Cookies
Every cookie we set, what it does, and how long it lasts. If a cookie is not on this page, we do not set it.
Before you sign in, there are none
The public pages — everything you can read without an account, including this one and every status page — set no cookies at all. Not a session cookie, not a preference, nothing.
That is unusual enough to be worth saying plainly, because most sites showing you a cookie banner have already set several before you answer it. We do not show you one, because there is nothing to ask about.
Strictly necessary
These are set only once you sign in or unlock a protected status page, and only because the thing you asked for cannot work without them. Under the ePrivacy rules they do not require consent, and there is no way to refuse them and still sign in.
| Name | Purpose | Lasts |
|---|---|---|
better-auth.session_token | Keeps you signed in. Without it every page would ask for your password again. | 30 days, or until you sign out |
better-auth.session_data | A short-lived signed copy of your session, so each dashboard page does not need a database round trip to know who you are. | 5 minutes |
better-auth.dont_remember | Records that you asked not to be kept signed in. | Until you close the browser |
vsp_… | Remembers that you entered the password for one specific status page. One cookie per page, so unlocking one does not unlock another. | 7 days |
In production all of these are Secure and HttpOnly, which means they are sent only over HTTPS and cannot be read by scripts on the page.
Analytics — our own, and it stores nothing on your device
We measure our own public pages, this one included, with the analytics built into this product. It sets no cookie, writes nothing to local storage and reads nothing from your device — which is why there is still no banner. The consent rules are about storing or reading on your equipment, and this does neither.
Not in the dashboard, and not on a status page you publish: those visitors are yours rather than ours, and counting them under our own account is not something we will do.
No Google Analytics and no third-party tag — nothing here can follow you to another site. Your address is turned into a short hash using a secret that is generated daily and destroyed after two days, so once it is gone nobody, us included, can work out which rows were you.
There used to be optional analytics here behind a consent banner, and that is what is gone: the banner, the choice it stored, and the third-party tag behind them.
If you allowed or declined it in the past, your browser may still hold avitrina.consent.analytics value in local storage. Nothing reads it any more and you can delete it.
What we do not use
No advertising cookies, no retargeting pixels, no social plugins, no session recording or heat-mapping, and no cross-site tracking of any kind. We do not sell or share anything for advertising, and there is no third party building a profile of you through us.
Managing them yourself
Every browser can show, block and delete cookies for a site, and blocking ours will sign you out rather than break anything permanently. If you would rather ask us something first, write to privacy@vitrinaengine.com.
The privacy policy covers what we do with personal data more broadly, and the sub-processor list names every company involved.
Last updated 31 August 2026.