Cookie Policy
What OmniOS OÜ stores in your browser, why, and for how long. Optional analytics needs a saved choice on both sites; essential functions and aggregate request counts are separate.
- In force from
- Version
- 2.4
- Issued by
- OmniOS OÜ
Aligns both sites around optional analytics, remembered preferences and aggregate server measurement without automatic prompts.
1The two sites are treated differently, on purpose
Vultax runs two sites. vultax.com is the public website: a visitor arrives without an account, often from a search result, and has no relationship with us. app.vultax.com is the product: it includes public research screens and account features governed by the Terms.
Optional analytics is off until you enable it on either site. Essential sign-in and security functions and aggregate server-request counts continue independently. Accepting the Terms does not enable optional analytics.
There is no automatic analytics popup. Open Analytics choices in the website footer, or Settings → Privacy & data in the app, to enable or withdraw optional measurement.
Your answer is stored in one cookie that both sites read, so a choice made in either place applies in both. Declining is stored for longer than accepting, because a refusal should not quietly expire and put the question back in front of you.
2What we set
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
| vx_session | Keeps you signed in to the app. Signed, HttpOnly, Secure, SameSite=Strict — it cannot be read by scripts and is not sent to other sites. | 24 hours | Strictly necessary |
| vx_oauth_state_nonce | A single-use value that ties a "Sign in with Google" redirect back to the browser that started it. Prevents sign-in request forgery. | The sign-in flow only | Strictly necessary |
| vx_oauth_pkce_verifier | The PKCE code verifier, which stops an intercepted authorisation code from being exchanged by anyone else. | The sign-in flow only | Strictly necessary |
| vx_consent_analytics_v2 | Records your analytics choice — granted or denied — so we do not ask again and so the choice applies on both sites. Scoped to Domain=vultax.com for that reason. It contains no identifier and nothing about you. | 180 days if you allow analytics; 400 days if you decline | Strictly necessary — it is the record of your own decision |
| _ga and site-specific _ga cookies | Google Analytics 4 in the app. A pseudonymous client identifier for consenting page measurement, written only after you allow optional analytics. Our first-party analytics uses the separate browser identifier below on both sites. | 180 days | Analytics |
| vx_pa_browser_v1 | An optional pseudonymous browser identifier used by our first-party analytics after permission. | Up to 180 days; detailed records last 90 days | Optional analytics |
| vx_ref | Remembers which member referred you, if you arrived through a vultax.com/r/ link, so their share is credited when you create an account. It holds a referral code and nothing else. HttpOnly, Secure, SameSite=Lax. | 30 days | Functional |
There are no advertising cookies on either site, and we do not set anything that tracks you across other people's websites.
2bStored in your browser, but not a cookie
The app keeps some state in your browser's local storage. Local storage is covered by the same consent rule as cookies, so it is listed here. Display and feature settings support the actions you request. After permission, optional analytics also keeps a short-lived session identifier in session storage, renewed after 30 minutes of inactivity; it groups consenting page events and is removed on withdrawal.
| Key | What it holds | Lifetime | Type |
|---|---|---|---|
| vultax:theme | Which of the app's colour themes you picked. | Until you clear it | Strictly necessary — it exists only because you chose a theme |
| vultax:device_fingerprint | A random identifier this browser generates for itself the first time you sign in, sent with your sign-in request along with your time zone, language and browser user-agent so we can recognise a familiar device and challenge an unfamiliar one. It is not derived from anything about your hardware and is not used for analytics or advertising. | Until you clear it | Strictly necessary — account security |
| vultax:vi_session_id and vi:settings:v1 | The identifier of your current Vi conversation and your Vi display preferences, so a reload does not lose the thread. | Until you clear it | Strictly necessary — it is the feature you opened |
| vultax:review | Whether you have already been asked for feedback, so you are not asked twice. | Until you clear it | Strictly necessary |
The paper desk no longer keeps positions in your browser: simulated positions belong to your Vultax account and are held on our side, which is described in the privacy policy. Nothing on the paper desk is money, and no order reaches a market.
3Third parties
| Who | What it stores | Why |
|---|---|---|
| Google Analytics 4 | The Google Analytics cookies described above. Advertising features, Google Signals and ad personalisation are switched off, and Google is instructed to deny advertising storage regardless of your analytics choice. | Counting page views, navigation, completed signups and checkout starts. We do not send account identifiers, email addresses, search terms, wallet addresses or payment details. Governed by Google's privacy policy. |
| Cloudflare | __cf_bm, a bot-management token, and cf_clearance only if you are challenged. | Distinguishing people from automated traffic, so the service stays up under attack. Strictly necessary for security; Cloudflare does not use them for advertising. |
| Aggregate server measurement | No analytics cookie, browser identifier or extra browser beacon is used for aggregate request counts. | Counts are derived from existing server requests. They contain no visitor profile and are separate from consenting-browser measurements. See the privacy policy for purpose and retention. |
| Stripe | Cookies set on Stripe's own checkout and billing pages, under Stripe's control. | Payment processing and card fraud prevention. Governed by Stripe's privacy policy. |
| OpenAI, ChatGPT Ads measurement | Nothing. There is no OpenAI browser pixel on either site. | When you subscribe to the research newsletter we report that one event from our own server — a one-way hash of the address you just gave us, never the address itself, with the IP address and user-agent of that request. What OpenAI receives is in the privacy policy and on the sub-processors page. |
4Changing your mind, and blocking the lot
- On vultax.com: the Analytics choices link in the footer of every page reopens the question. Declining stops optional browser measurement immediately and removes the analytics cookies the page can reach.
- On app.vultax.com: Settings → Privacy & data changes the saved analytics choice for this browser. It applies on both sites and is not tied to your plan.
- In your browser: you can block or delete cookies and scripts entirely. Blocking the essential sign-in cookies will prevent sign-in. Optional analytics may be blocked without affecting the service.
- Google's own opt-out: Google publishes a browser add-on that stops Google Analytics on every site, including ours.
Questions about anything on this page go to [email protected]. The wider picture — what we hold, on what legal basis and for how long — is in the privacy policy.