Cookie Policy
Vilkax sets the smallest possible number of cookies. We run no advertising, no cross-site tracking, and no cookies that profile you. Two first-party cookies exist: your sign-in session, which is strictly necessary, and an attribution cookie that appears only if you arrived through a partner link, credits that partner, and can be deleted without losing anything. We also keep optional, first-party, anonymous product analytics (no cookies, no third parties), but it is off until you opt in: on your first visit we ask once with a small banner, it honours your browser's Do-Not-Track / Global Privacy Control, and you can change your choice below at any time.
This page explains exactly what is stored on your device when you use vilkax.com, what each item is for, whether it is strictly necessary, and how long it lasts. It complements the Privacy Policy.
The short version
- We use two first-party cookies: your sign-in session (strictly necessary) and, only after a partner link, a 30-day attribution cookie (not necessary; see below).
- Cloudflare - our security and edge provider - may set its own strictly-necessary security cookies to keep the site online and block abuse.
- Our fonts are self-hosted - no third-party font request, so no external server ever sees your IP for typography.
- We set no advertising, profiling, or cross-site tracking cookies. We do keep first-party, anonymous product analytics (no third parties, no ad networks, no profile of you) - it is off until you opt in on your first visit, and you can change your choice any time.
First-party cookie we set
-
vilkax_sid- your sign-in session. This is what keeps you logged in after you authenticate, and it is the cookie that protects your account.- Purpose: authentication / session management. Carries a signed session identifier (a SID plus an HMAC); it holds no personal data in itself.
- Category: strictly necessary. Without it you could not stay signed in, so it is exempt from consent under the ePrivacy rules.
- Set by: Vilkax (first party).
- Security flags:
HttpOnly(not readable by JavaScript),Secure(HTTPS only),SameSite=Lax(not sent on cross-site requests),Path=/. - Retention: up to 24 hours, then it expires; it renews on use while you stay active. Signing out clears it immediately.
Attribution cookie (partner links)
If you reach vilkax.com through a link from a partner who refers people to us, we set one more cookie so that the partner is credited if you later sign up. If you arrive any other way, this cookie is never set.
vlx_ref- a signed partner reference. It holds a partner code and a signature, no personal data, and it is used for nothing other than crediting that partner.- Category: not strictly necessary. Under the ePrivacy rules, and the guidance of the Spanish data protection authority we follow, a cookie like this needs your consent. It should be set only when you have accepted the first-visit banner; until the site enforces that, you can refuse it by deleting it in your browser, which has no effect on your account or on the service.
- Set by: Vilkax (first party), only on arrival through a partner link.
- Security flags:
SameSite=Lax(not sent on cross-site requests), signed so it cannot be forged. - Retention: 30 days, then it expires. Deleting it earlier is harmless.
Other first-party cookies we set
The complete list of the remaining cookies vilkax.com itself writes. Each is named as it appears in your browser, with what it is for, how long it lasts, and its category.
| Cookie | Purpose | Lasts | Category |
|---|---|---|---|
vlx_did | A random install id (never derived from you or your hardware) so that sign-ins from this browser can be recognised as the same device, and so that an account sign-up from a link in your mail client can be tied to the device that made it. Hashed on our server before it is stored. SameSite=Lax, not HttpOnly (the page has to read it). | 2 years, refreshed on each visit | Strictly necessary (account security & fraud prevention, GDPR art. 6(1)(f); see the Privacy Policy, "Device identity") |
vlx_lang | The language you chose for the site, so we do not ask again. | 1 year | Strictly necessary (a preference you asked us to remember, ePrivacy art. 5(3) exemption) |
vilkax_apple_state, vilkax_apple_nonce | Random one-time values that protect a "Sign in with Apple" handshake against forgery and replay. Only set while you sign in with Apple. HttpOnly; Secure; SameSite=None (Apple posts the reply cross-site). | 10 minutes | Strictly necessary (security) |
vilkax_apple_dc | Only when a desktop app started the Apple sign-in: the opaque code that lets that app finish signing in. Never a session. | 10 minutes | Strictly necessary (security) |
vlx_sso_state | A hashed one-time value protecting an organisation single-sign-on handshake. Scoped to /api/auth/sso/. HttpOnly; Secure; SameSite=Lax. | 10 minutes | Strictly necessary (security) |
Security & infrastructure cookies (Cloudflare)
Vilkax is served and protected by Cloudflare. To keep the site available and to tell humans apart from automated abuse, Cloudflare may set its own strictly-necessary cookies when you encounter a security check.
-
Cloudflare Turnstile / challenge cookies -
set only when you hit a security challenge (for example on
sign-in or sign-up). Turnstile is the privacy-preserving
challenge we use instead of a traditional tracking CAPTCHA.
- Purpose: bot mitigation and abuse prevention - confirming a request is from a real person, and keeping the platform online under attack.
- Category: strictly necessary (security). Exempt from consent.
- Set by: Cloudflare, our infrastructure and security provider (acting as a processor).
- Retention: short-lived; managed by Cloudflare and typically cleared within the same session or a short window after the challenge. We do not read or repurpose these cookies.
Cloudflare does not use these to profile you for advertising. For the technical detail, Cloudflare publishes its own cookie reference at developers.cloudflare.com.
Third-party requests (not cookies we set)
-
Fonts - self-hosted, no third-party request.
Our typefaces (Manrope and the rest of the brand set) are served
from our own domain, not from Google Fonts or any
other third-party font service. Loading a page here makes
no font request to any external server, so no
third party sees your IP address to deliver typography. (Earlier
versions of this site loaded fonts from
fonts.googleapis.com; we removed that dependency.) - Spotify player - optional, consent-gated. The home and Sounds pages can show an embedded Spotify playlist player. Spotify is a third party, so its player - and any request or cookie it makes - does not load when the page opens. It loads only after you accept analytics on the first-visit banner or click the player to load it. Until then, no request reaches Spotify. Once loaded, Spotify's own privacy policy governs what it collects.
What we do NOT use
- No advertising cookies, and nothing from an ad network.
- No cross-site tracking pixels or third-party ad networks.
- No behavioural analytics that build a profile of you - our product analytics are anonymous and are never used to profile or target an individual.
- No profiling cookies. The only cookie we always set is strictly necessary; the attribution cookie is set only after a partner link and you can delete it at any time. Our optional first-party analytics use device storage (not cookies) and are off until you opt in via the first-visit banner; we honour your browser's Do-Not-Track / Global Privacy Control automatically, and you can change your choice below.
Product analytics & your choice
To understand which features help and where the product breaks,
we collect first-party, anonymous usage signals
(for example: a page was viewed, a scan was run). These are
not advertising, are never shared with a third
party, and are never used to build a profile of you - a random
session token (kept in your browser's sessionStorage)
is sent to our own server, which only ever stores a hashed value.
Analytics is off until you opt in: on your first
visit we ask once with a small banner, and nothing non-essential is
sent until you accept. We also automatically respect your browser's
Do-Not-Track and Global Privacy Control
settings as a decline.
We apply this the way your local law expects. Where the law requires your prior consent, such as in the EU and the UK, this analytics stays off until you opt in. Where the law instead gives you a right to opt out, such as in the United States, it may run by default and you can opt out at any time, including a Do Not Sell or Share My Personal Information choice. Global Privacy Control and Do-Not-Track are always honoured, and we never sell your personal data.
You can change your choice on this device at any time - it takes effect immediately:
Your cookie preferences
Everything that is not strictly necessary is off until you say yes, and saying no is exactly one click, the same as saying yes. Your choice is stored on this device together with the version of this policy you agreed to (vlx_consent_v), so if the policy changes materially we will ask again rather than assume. You can change any of these at any time; changes take effect immediately.
| Category | What it enables | Your choice |
|---|---|---|
| Strictly necessary | Sign-in session, security handshakes, your language, the device install id, and this consent record. Cannot be switched off because the site does not work without them. | Always on |
| Analytics | First-party, anonymous product analytics (see below). | |
| Partner referral | Remembering which partner referred you so they can be credited if you sign up (vlx_ref cookie and the vlk_ref / vlk_joined storage keys). | |
| Device fingerprint hash | Lets the web app compute a one-way hash of a few non-identifying signals (browser brand list, platform, time zone, language, screen size class, never canvas, audio or hardware ids) so that a sign-in from a new device can be told apart from a known one. Only the hash leaves your browser. |
Storage on this device that is not a cookie
Besides cookies, vilkax.com keeps a few small items in your browser's local storage so the site remembers your choices. None of them is sent to a third party, none identifies you, and you can clear them at any time by clearing the site data for vilkax.com in your browser. The complete list:
| Key | Where | What it is for | Lasts |
|---|---|---|---|
vilkax_signals_consent | localStorage | Your analytics choice from the first-visit banner (yes / no) | Until you change it |
vlx-signals | localStorage | Mirror of the same choice read by the partner-link script | Until you change it |
vilkax_sig_sid | sessionStorage | Random analytics session token; only sent, hashed, if you opted in | Closes with the tab |
vlx.locale, vlx.langPrompt.shown | localStorage | Your language, and that we already offered to switch it | Until cleared |
vlx-theme, vlx-mode | localStorage | Light / dark theme and display mode | Until cleared |
vlx-sid, vlx_token | localStorage | Web-app sign-in state for the in-browser app (the cookie above does the same for the site) | Until you sign out |
vlx-threats-count, vlx-search-count, vlx-blocked-count | localStorage | Counters shown on the dashboard so it does not flash empty on load | Until cleared |
vlx-cmd-recents, vlx-biz-tab, vlx-default-dismissed, vilkax_tour_done | localStorage | Interface memory: recent commands, last tab, dismissed hints, tour completed | Until cleared |
vlk_ref, vlk_joined, vlx_biz_joined | localStorage | Partner reference and sign-up markers for the referral programme (the storage twin of the cookie above) | Until cleared |
vlx:geo:v1 | localStorage | Which consent regime applies to you (EU opt-in, US opt-out), from your country, so the banner behaves correctly | Until cleared |
explorer-api-keys | localStorage | API keys you entered yourself in the Vilkex explorer, kept only in your browser | Until you remove them |
vlx_did | localStorage | Copy of the install id cookie above, so a cleared cookie recovers the same id instead of minting a new one | Until cleared |
vlx_consent_v | localStorage | Your consent choices per category, with the policy version and the time you chose | Until you change it |
vlx_device_profile_id | localStorage | The id of this browser's device profile in your account (Settings → Devices), sent on sign-in so a known device is recognised | Until you revoke the device or sign out |
vlx-device / keys | IndexedDB | This browser's request-signing key pair. The private key is marked non-extractable and never leaves the browser; only the public key is sent to us | Until cleared |
Clearing these resets your language, theme and consent choices, and signs you out of the web app. Nothing else is lost; your account data lives on our servers, not in your browser.
Managing cookies
You can clear or block cookies from your browser settings at any
time. Blocking the strictly-necessary vilkax_sid
cookie will sign you out and prevent you from staying signed in;
everything else on the public site will still work.
Contact
Questions about cookies or your data: write to privacy@vilkax.com, or use our contact form and select the privacy topic. Our data protection contact answers within one month.
This summary is provided for transparency and is not a substitute for the full Privacy Policy or our terms; it is subject to review and may be updated as the platform evolves.
This document is written in English and published in translation. Where a translation differs from the English text, the English text prevails, without prejudice to the mandatory rules of your country of residence.
Last updated: 2026-09-06 · Version v2 (added the partner-attribution cookie and the inventory of device storage that is not a cookie; corrected the data protection contact; v1 of 2026-06-10 verified the inventory against the deployed session and security configuration).