Cookie Policy

1. Visitorly app (this domain)

• Session cookie (visitorly_session): set when you sign in. Required for authentication. Typically HttpOnly and Secure in production. Lasts about 14 days or until you sign out.
• Share-link cookie (name starts with vl_share_): set for about 12 hours after someone unlocks a passworded report link, so they are not asked for the password on every click. Not used for marketing.
• Hosting/CDN providers may set strictly necessary cookies for security and performance.

Password-reset links and authenticator codes are not cookies. Reset tokens are stored as hashes in our database and expire in one hour.

2. Visitorly tracker on customer sites

When a customer installs /t.js, the script may store anonymous visitor and session identifiers in the browser (localStorage and/or cookies) to count unique visitors and sessions. These identifiers are not meant to identify a person by name or email. An optional first-party CNAME still serves the same tracker from a hostname on the customer’s domain.

Customers who install the tracker are responsible for consent banners and disclosures on their websites where required by law.

3. Third-party embeds

Connecting Google or Clarity, or loading Google Tag Manager, may cause those providers to set their own cookies when their scripts or OAuth flows run. Continue with Google or GitHub on login/register also uses those providers’ cookies for the sign-in handshake. Whop or Stripe checkout (when you pay online) may also set cookies on their domains. Review Google, GitHub, Microsoft, Whop, and Stripe privacy/cookie documentation for details.

4. Managing cookies

You can clear cookies and site data in your browser settings. Signing out clears the app session cookie from normal use. Blocking the session cookie prevents login. Blocking the share cookie means unlocking a share link again.

5. More information

See our Privacy Policy for broader data practices.