Session cookie
Name: vsn_session. Purpose: keeps you logged in. Contains a signed, rotating token, never your password. httpOnly, Secure, SameSite=Lax. Lifetime: 30 days, or until you log out. Strictly necessary — the service cannot work without it.
Preference cookie
Name: vsn_prefs. Purpose: remembers your interface language and light/dark choice so pages render correctly on first paint. Contains two short strings. Lifetime: one year. Functional.
CSRF cookie
Name: vsn_csrf. Purpose: protects form submissions against cross-site request forgery. Contains a random token. Lifetime: session. Strictly necessary.
What we do not use
No Google Analytics, no Meta pixel, no advertising identifiers, no session recording, no third-party embeds that set cookies. Aggregate traffic statistics come from server logs that are not tied to a cookie. This is why you do not see a consent banner: there is nothing non-essential to consent to.
Controlling cookies
You can clear or block cookies in your browser. Blocking the session cookie means you cannot stay logged in; everything else degrades gracefully.