Cookie Policy · Veloris

This policy explains the cookies and similar technologies used by Veloris (the “Platform”). It supplements the Privacy Policy.

The short version

We set two cookies. Both are strictly necessary to keep you signed in. We use no analytics cookies, no advertising cookies, and no third-party trackers — which is why you are not asked to accept a consent banner.

1. What cookies are

A cookie is a small text file a site asks your browser to store and send back on subsequent requests. Because HTTP has no memory of its own, this is how a site can tell that the request it just received came from someone who signed in a moment ago.

2. Cookies we set

Both are strictly necessary: without them you cannot stay signed in, and the Platform cannot function.

Cookie	Purpose	Lifetime
`access_token`	Authenticates each request, so the server knows which account is asking. Short-lived by design: if it were ever captured, the window in which it is useful is small.	30 minutes
`refresh_token`	Obtains a new access token when the current one expires, so a study session is not interrupted every half hour. Rotated on each use — a refresh token that has been used once is immediately invalid.	14 days

2.1 How they are protected

httpOnly — JavaScript cannot read them. This is the reason we use cookies rather than browser storage for session tokens: a token in localStorage is readable by any script that runs on the page, so a single cross-site scripting flaw would hand over the session. An httpOnly cookie is not exposed that way.
SameSite=Lax — the browser will not send them on cross-site requests initiated by another site, which blocks cross-site request forgery.
Secure in production — sent only over HTTPS, never in clear text.
Revocable — signing out invalidates that session server-side, not just in your browser. Resetting your password invalidates every session everywhere.

3. Cookies we do not set

Analytics cookies. None. We do not run Google Analytics or any comparable third-party analytics on the Platform.
Advertising and cross-site tracking cookies. None. We do not advertise and do not share data with ad networks.
Social media pixels, session replay, and fingerprinting. None.

If we introduce non-essential cookies, we will ask for your consent before setting them and update this policy first. Under the ePrivacy Directive and the UK PECR, strictly necessary cookies do not require consent — which is why there is no banner today. A banner that asks permission for cookies that cannot be declined is theatre, and we would rather tell you plainly what we set.

4. Browser storage (not a cookie)

The Platform stores your light/dark theme choice in your browser’s localStorage. It stays on your device, is never transmitted to us, contains nothing that identifies you, and is cleared when you clear site data.

5. Third-party cookies

We set no third-party cookies on the Platform. If you are taken to Stripe to complete a payment, Stripe operates that page and may set its own cookies under its own policy; those are outside our control and are covered by Stripe’s cookie policy.

6. Managing cookies

You can block or delete cookies in your browser settings — usually under Privacy or Site Settings, where you can also block them for this site specifically. Signing out from the Platform clears both cookies and invalidates the session server-side.

Blocking our two cookies will prevent you from signing in. There is no alternative mechanism: they are what authentication consists of. Blocking third-party cookies, by contrast, has no effect on the Platform at all, since we set none.

Browser instructions: Chrome, Firefox, Safari, Edge.

7. Changes and contact

If our use of cookies changes, this policy and its version and date will be updated, and we will seek consent first for anything non-essential. Questions: privacy@veloris.health.