VesselTwin Cookie Notice
Last updated 2026-07-10
1. Summary
VesselTwin sets two kinds of browser storage. Strictly necessary cookies and storage keep you signed in, keep your session secure, and make the app work — these are always on. Optional analytics cookies help us measure traffic (unique visitors, sessions, which pages lead where) and are set only if you choose Accept on the first-visit prompt. If you decline — or never answer — analytics run in a cookieless mode that stores nothing on your device. We do not use advertising or cross-site tracking cookies, and we do not embed third-party social or marketing pixels.
Under EU/UK ePrivacy rules, strictly-necessary cookies do not require prior consent; analytics cookies do, which is why we ask first and default to cookieless.
2. What we set today
| Cookie / storage | Purpose | Category | Lifetime | Set by |
|---|---|---|---|---|
Clerk authentication cookies — observed names include __session, __client_uat, __clerk_db_jwt, clerk_active_context, and per-instance suffixed variants. Exact set may change with provider updates. | Sign-in session, session JWT, active-organization context, CSRF / clickjacking protection. | Strictly necessary | Session / up to 30 days | Clerk (auth provider) |
localStorage key __clerk_environment | Caches Clerk environment config (sign-in methods, social providers) to speed up auth UI load. | Strictly necessary | Until you clear browser storage | Clerk (auth provider) |
localStorage key cookie-consent.v2 | Remembers your Accept/Decline choice from the first-visit cookie prompt (replaces the older cookie-disclosure.acknowledged.v1 key). | Strictly necessary (record of your choice) | Until you clear browser storage or change your choice below | VesselTwin |
PostHog analytics cookie and storage — ph_* cookie plus matching localStorage keys. | Recognizes your browser across visits so traffic measurement (unique visitors, sessions, page flows) is accurate. Set only after you choose Accept on the first-visit prompt — never before, and never if you decline. | Analytics (optional — consent required) | Up to 1 year, or until you withdraw your choice | PostHog (analytics provider), first-party |
localStorage keys under recipient-terms.accepted.* | Remembers your acceptance of recipient terms on a vendor or document share link. | Strictly necessary (record of legal acceptance) | Until you clear browser storage | VesselTwin |
| Next.js framework cookies (e.g. locale, build id where applicable) | Application routing and asset versioning. | Strictly necessary | Session | Next.js (framework) |
3. What we do not set
- No analytics cookies without your consent — and none from any provider other than the PostHog integration described above.
- No Google Ads, Facebook/Meta Pixel, LinkedIn Insight, TikTok Pixel, or other advertising / retargeting cookies.
- No third-party social embeds that drop cookies (e.g. embedded YouTube, Twitter, Facebook widgets).
- No cross-site tracking or device-fingerprinting.
For transparency beyond cookies: even without your consent, we measure traffic and product usage (for example, which pages are visited and which features are used) with a cookieless analytics configuration that stores nothing on your device. Signed-in activity is associated with your account's opaque identifier so we can understand how the product is used; event payloads are restricted to identifiers and bounded values — never vessel names, hull IDs, locations, document contents, or free text. Details: subprocessors page and Privacy Policy §8.
4. Mobile apps
The VesselTwin native iOS app and the Android Capacitor wrapper authenticate using bearer tokens stored in the operating system's secure storage (Keychain on iOS, Capacitor Preferences on Android). They do not use HTTP cookies. The first-visit cookie banner therefore only appears in the web browser.
5. How to control cookies
The only optional cookies we set are the analytics cookies described in Section 2, and they are controlled by the Accept / Decline choice on the first-visit prompt. You can change that choice here at any time — withdrawing is immediate, drops the stored analytics identifier, and returns analytics to cookieless mode:
You have not made an analytics-cookie choice on this browser yet.
You can also clear cookies and site data in your browser settings — note that doing so signs you out and re-arms the first-visit prompt.
6. Future changes
The first-visit prompt is a true consent control with Accept / Decline, and no optional cookie fires before you make a choice. If we ever add further categories of non-essential cookies (for example, marketing), we will update this notice and ask for a separate choice first. Material changes will be reflected on this page; the "Last updated" date at the top will move.
7. Contact
Questions about cookies or privacy? privacy@vesseltwin.io.