Cookies Policy
Last updated
Cookies are small text files a website stores in your browser. vomatt uses as few as possible: the ones that keep you signed in and remember your settings are always on, and analytics cookies are set only if you say yes.
Strictly necessary
These make the Service work, so they can’t be switched off.
- accessToken: keeps you signed in. Lasts about 15 minutes and is renewed automatically while you use the site.
- refreshToken: renews your sign-in securely. Replaced each time it’s used; expires after 30 days without use.
- preferred-language: remembers English or 繁體中文 (1 year).
- cookie-consent: remembers whether you accepted or declined analytics cookies (1 year).
- session-unconfirmed: set only while we can’t reach our servers to confirm your sign-in, so the page can retry (until you close the browser).
- auth-key-mismatch: set only if a server fault stops us confirming your sign-in, so the site doesn’t retry in a loop. It holds a one-way fingerprint, never your sign-in token (until you close the browser).
The sign-in cookies are httpOnly, so scripts on the page can’t read them, and they’re removed when you sign out or delete your account.
Preferences
- sidebar_state: remembers whether the sidebar is open or collapsed. Set only when you toggle it (7 days).
Analytics (only with your consent)
When analytics is turned on, the cookie banner asks first. Nothing loads until you choose “Accept analytics”; if you decline, no analytics script runs. If you accept, Google Analytics (loaded directly or through Google Tag Manager) sets:
- _ga: tells visits from different browsers apart (2 years).
- _ga_<ID>: keeps track of the current visit (2 years).
We use this to count visits and see which pages are used. We don’t use it for advertising, and we don’t send Google your email address or username.
Other storage on your device
- Poll drafts: polls you save as drafts are kept in your browser’s local storage (vomatt_poll_drafts). They never reach our servers and stay until you delete them or clear your browser data.
- Passkeys: if you add one, its private key is kept by your device or password manager, not by vomatt.
Managing cookies
To change your analytics choice, use the Cookie settings button at the end of this page. You can also block or delete cookies in your browser settings, but if you block the necessary ones you won’t be able to sign in.
To opt out of Google Analytics on every site, use Google’s opt-out browser add-on.
Contact
Questions: hello@vomatt.com. For how we handle personal data generally, see our Privacy Policy.