the domain of the provider concerned.
Please note: if you delete the site data of WANTED SIX, you are signed out, the cookie notice appears again and the homepage intro plays once more. If you block the necessary cookies, sign-in and the member area will not work.
Changes and language versions
If the cookies, storage or services on WANTED SIX change, we will update this policy and the date at the top. A new service that requires consent stays off until you select it in the cookie settings.
This policy is available in German and English. Both language versions have the same content; in case of any contradiction, the interpretation more favourable to you applies.
For questions about cookies and data protection, contact us at hello@wantedsix.com or through the contact form. More information is in the privacy policy, the terms of use and the legal notice.