Cookie Policy
This page describes browser storage used by the current VectorXS application.
Strictly necessary cookies
| Name | Purpose | Typical duration | Category |
|---|---|---|---|
vectorxs_session | Keeps an authenticated user signed in and associates requests with the correct server-side session. | Up to 14 days unless signed out or revoked earlier. | Strictly necessary |
vectorxs_csrf | Protects sign-in and other forms from cross-site request forgery. | Up to two hours. | Strictly necessary |
A short-lived vectorxs_native_signin cookie binds an email code or provider response to the initiating browser for up to ten minutes. Authentication cookies use HttpOnly. Session and CSRF cookies use SameSite=Lax; the temporary Apple sign-in cookie uses SameSite=None so Apple can return its verified form response. Production startup requires Secure cookies and an HTTPS public URL.
Cloudflare Turnstile is embedded on account forms for security checks. VectorXS verifies its result on the server. The widget processes browser security signals through Cloudflare; it is not an advertising or analytics feature.
Analytics and advertising
This build does not include Google Analytics, advertising pixels, social-media tracking pixels, or similar non-essential browser tracking. Because there are no optional tracking cookies in this build, there is no “accept all” control.
Cookie notice preference
When you dismiss the cookie notice, the browser stores a small local preference in localStorage so the notice does not repeatedly appear. That preference is not used for advertising or cross-site tracking.
Theme preference
Your light or dark appearance choice is stored in localStorage under vectorxs-theme until you change it or clear site storage. It is not an authentication credential.
Changes
If analytics, advertising, embedded media, or other non-essential browser storage is added later, the cookie notice and this policy must be updated before those technologies are enabled for users who require consent.