VesselTwin Privacy Choices and Cookie Notice
Last updated 2026-08-06
1. Summary
VesselTwin offers three categories. Necessary cookies and storage keep you signed in, secure the Service, and remember your choices; they are always on. Analytics cookies recognize your browser for visitor and session measurement only if you enable them. If they are off, analytics run in a cookieless mode that stores nothing on your device. Marketing is a separate choice that loads Reddit Pixel for page and conversion measurement and permits a one-time, server-side Meta registration event. VesselTwin does not load Meta Pixel or use advertising pixels for device fingerprinting.
Under EU/UK ePrivacy rules, strictly-necessary cookies do not require prior consent; analytics cookies do, which is why we ask first and default to cookieless.
2. What we set today
| Cookie / storage | Purpose | Category | Lifetime | Set by |
|---|---|---|---|---|
Clerk authentication cookies — observed names include __session, __client_uat, __clerk_db_jwt, clerk_active_context, and per-instance suffixed variants. Exact set may change with provider updates. | Sign-in session, session JWT, active-organization context, CSRF / clickjacking protection. | Strictly necessary | Session / up to 30 days | Clerk (auth provider) |
localStorage key __clerk_environment | Caches Clerk environment config (sign-in methods, social providers) to speed up auth UI load. | Strictly necessary | Until you clear browser storage | Clerk (auth provider) |
localStorage key privacy-choices.v4 | Remembers your separate Analytics and Marketing choices, their timestamp, consent-schema version, and whether Global Privacy Control was active. Historical privacy-choices.v3 and cookie-consent.v2 analytics choices are retained as a preference but never interpreted as consent to the current Marketing measurement. | Strictly necessary (record of your choice) | Until you clear browser storage or change your choice below | VesselTwin |
Reddit Pixel cookies — including _rdt_uuid and, where applicable,_rdt_cid, _rdt_em, or _rdt_pn — plus thelocalStorage key vt.reddit.signup.sent.v1. | Measures ad landing-page visits and the SignUp and VesselCreated conversions. Set only after you enable Marketing. VesselTwin does not send email, phone, account IDs, boat IDs, or boat-record fields to Reddit Pixel. | Marketing (optional — consent required) | Up to 90 days, or until you withdraw your choice | Reddit (advertising measurement partner) |
PostHog analytics cookie and storage — ph_* cookie plus matching localStorage keys. | Recognizes your browser across visits so traffic measurement (unique visitors, sessions, page flows) is accurate. Set only after you enable Analytics — never before, and never if Analytics is off. | Analytics (optional — consent required) | Up to 1 year, or until you withdraw your choice | PostHog (analytics provider), first-party |
localStorage keys under recipient-terms.accepted.* | Remembers your acceptance of recipient terms on a vendor or document share link. | Strictly necessary (record of legal acceptance) | Until you clear browser storage | VesselTwin |
| Next.js framework cookies (e.g. locale, build id where applicable) | Application routing and asset versioning. | Strictly necessary | Session | Next.js (framework) |
3. Marketing measurement
If you enable Marketing, VesselTwin loads Reddit Pixel only on a fixed set of public, signup, dashboard, and new-boat pages whose URLs contain no account or boat record identifiers. Reddit may receive the requested page URL, referrer, IP address, user agent, Pixel cookie or browser identifier, and one of three event names: PageVisit, SignUp, or the custom VesselCreated event. We disable Reddit advanced matching and do not send email, phone, external account IDs, boat IDs, or boat-record properties through the Pixel. We do not currently use these events to build retargeting or lookalike audiences.
If you enable Marketing while signing up, VesselTwin's API may also send Meta Platforms, Inc. one CompleteRegistration event containing the event time, signup URL, a SHA-256-hashed email, and a separately hashed account identifier. Hashing is a data minimization measure, not anonymization. We do not send vessel records, HINs, registrations, documents, maintenance information, payment details, precise location, or free text.
The Meta integration remains server-side: no Meta Pixel, _fbp, _fbc, or other Meta browser identifier is set. Marketing is forced off when Global Privacy Control is detected. Details are in Privacy Policy §§4.5, 8, 9.3, and 13.4.
4. What we do not set
- No analytics cookies without your consent — and none from any provider other than the PostHog integration described above.
- No Google Ads, Facebook/Meta Pixel, LinkedIn Insight, or TikTok Pixel.
- No Reddit advanced matching and no current retargeting or lookalike audiences.
- No third-party social embeds that drop cookies (e.g. embedded YouTube, Twitter, Facebook widgets).
- No device fingerprinting.
For transparency beyond cookies: even without your consent, we measure traffic and product usage (for example, which pages are visited and which features are used) with a cookieless analytics configuration that stores nothing on your device. Signed-in activity is associated with your account's opaque identifier so we can understand how the product is used; event payloads are restricted to identifiers and bounded values — never vessel names, hull IDs, locations, document contents, or free text. Details: subprocessors page and Privacy Policy §8.
5. Mobile apps
The VesselTwin native iOS app authenticates with short-lived bearer tokens managed by Clerk and stored using iOS Keychain protections; it does not use browser cookies. The Android Capacitor wrapper runs the VesselTwin website inside an app WebView and uses Clerk's web-session storage and cookies there. VesselTwin does not copy Android tokens into Capacitor Preferences, and Android app backup and device-transfer export are disabled so WebView session data is not restored onto another device. Because Android uses the web session, the first-visit cookie choice applies there just as it does in a browser.
6. Your Privacy Choices
Necessary storage is always on. Analytics and Marketing are independently optional and do not affect access to VesselTwin. You can change either choice below at any time. Turning off Analytics immediately drops the persisted analytics identity and returns PostHog to cookieless mode. Turning off Marketing disables future Reddit Pixel calls, clears Reddit first-party cookies that VesselTwin can access, and prevents future server-side advertising-measurement events; it does not undo processing completed while consent was active.
You can also clear cookies and site data in your browser settings — note that doing so signs you out and re-arms the first-visit prompt.
7. Future changes
The first-visit prompt provides Reject optional, Customize, and Accept all controls, and no optional cookie fires before a choice. We will not add Meta Pixel, retargeting audiences, lookalike audiences, advanced matching, or additional advertising partners under this consent version. A material expansion requires updated disclosures and any fresh consent or opt-out required before it begins.
8. Contact
Questions about cookies or privacy? privacy@vesseltwin.io.