Cookies

This is the part that matters most, because it is the part that would follow people around. Serving a ViberDen ad sets nothing in the visitor's browser. A visitor who sees or clicks an ad on a member's website is measured without a cookie of any kind. The privacy policy describes exactly how, using a fingerprint whose key rotates every day. Everything on the rest of this page concerns viberden.com itself and the people who visit it.

All four are first-party, and all four are SameSite=Lax, scoped to the whole site, and sent over HTTPS only. The first three are HttpOnly, which means no script on the page can read them, including any script we ship ourselves.

• vd_session: the identifier of your signed-in session, and nothing else. Everything about your session, including the token that protects forms against cross-site submission, is stored on our own servers and keyed by it. It lasts 30 days and is cleared when you sign out. Set only once you sign in.
• vd_ref: set when you arrive through another member's referral link, so the referral can still be credited if you register a few days later. It holds the referral code and nothing else, and it lasts 30 days.
• vd_oauth_state: set for the few seconds you spend at Google or GitHub when you choose to sign in with one of them. It carries the one-time value that proves the reply came back from the request you started, it expires after 10 minutes, and it is cleared the moment you return. If you never use those buttons, it is never set.
• vd_theme: remembers whether you chose the light or the dark theme. It holds the word light or dark, carries no identifier, and lasts a year. This is the one cookie that is not HttpOnly: the page itself writes it when you change the theme, and reads it before the first paint so the site never flashes the wrong one at you.

If a cookie named vd_lang is present, the site answers in the language it names. Nothing in ViberDen writes it today, because the language preference that will is not built yet. Unless you set it yourself you do not have one. It is listed here because the code that reads it exists, and a disclosure that only covers what is convenient is not a disclosure.

• No advertising cookies. Not on this site, not on members' sites.
• No analytics cookies. Website analytics uses a self-hosted Umami instance on our own EU server. It records basic metadata such as page URL, referrer, and browser language without storing an analytics identifier in your browser.
• No cross-site tracking. Analytics is used for aggregate website patterns, not to follow visitors between sites or build profiles.

The four cookies above are the ones without which the thing you asked for does not work: you cannot stay signed in without a session, a sign-in with Google cannot be checked without its state, a referral cannot be credited without the code, and a theme you picked cannot be remembered without somewhere to remember it. None is used for advertising, analytics, or profiling. Umami does not set a cookie. If that ever changes, we will ask first, and this page will say so before the cookie is set.

Every browser can block or delete cookies for a site, usually under Settings → Privacy. Nothing here objects if you do, but the consequences follow from what each one is for:

• Without vd_session you cannot sign in, because the session has nowhere to live.
• Without vd_oauth_state a sign-in with Google or GitHub will be refused when it returns.
• Without vd_ref a referral that brought you here cannot be credited.
• Without vd_theme the site follows your operating system's light or dark setting on every visit.

Clearing them at any time signs you out and forgets your theme. Nothing else about your account is affected. Cookie blocking does not disable Umami because Umami does not use cookies.

Questions about this page, or about anything in the privacy policy: [email protected], or through the contact form.