Cookie Policy

To keep you signed in, our API sets a single essential cookie (vq_refresh) after you log in. It holds your session refresh token and is set as httpOnly (not readable by JavaScript), scoped to the authentication endpoints, and marked Secure in production so it is only sent over HTTPS. It is used solely to renew your short-lived access token so you stay signed in, and it is cleared when you sign out. No cookie is used for tracking or advertising. A short-lived access token is held only in your browser's memory for the duration of the tab session and is not persisted to disk.

When you choose “Continue with Google”, Google may set its own cookies as part of its sign-in process, governed by Google's privacy policy. We only request the basic identity and email needed to sign you in.

[CONFIRM: state whether any analytics/measurement cookies are used in production. If none are used, this section should say “We do not use analytics or advertising cookies.”]

You can clear browser storage and cookies at any time through your browser settings. Clearing authentication storage will sign you out.