Cookie policy

Summary

Browsing the public pages sets no cookies. We use no analytics, advertising, social media or tracking cookies, and no third-party cookies. That is why there is no cookie banner: the only cookies below are strictly necessary for a service you ask for, which German law (Section 25(2) TDDDG) allows without consent.

We also store nothing else in your browser, such as local storage, for tracking. The quick scan keeps your answers only in the open page.

The cookies

__Host-vb_session
Keeps you signed in to your workspace.
Set: After you sign in. Lasts: Up to 7 days, or until you sign out. First-party, HTTPS only.

__Secure-vb_oauth
Ties a Google or GitHub sign-in to the browser that started it, so nobody can complete it in your name.
Set: When you choose Google or GitHub. Lasts: 10 minutes, deleted when the sign-in finishes. First-party, HTTPS only.

sidebar_state
Remembers whether the workspace sidebar is open.
Set: When you toggle the sidebar. Lasts: 7 days. First-party, HTTPS only.

How they are protected

The sign-in cookies cannot be read by scripts on the page (HttpOnly), are only sent over HTTPS (Secure), and are not sent along with requests started by other websites (SameSite=Lax). The __Host- and __Secure- name prefixes make browsers enforce these rules. The cookies hold only a random value; the matching record on our side is stored as a hash.

Cloudflare security checks

If Cloudflare suspects an automated attack, it may show a short security check. Only then can it set a strictly necessary security cookie such as __cf_bm or cf_clearance, which lasts between 30 minutes and a few hours. Normal visits do not trigger this.

Your choices

You can delete or block cookies in your browser settings at any time. Blocking the sign-in cookies means you cannot stay signed in to the workspace; the public pages work without any cookies. Signing out deletes the session cookie.

More detail is in our privacy policy.