Cookie Policy

Four cookies. All of them strictly necessary.

We set no advertising cookies, no analytics cookies, and nothing that follows you anywhere, so there is nothing to opt into or out of. What we do set is the handful of first-party cookies without which you could not stay signed in — listed below by name, with what each one does and how long it lives.

Last updated
21 October 2026
Effective
5 August 2026
On this page

What this covers

Cookies are small files a site stores in your browser. This policy covers those, and also the two other places we keep data in your browser — session storage and local storage — because from a privacy point of view what matters is not the mechanism but what is held and for how long.

It applies to our website, the web console, and the docs site. For the wider picture of what we collect, read the Privacy Policy.

Cookies we set

Every cookie below is first-party, marked HttpOnly and Secure, and restricted by SameSite. They exist to keep you signed in and to stop a stolen token being replayed from another device. None of them profile you, and there is nothing to opt out of — removing them signs you out.

Cookies set by PulsVault, with purpose and lifetime
CookiePurposeLifetime
tokenCarries your signed access token so the API knows the request is yours. HttpOnly, so page scripts cannot read it.Short-lived; refreshed while you stay active
refresh_tokenLets the app obtain a new access token without asking you to sign in again.Session, or the length of "keep me signed in"
session_idIdentifies your server-side session so you can list and revoke your active sessions.Until you sign out or the session expires
fp_tagBinds a session to the device that opened it. A token replayed from another device fails this check.Matches the session it protects

Because all four are strictly necessary to deliver a service you asked for, they do not require consent under the ePrivacy rules — which is why the notice on your first visit asks you only to accept them, not to choose.

Browser storage

Data PulsVault keeps in browser session and local storage
KeyPurposeLifetime
fp_tagThe device fingerprint the client sends alongside requests, matching the cookie of the same name.Persistent, until you clear site data
onepasse_recent_searches, onepasse_search_filterYour recent searches and last filter, so the console reopens where you left it.Persistent, until you clear it or clear site data
cookie-noticeRemembers that you accepted the cookie notice, so it is shown only once.Persistent, until you clear site data
UI preferencesInterface choices such as theme, sidebar state and dismissed hints.Persistent, until you clear site data

Locking your vault, signing out, or closing the browser clears the session-storage entries immediately. On a shared or public computer, lock or sign out when you finish — that is what the lock button is for.

No tracking, no ad tech

To be explicit about what is absent:

  • No advertising or retargeting cookies, and no advertising network on any page.
  • No third-party analytics or session-recording scripts.
  • No social media tracking pixels or embedded like buttons.
  • No cross-site identifiers, no fingerprinting for profiling, and no data brokers.

The one fingerprint we do compute is a device tag used purely to bind your session to your device. It is a security control, not a profiling tool, and it is not shared with anyone.

Our payment pages hand off to our payment processor, which sets its own cookies to complete a transaction and prevent fraud. Those cookies are governed by that provider's policy, and they appear only when you are actively paying.

Managing cookies

Every browser lets you view, block, and delete cookies and site data, usually under Privacy or Site settings. You are welcome to do so at any time.

  • Clearing our cookies signs you out and ends your sessions on this browser.
  • Clearing site data also removes your interface preferences and recent searches.
  • Blocking cookies for this site entirely will prevent sign-in from working at all.

Nothing you clear touches your vault. Your data lives encrypted on our servers, and it comes back the next time you sign in and unlock.

Changes to this policy

If we ever add a cookie, this page changes first and the date at the top moves with it. Should we one day introduce anything that is not strictly necessary, we would ask for your consent before setting it — not after.

Contact us

Questions about cookies or anything else on this page: privacy@pulsvault.com. For anything else, write to hello@pulsvault.com.

Also worth reading