Cookie Notice

1. Introduction

Cookies are small text files placed on your device when you visit a website or use an online service. They allow the service to recognise your device, keep you signed in, remember your preferences, and operate securely. We also use a small number of similar technologies (such as local storage) for the same purposes; in this Notice, “cookies” refers to all of them.

This Notice describes the categories of cookies we use, what each one does, and the choices available to you. It should be read together with the Privacy Notice. We use only a limited set of cookies, and we group them into the categories described below.

Local storage

In addition to cookies, our applications use browser local storage to remember your preferences and functional state between visits. Local storage stays on your device and is not sent to our servers with every request. It is cleared when you clear your browser data. We store: your interface theme (vexaro-theme), when you change it; your recent connection history for quick reconnect (vexaro_recent_connections, stored locally only and never sent to our servers); and small functional counters used to time in-product surveys and to enforce guest-mode session limits on your device. Your cookie choice is a cookie, vexaro_consent (Section 2), not local storage.

2. Strictly Necessary Cookies

These cookies are required to operate the Service and to keep it secure. They cannot be disabled, because without them core functions, such as signing in and submitting forms safely, would not work.

Cookie	Purpose	Type / duration
vexaro_access_token	A short-lived (about 15-minute) HttpOnly access token the browser sends to authenticate API requests; not readable by client-side scripts. Refreshed automatically.	Persistent / about 15 minutes
vexaro_refresh_token	A longer-lived HttpOnly token used to obtain a new access token without re-signing-in; not readable by client-side scripts.	Persistent / 7 days
vexaro_session	A non-HttpOnly marker (value "1") that lets the signed-in application know a session is active; it contains no credential.	Persistent / 7 days
vexaro_consent	Stores your choice in the cookie banner: only necessary cookies, or necessary cookies together with “Statistics and invitations” (Section 5). It is set only when you choose, and one choice applies to all our websites on the same domain (vexaro.cloud and its subdomains, or vexarodesk.com), so the banner is not shown again.	Persistent / 180 days
vexaro_mfa_pending	Holds a sign-in that is waiting for your two-factor code. Set only during such a sign-in.	Persistent / 5 minutes
__Host-vexaro_google_state	A one-time value that protects “Continue with Google” against forged requests; it is checked when Google sends you back to us. Set only when you choose to sign in with Google.	Persistent / 10 minutes
vexaro_csrf	A cross-site-request-forgery (CSRF) token that protects state-changing requests. It is intentionally readable by the browser so it can be echoed back in a request header, and is protected from cross-site use by the SameSite=Lax attribute.	Persistent / 12 hours

Because these cookies are strictly necessary, they are set without requiring opt-in consent. Disabling them in your browser will prevent you from signing in to and using the Service.

3. Preferences Cookies

These cookies remember choices you make so that the Service behaves the way you expect on your next visit.

Cookie	Purpose	Type / duration
NEXT_LOCALE	Stores the interface language you picked, so your language preference persists across visits. It is set only when you pick a language with the language switcher, never on a first visit; until then the language follows your browser settings.	Persistent / 1 year

Preference cookies do not identify you and are used only to apply your chosen settings.

4. Security Cookies

In addition to the CSRF token described in Section 2, we use cookies and similar technologies for security and anti-abuse purposes: for example, to support authentication integrity, to help detect and prevent unauthorised access, fraud, and automated abuse, and to enforce the Terms of Service and the Acceptable Use Policy. These are part of the protection of the Service and are not used for advertising or cross-site tracking.

Our sign-in, sign-up and email confirmation pages use Cloudflare Turnstile, a bot-protection widget provided by Cloudflare, Inc., to tell human visitors apart from automated scripts, and the Service is delivered through Cloudflare’s global edge network. As part of providing these protections, Cloudflare may set functional cookies on your device, including:

Cookie	Set by	Purpose	Type / duration
_cfuvid	Cloudflare (challenges.cloudflare.com)	Distinguishes and rate-limits requests to the Turnstile challenge service.	Session
__cf_bm	Cloudflare	Cloudflare Bot Management: tells legitimate users apart from automated traffic on Cloudflare-protected endpoints.	About 30 minutes
cf_clearance	Cloudflare	Records that a visitor has passed a Cloudflare security challenge, where one is presented.	Up to 1 year

These cookies are set by Cloudflare, not by Vexaro, are necessary for the security and integrity of the Service, and are not used for advertising or cross-site tracking. Cloudflare’s handling of this data is governed by the Cloudflare Privacy Policy.

We also set functional cookies to support our referral and invitation programmes. Partner referrals use one cookie:

Cookie	Purpose	Type / duration
vexaro_ref	Records a referral partner code when you arrive through a partner referral link, so the partner can be credited if you sign up. Set only when you follow such a link.	Persistent / 30 days

Personal invitations use a second one:

Cookie	Purpose	Type / duration
vexaro_invite	Remembers the invitation code from a personal invitation link on vexarodesk.com, so the person who invited you can be credited when you sign up later. It holds only that code and is set only when you follow such a link and have allowed “Statistics and invitations” in the cookie banner.	Persistent / 30 days

Without that cookie, an invitation still counts when you sign up from the invitation link itself, because the sign-up form sends the code of the link with your registration.

Section 3.7 of the Privacy Notice describes what the invitation programme stores.

5. Optional Cookies and the Cookie Banner

On your first visit to any of our websites or to the console, a banner asks for your choice. Until you choose, nothing optional is stored on your device. You can choose Only necessary, Accept all, or open Settings and decide per category. Your choice is kept in the vexaro_consent cookie (Section 2) for 180 days and applies to all our websites on the same domain.

There is one optional category, Statistics and invitations:

• the vexaro_invite cookie described in Section 4, which remembers an invitation link for 30 days;
• visit statistics, if we enable them, as described below.

We do not currently run analytics or usage-measurement cookies on our public websites or the Service, and none are set unless you give opt-in consent.

If we enable optional analytics in future, it will operate on the following basis, and we will name the specific provider and its cookies in this Notice before activating them:

• Opt-in. No analytics cookie is set unless you choose to enable analytics; if you do nothing, none are used.
• Named and disclosed. Before an analytics provider is activated, we will name it and the cookies it sets. It could be, for example, a first-party measurement tool or a third-party service such as Google Analytics or Yandex Metrica. Where the provider is a third party, that provider’s own privacy terms apply and will be linked here.
• Usage-only. Analytics is used to understand aggregate usage, such as page views and feature interactions. It is not used to track you across other websites for advertising.
• Withdrawable. You can withdraw consent and disable analytics at any time (see Section 7); the associated cookies are deleted when you do.

6. No Advertising or Marketing Trackers

Our public websites and applications are designed to avoid advertising trackers by default. Our websites load their pages, fonts, and images from Vexaro’s own servers; apart from the Cloudflare Turnstile widget on sign-in pages (Section 4), they load no third-party content. We do not use cookies to sell browsing data, and we do not share browsing data with data brokers. If we introduce optional marketing or third-party analytics technologies, we will describe them in this Notice and provide the consent or choice mechanism required for that technology before using it where required.

7. Managing Cookies and Consent

You can manage cookies in two ways:

• Cookie settings: every page of our websites has a “Cookie settings” link at the bottom, and the console has it in the account menu and on the sign-in page. It opens the banner again, so you can allow the optional category or withdraw your consent at any time.
• Browser controls: most browsers let you view, block, or delete cookies through their settings. Please note that blocking or deleting strictly necessary cookies (Section 2) will prevent you from signing in to and using the Service, and blocking preference cookies (Section 3) means your settings will not be remembered.

Because we do not use advertising or marketing trackers, there is no advertising opt-out to configure.

8. Contact

For questions about this Cookie Notice or about how we use cookies, contact our Privacy Contact at [email protected]. For broader information about how we handle Personal Data, see the Privacy Notice. Contracting and notice details are provided on invoices and Order Forms.

This document is part of the Vexaro Legal Center.