1. What cookies and browser storage are
Cookies are small files a website stores in your browser. Local storage and session storage are similar browser features that keep small pieces of data on your device. We call them all “cookies” on this page where the difference does not matter.
2. visitorstory.com
Our public website does not set cookies of its own and does not run advertising or analytics scripts. Our network provider, Cloudflare, may set strictly necessary security cookies (for example __cf_bm or cf_clearance) when it checks traffic for abuse; these last no longer than 30 minutes (__cf_bm) or as set by Cloudflare’s security check (cf_clearance).
3. The VisitorStory app (app.visitorstory.com)
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
sessionid | Keeps you signed in | 2 weeks | Strictly necessary, first party |
csrftoken | Protects forms against cross-site request forgery | 1 year | Strictly necessary, first party |
messages | Shows one-time confirmation messages | Until the browser is closed | Strictly necessary, first party |
4. The VisitorStory script on customers’ websites
These are used only on websites where a customer has installed VisitorStory. The customer is responsible for describing them in its own cookie notice and for asking for consent where the law requires.
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
_vsid | Cookie set by i.visitorstory.com (HttpOnly, Secure) | A random visitor ID so a returning visitor is counted once | 400 days |
_vsc | Cookie on the customer’s website | Remembers the visitor’s choice in the consent banner (accepted, declined, or which options) | 365 days; only set when a visitor makes a choice |
_vs_vid | Local storage on the customer’s website | A copy of the random visitor ID | Until cleared by the visitor |
_vs_tab | Session storage on the customer’s website | A random tab ID, so one visit across several pages stays one visit | Until the tab is closed |
_vs_cfg2_<site key> | Session storage on the customer’s website | A cached copy of the site’s recording settings (consent mode, sample rate, masking), so they are not fetched on every page | Until the tab is closed |
The script does not use device fingerprinting. If the browser sends a Global Privacy Control signal, the script records nothing by default. In “bottom bar” consent mode, only basic analytics (page views, clicks, scrolling) run until the visitor accepts; in “full-screen pop-up” mode nothing is recorded or sent until the visitor chooses.
5. Your choices
You can block or delete cookies and browser storage in your browser settings; the app will not work without its strictly necessary cookies. On a customer’s website, use its consent banner or enable Global Privacy Control in your browser. To ask about data a website recorded about you, contact that website.
6. Changes
We will update this page if the cookies we use change.
Contact
[Company legal name], [Registered address]. Email support@visitorstory.com.