Cookie Policy
Version: v1.1 β 2026-09-13 Effective date: 2026-09-13
This Cookie Policy explains how Vestibo
("Vestibo") uses cookies and similar technologies on the
website at https://vestibo.com (the
"Website") and the dashboard at https://app.vestibo.com
(the "Dashboard"). It supplements the Privacy Policy.
This Cookie Policy is written to satisfy our obligations under the EU ePrivacy Directive (Directive 2002/58/EC) as implemented in EU Member States, the UK Privacy and Electronic Communications Regulations 2003, and the consent-related provisions of the GDPR. Today we set strictly-necessary cookies plus a small number of consent-exempt preference cookies and browser-storage items (such as your language and theme choices and onboarding progress); we do not set analytics or advertising cookies. Because none of these require consent under the ePrivacy rules, we do not currently display a cookie-consent banner. If we later introduce non-essential cookies, we will add a consent mechanism and update this policy first.
1. What cookies are
Cookies are small text files that a website places on your device. "Similar technologies" include local storage, session storage, pixels (1Γ1 images), and SDKs. Throughout this policy we use "cookies" to refer to all of these.
2. Cookies we use
2.1 Strictly necessary (always on)
These cookies are essential for the Service to work and are set without consent on the basis of legitimate interests.
| Name | Purpose | Storage | Duration |
|---|---|---|---|
agentic_token | httpOnly session cookie that authenticates your signed-in dashboard session; JavaScript cannot read it, and our middleware uses it to protect signed-in routes. | Cookie (httpOnly, Secure in production, SameSite=Lax) | Up to 30 days. |
agentic_auth_user | Your non-sensitive profile (name, email, role) cached so the signed-in dashboard paints instantly. | localStorage | Until logout. |
During sign-up and Google sign-in we also set short-lived,
path-scoped httpOnly security cookies β vestibo_signup (sign-up
verification / anti-hijack binding, ~30 minutes) and, on the Google
flow, g_oauth_state and g_oauth_pkce (OAuth CSRF/PKCE protection,
~10 minutes). These are strictly necessary, carry no tracking value,
and expire within minutes.
2.2 Analytics
We do not set analytics cookies in your browser, and we use no third-party analytics SDK. We measure two things, both without storing anything on your device:
- Product usage β for example, how far accounts get through the sign-up flow β measured server-side from your authenticated interactions with the Service.
- Website pages β when you view a page on our public website, our
own server records the page path, the site that referred you (the
domain only, never the full link or your search terms), a country,
a coarse device type (phone / tablet / computer), and any
utm_campaign tag in the link you followed.
Three details about the website measurement, because they are the reason it needs no consent prompt:
- Nothing is written to or read from your device β no cookie, no local storage, no session storage, no pixel. There is nothing stored for you to clear.
- We do not store your IP address with this measurement. Your address and browser name are combined into an irreversible code that lets us count how many people visited without knowing who they are. The key to that code is regenerated every day, so yesterday's codes and today's cannot be matched to each other β the records themselves give us no way to follow a visitor from one day to the next, or to work out who any code belongs to. To be precise about the limit of that: the code is derived with a secret key we hold, so if we already knew a specific person's IP address and browser we could test whether a matching code appears on a given day. We do not do this, and it is not something the stored data lets us discover β it would require knowing who we were looking for, and their exact address, beforehand.
- The country is worked out from your browser's timezone setting, not from your IP address β so it is approximate, and it is blank whenever the timezone does not identify a single country.
Because none of this relies on cookies or similar device storage, it does not require a consent prompt under the ePrivacy rules.
2.3 Functional (preferences)
| Name | Purpose | Storage | Duration |
|---|---|---|---|
agentic-theme | Remembers your light/dark theme preference. | localStorage | Persistent (until cleared). |
agentic-onboarding | Remembers your progress through and dismissal of the onboarding checklist. | localStorage | Persistent (until cleared). |
agentic_locale | Remembers the language you chose (set when you choose a language from the switcher). | Cookie (SameSite=Lax) | 1 year. |
We also use other first-party browser storage β for example, a trial-notice dismissal and the embeddable widget's session id (both cleared when the browser tab closes). These carry no tracking value and are not shared with any third party.
2.4 What we do not use
We do not use:
- third-party advertising or remarketing cookies (Google Ads, Meta Pixel, etc.);
- cross-context behavioural advertising trackers;
- device fingerprinting to identify or re-identify you, to follow you between visits, or to recognise you on any other website. The daily-rotating code described in Β§ 2.2 is deliberately built so it cannot do any of those things: it is irreversible, it is scoped to our own site, and its key changes every day;
- pixels from social networks on the public marketing surfaces.
3. Sub-processor cookies
No third-party sub-processor sets cookies through our website or dashboard today. The embeddable widget and its installer are served from our own infrastructure under the same cookie policy as the dashboard.
4. Managing your choices
- Nothing to opt out of today. Because we set only strictly-necessary cookies and preference storage (no analytics or advertising cookies), there are no optional cookies to toggle. The website measurement in Β§ 2.2 stores nothing on your device, so it leaves nothing for you to clear or switch off here either; if you object to it, Β§ 8 of the Privacy Policy covers your right to object to processing based on legitimate interests. If we add non-essential cookies in future, we will provide a consent banner and preference controls here.
- Browser controls. You can block or delete cookies via your browser settings. Blocking strictly necessary cookies will break parts of the Service (notably login).
- Do Not Track / Global Privacy Control. We do not respond to the
DNTheader because there is no industry standard. Because we do not sell or share personal information for behavioural advertising, a Global Privacy Control signal has no sale or sharing to opt out of; we would honour it as a CCPA opt-out to the extent any such activity ever applied.
5. Changes
We may update this Cookie Policy when we add, remove, or change cookies. We always publish the current version here with the Effective date at the top, and for material changes we will give notice β including a consent mechanism if we introduce any non-essential cookies β before the change takes effect.
6. Contact
privacy@vestibo.com for any question about this Cookie Policy.
Changelog
- v1.1 (2026-09-13) β Β§ 2.2 rewritten to describe the first-party,
cookieless website measurement (page path, referring domain,
timezone-derived country, device type,
utm_tags) that now runs on the public site, including the daily-rotating irreversible visitor code and the fact that no IP address is stored with it. Β§ 2.4's flat "no fingerprinting" line narrowed to the claim that is actually true and testable, and Β§ 4 extended to say the new measurement leaves nothing on the device to clear. No cookie or device storage was added, so no consent banner is required. - v1.0 (2026-07-23) β first published version; rebranded to Vestibo and reconciled to the current product.
- v0.1 (2026-05-16) β initial internal draft.