Cookie Policy
What OmniOS OÜ stores in your browser, why, and for how long. Optional analytics needs a saved choice on both sites; essential functions and aggregate request counts are separate.
- In force from
- Version
- 2.7
- Issued by
- OmniOS OÜ
Version 2.7, 21 October 2026: documents the separate, off-by-default account-use permission receipt. The existing Usage analytics choice does not grant this scope.
1The two sites are treated differently, on purpose
Vultax runs two sites. vultax.com is the public website: a visitor arrives without an account, often from a search result, and has no relationship with us. app.vultax.com is the product: it includes public research screens and account features governed by the Terms.
Optional analytics is off until you enable it on either site. Essential sign-in and security functions and aggregate server-request counts continue independently. Accepting the Terms does not enable optional analytics.
While no choice is saved, vultax.com shows a short prompt with two answers, Accept analytics and No thanks. Nothing optional runs before you accept; closing the page, scrolling or browsing on is not a yes. The prompt stays away once you have answered on either site, if you declined before, or if your browser sends Global Privacy Control or Do Not Track. To change your answer later, open Analytics choices in the website footer, or Settings → Privacy & data in the app.
Your answer is stored in one cookie that both sites read, so a choice made in either place applies in both. Declining is stored for longer than accepting, because a refusal should not quietly expire and put the question back in front of you.
2What we set
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
| vx_session | Keeps you signed in to the app. Signed, HttpOnly, Secure, SameSite=Strict — it cannot be read by scripts and is not sent to other sites. | 24 hours | Strictly necessary |
| vx_oauth_state_nonce | A single-use value that ties a "Sign in with Google" redirect back to the browser that started it. Prevents sign-in request forgery. | The sign-in flow only | Strictly necessary |
| vx_oauth_pkce_verifier | The PKCE code verifier, which stops an intercepted authorisation code from being exchanged by anyone else. | The sign-in flow only | Strictly necessary |
| vx_consent_analytics_v2 | Records your analytics choice — granted or denied — so we do not ask again and so the choice applies on both sites. Scoped to Domain=vultax.com for that reason. It contains no identifier and nothing about you. | 180 days if you allow analytics; 400 days if you decline | Strictly necessary — it is the record of your own decision |
| _ga and site-specific _ga cookies | Google Analytics 4 in the app. A pseudonymous client identifier for consenting page measurement, written only after you allow optional analytics. Our first-party analytics uses the separate browser identifier below on both sites. | 180 days | Analytics |
| vx_pa_browser_v1 | An optional pseudonymous browser identifier used by our first-party analytics after permission. | Up to 180 days; detailed records last 90 days | Optional analytics |
| __Host-vx_account_usage_v1 | An opaque permission receipt for the separate Account-use measurement choice, set only when you explicitly enable it while signed in. Secure, HttpOnly, SameSite=Strict and restricted to app.vultax.com. It does not itself contain an account identifier. Server records associate the receipt with a protected account code for coarse qualifying actions; anonymous browsing history is never linked. Off by default. Withdraw in Settings → Privacy & data; withdrawing Usage analytics also revokes the associated permission and deletes its contributions. | Up to 90 days | Separately optional account-use measurement |
| vx_ref | No longer set. It remembered which member referred you when you arrived through a vultax.com/r/ link; the referral programme closed on 17 October 2026 and those links now lead to work with us. A cookie set before that date holds a referral code and nothing else, and expires on its own. | Up to 30 days from when it was set | Functional, discontinued |
There are no advertising cookies on either site, and we do not set anything that tracks you across other people's websites.
2bStored in your browser, but not a cookie
The app keeps some state in your browser's local storage. Local storage is covered by the same consent rule as cookies, so it is listed here. Display and feature settings support the actions you request. After permission, optional analytics also keeps a short-lived session identifier in session storage, renewed after 30 minutes of inactivity; it groups consenting page events and is removed on withdrawal.
| Key | What it holds | Lifetime | Type |
|---|---|---|---|
| vultax:theme | Which of the app's colour themes you picked. | Until you clear it | Strictly necessary — it exists only because you chose a theme |
| vultax:device_fingerprint | A random identifier this browser generates for itself the first time you sign in, sent with your sign-in request along with your time zone, language and browser user-agent so we can recognise a familiar device and challenge an unfamiliar one. It is not derived from anything about your hardware and is not used for analytics or advertising. | Until you clear it | Strictly necessary — account security |
| vultax:vi_session_id and vi:settings:v1 | The identifier of your current Vi conversation and your Vi display preferences, so a reload does not lose the thread. | Until you clear it | Strictly necessary — it is the feature you opened |
| vultax:review | Whether you have already been asked for feedback, so you are not asked twice. | Until you clear it | Strictly necessary |
The paper desk no longer keeps positions in your browser: simulated positions belong to your Vultax account and are held on our side, which is described in the privacy policy. Nothing on the paper desk is money, and no order reaches a market.
3Third parties
| Who | What it stores | Why |
|---|---|---|
| Google Analytics 4 | The Google Analytics cookies described above. Advertising features, Google Signals and ad personalisation are switched off, and Google is instructed to deny advertising storage regardless of your analytics choice. | Counting page views, navigation, completed signups and checkout starts. We do not send account identifiers, email addresses, search terms, wallet addresses or payment details. Governed by Google's privacy policy. |
| Cloudflare | __cf_bm, a bot-management token, and cf_clearance only if you are challenged. | Distinguishing people from automated traffic, so the service stays up under attack. Strictly necessary for security; Cloudflare does not use them for advertising. |
| Aggregate server measurement | No analytics cookie, browser identifier or extra browser beacon is used for aggregate request counts. | Counts are derived from existing server requests. They contain no visitor profile and are separate from consenting-browser measurements. See the privacy policy for purpose and retention. |
| Stripe | No longer reached from vultax.com or the terminal: checkout closed with the paid plans on 17 October 2026. Stripe's billing portal, for a subscription that predates that date, sets its own cookies under Stripe's control. | Payment records and card fraud prevention for those subscriptions. Governed by Stripe's privacy policy. |
| OpenAI, ChatGPT Ads measurement | Nothing. There is no OpenAI browser pixel on either site. | When you subscribe to the research newsletter we report that one event from our own server — a one-way hash of the address you just gave us, never the address itself, with the IP address and user-agent of that request. What OpenAI receives is in the privacy policy and on the sub-processors page. |
4Changing your mind, and blocking the lot
- On vultax.com: the Analytics choices link in the footer of every page reopens the question. Declining stops optional browser measurement immediately and removes the analytics cookies the page can reach.
- On app.vultax.com: Settings → Privacy & data changes the saved analytics choice for this browser. It applies on both sites and is not tied to your plan.
- In your browser: you can block or delete cookies and scripts entirely. Blocking the essential sign-in cookies will prevent sign-in. Optional analytics may be blocked without affecting the service.
- Google's own opt-out: Google publishes a browser add-on that stops Google Analytics on every site, including ours.
Questions about anything on this page go to [email protected]. The wider picture — what we hold, on what legal basis and for how long — is in the privacy policy.