Cookie Policy
A complete list of what OmniOS OÜ stores on your device when you use Vultax. It is short because the list is short: three cookies that exist only to sign you in and keep the sign-in flow safe.
- In force from
- Version
- 1.1
- Issued by
- OmniOS OÜ
Version 1.1 lists the two browser local-storage entries alongside the cookies. First published as a standalone document, replacing the cookie section of the February 2026 privacy policy, which listed analytics and marketing categories the site no longer uses.
1Why there is no cookie banner
Article 5(3) of the ePrivacy Directive, implemented in Estonia by § 102-1 of the Electronic Communications Act, requires consent before storing anything on your device — unless it is strictly necessary to provide the service you asked for.
Everything we store is strictly necessary. We run no advertising cookies, no profiling cookies, no cross-site tracking, no social plugins, and no third-party analytics that identify you. There is nothing here to consent to, so we do not interrupt you to ask.
If that ever changes, a consent banner will appear before the first non-essential cookie is set, refusing will be as easy as accepting, and nothing will load until you choose. We will not treat a scroll or a continued visit as consent.
2What we set
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
| vx_session | Keeps you signed in to the terminal. Signed, HttpOnly, Secure, SameSite=Strict — it cannot be read by scripts and is not sent to other sites. | 24 hours | Strictly necessary |
| vx_oauth_state_nonce | A single-use value that ties a "Sign in with Google" redirect back to the browser that started it. Prevents sign-in request forgery. | The sign-in flow only | Strictly necessary |
| vx_oauth_pkce_verifier | The PKCE code verifier, which stops an intercepted authorisation code from being exchanged by anyone else. | The sign-in flow only | Strictly necessary |
The public terminal and the marketing site set none of these until you sign in. You can read vultax.com end to end without anything being stored on your device.
2bStored in your browser, but not a cookie
Two features keep their state in your browser's local storage. Local storage is covered by the same consent rule as cookies, so it is listed here. Neither entry is ever sent to us.
| Key | What it holds | Lifetime | Type |
|---|---|---|---|
| vultax:theme | Which of the terminal's colour themes you picked. | Until you clear it | Strictly necessary — it exists only because you chose a theme |
| vultax.predictions.paperDesk.v1 | Your simulated paper-desk positions and virtual balance. Nothing here is money, and nothing here reaches our servers. | Until you clear it or reset the desk | Strictly necessary — it is the feature you opened |
3Third parties
| Who | What it stores | Why |
|---|---|---|
| Cloudflare | __cf_bm, a bot-management token, and cf_clearance only if you are challenged. | Distinguishing people from automated traffic, so the Service stays up under attack. Strictly necessary for security; Cloudflare does not use them for advertising. |
| Cloudflare Web Analytics | Nothing. It is cookieless by design and stores no identifier on your device. | Aggregate page and referrer counts, so we know what to build and fix. |
| Stripe | Cookies set on Stripe's own checkout and billing pages, under Stripe's control. | Payment processing and card fraud prevention. Governed by Stripe's privacy policy. |
We removed Google Analytics from both vultax.com and the terminal in September 2026, and no longer load any Google tag. The earlier version of our privacy policy described analytics and marketing cookies that are no longer in use.
4Controlling what is stored
Every browser lets you view, block and delete cookies for a site. Blocking ours will sign you out and prevent sign-in, because the sign-in flow cannot work without them. Nothing else on the site depends on a cookie.
Questions about anything on this page go to [email protected]. The wider picture is in the privacy policy.