legal / cookies
Cookie Policy
WhatPortIs is a free database of network ports and protocols. It sets two cookies in total — one to count visits, one that only a maintainer signing into the admin console ever receives — and keeps your theme choice in localStorage. That's the whole list, and it's written out below with names, flags and lifetimes so you can check it against your own devtools.
- cookies set
- 2
- for visitors
- 1
- ad cookies
- 0
- last updated
- 13 August 2026
00 / definitions
What A Cookie Actually Is
A cookie is a small named string a site asks your browser to keep and hand back on every later request to that site. It is how a server tells one visit from the next without knowing who you are. localStorage and sessionStorage are the other two places a page can leave data; they are not cookies, are never attached to a request, and are readable only by JavaScript running on the same site. This page covers all three, because "we only use essential cookies" is a hollow claim if the tracking simply moved next door.
A cookie is called first-party when it belongs to the domain in your address bar, and third-party when it belongs to someone else's domain embedded in the page. Both cookies here are first-party. The analytics one is first-party because analytics requests are proxied through /ingest on whatportis.com and forwarded server-side — which is worth stating plainly, since it also means a generic "block third-party cookies" setting will not stop it. The section on control below says what will.
01 / inventory
Every Cookie This Site Sets
Two, both first-party. The project key in the PostHog name is a public identifier for this site's analytics project, so the real cookie reads as a long string rather than the placeholder shown here.
ph_<project key>_posthog
analyticscookie- provider
- PostHog, served first-party through /ingest on this domain
- purpose
- Holds a random id for this browser, the id of the current session, and the referrer or campaign the visit arrived on. It is how a page view gets counted without an account. The id is generated in your browser; nothing on this site ever asks for a name, an email or a login to attach to it.
- lifetime
- 365 days, pushed back on each visit
- flags
- readable by JavaScript (not httpOnly), SameSite=Lax, path=/, secure over https
- set in
- posthog-js defaults, initialised in components/PostHogProvider.tsx
admin-auth
necessarycookie- provider
- WhatPortIs (this site)
- purpose
- Marks a signed-in maintainer in the admin console. It holds the literal string "true" and nothing else — no id, no name, no session record. It is only written after someone posts the correct admin password, and it is never set for ordinary visitors: reading, searching and contributing all work without a login.
- lifetime
- 24 hours (max-age 86400); logging out deletes it immediately
- flags
- httpOnly (JavaScript cannot read it), SameSite=Strict, path=/, secure in production
- set in
- app/api/admin/login/route.ts
The analytics client is also configured to report uncaught JavaScript errors, so a page that breaks for you gets seen and fixed. Those reports carry the same random id as everything else. What gets collected, as opposed to what gets stored on your machine, is the subject of the privacy policy.
02 / not cookies
Other Browser Storage
These are not cookies and this page does not pretend otherwise. They are stored in your browser, they never travel with a request, and the same controls clear them.
whatportis-theme
preferencelocalStorage- provider
- WhatPortIs (this site)
- purpose
- Remembers whether you picked light, dark or system from the theme toggle. It holds one of those three words.
- lifetime
- until you clear site data
- flags
- not sent to the server — it is read in the browser only
- set in
- next-themes, configured in app/layout.tsx
ph_<project key>_posthog
analyticslocalStorage- provider
- PostHog
- purpose
- The same analytics record as the cookie above. PostHog writes to both by default, so the id survives a cookie being dropped.
- lifetime
- until you clear site data
- flags
- same contents as the cookie; read in the browser only
- set in
- posthog-js default persistence of localStorage+cookie
ph_<project key>_window_id, ph_<project key>_primary_window_exists
analyticssessionStorage- provider
- PostHog
- purpose
- Ties events to one browser tab so two tabs are not read as two people.
- lifetime
- cleared when the tab closes
- flags
- per-tab, never sent as a request header
- set in
- posthog-js session handling
03 / absent
What Isn't Here
- advertising cookies
- no ad network runs here. Google AdSense was integrated once and was removed from the codebase; nothing replaced it.
- cross-site trackers
- no pixels, no tag manager, no remarketing tags, no data brokers. Nothing here follows you off this domain.
- social embeds
- no like buttons, no embedded timelines, no comment widgets — those set cookies for the network behind them.
- font cookies
- Inter Tight and JetBrains Mono are compiled into this site by next/font at build time, so your browser never asks Google for them and Google never sees the request.
- sold data
- the analytics figures are read by the people who maintain the database and by nobody else. They are not sold, traded or licensed.
04 / control
How To Control It
There is no cookie banner on this site today, and this page will not invent one. The analytics cookie is written when a page loads. That is the honest description of what happens, and the controls that actually work are the ones your browser already gives you.
The quickest one: click the padlock or the tune icon at the left of your address bar while you are on whatportis.com. Every major browser puts per-site cookie and data controls behind it, including a button that clears everything this site has stored. The longer route runs through settings.
- chrome
- settings → privacy and security → site settings → view permissions and data stored across sites
- firefox
- settings → privacy & security → cookies and site data → manage data
- safari
- settings → privacy → manage website data
- edge
- settings → cookies and site permissions → manage and delete cookies and site data
blocking — set your browser to block cookies for whatportis.com, or run a content blocker with a rule against the /ingest path. Because the analytics endpoint is proxied through this domain, a third-party cookie block or a blocklist entry for posthog.com will miss it; the block has to be aimed at this site.
clearing — clearing site data for whatportis.com removes the analytics cookie, its localStorage copy, the per-tab keys and your theme preference in one go. Nothing is rebuilt from a backup: the next visit starts with a fresh random id, indistinguishable from a first-time reader.
do not track / gpc — being straight about this: the analytics client runs on its default setting, which does not read the Do Not Track header, and it has no Global Privacy Control handling either. Sending those signals will not currently change what this site stores. If that matters to you, block or clear the cookie instead — that works today, and it works regardless of what any header says. If this changes, the entry above changes with it.
05 / consequences
If You Block Them
The site works. Search, categories, port pages, the API and sending a correction are all rendered on the server or need no stored state, so none of them depend on a cookie. Nothing is gated, nothing degrades, and no message will nag you about it.
Two things change. We stop being able to tell whether anyone read a page, which is the entire cost to us and a fair trade. And if you block site data wholesale rather than just cookies, your theme choice stops sticking — the page falls back to your operating system's light or dark setting on every visit, which for most people is the right answer anyway.
06 / processors
Who Else Sees It
One company: PostHog, which runs the analytics. Requests go to /ingest on this domain and are forwarded server-side to PostHog's US cloud region, so the data is stored in the United States. Their handling of it is covered by posthog.com/privacy.
Nobody else. The admin cookie never leaves this site's own server, and the theme key never leaves your browser. For what the server itself logs, and how corrections you submit are handled, see the privacy policy and the terms of service.
07 / upkeep
Changes And Contact
The inventory on this page is meant to match the code, not to describe it loosely. If a cookie is added, a lifetime changes, a consent banner appears or the analytics tool is swapped, this page is edited in the same change and the date at the top moves. A policy that has drifted from the code is a bug here, the same as a wrong port number.
Found something we store that isn't listed?
Open your devtools, compare the keys against the tables above, and tell us if they disagree. Questions about anything on this page go to the same address.