Cookie Policy
Last updated 1 October 2026
This policy explains cookies and browser storage used by VapeTax. VapeTax is operated by Qode Ltd, company number 17259547, at Liberty House, 30 Whitchurch Lane, Edgware, England, HA8 6LE.
Essential storage supports sign-in and app preferences. Optional first-party analytics runs only if you choose Allow analytics. Choosing Essential only leaves sign-in and the service available. We do not use advertising or third-party tracking tools.
1. Cookies and browser storage
Cookies are small values your browser sends with relevant requests. Local storage keeps values on your device between visits. Session storage keeps values for a browser tab. Our optional analytics reads its own identifiers from storage and sends them with a limited page-view event; it does not send the rest of your browser storage.
2. Essential storage
| Name | Purpose | Storage and duration |
|---|---|---|
vt_refresh | Keeps you signed in and renews your session | httpOnly cookie, valid for up to 30 days; renewed when your session refreshes and cleared on sign-out |
vt_analytics_consent | Remembers your analytics choice | Local storage, until you change it or clear site data |
The app also remembers practical preferences, such as language and scanner settings. The short-lived sign-in access token stays in memory, not in local storage. A previous cookie-banner acceptance does not opt you into analytics.
3. Optional analytics storage
| Name | Purpose | Storage and duration |
|---|---|---|
vt_analytics_visitor | A random identifier to estimate returning browsers | Local storage, expires after 90 days |
vt_analytics_session | A random visit identifier and its initial traffic source | Session storage, starts a new visit after 30 minutes without a qualifying page view or when the tab closes |
These identifiers are created only after opt-in. If browser storage is unavailable, analytics stays off. They are not advertising identifiers and are not used to follow you across other websites.
4. What optional analytics records
Analytics covers a limited set of public pages while you are signed out. Each event contains random event, visitor and visit identifiers, an approved page path and a limited traffic source. The source is a screened campaign source label or the referring website hostname; full query strings and referrer paths are not recorded.
Our hosting provider, Vercel, may supply an estimated country to the server. Our analytics records do not store IP addresses, full browser user-agent strings, account details, form contents or signed-in app activity. Reports show aggregate visitor, visit and page-view counts, countries and sources, rather than individual browser histories.
Analytics event records are retained for 90 days. Hosting and security logs needed to operate the service are separate from optional analytics. See our Privacy Policy.
5. Change or withdraw your choice
Use Cookie preferences in the public-site footer, or the button below, to change your choice. Choose Essential only to stop future analytics events and remove the analytics identifiers from this browser. Your sign-in session is unaffected. Records already received remain subject to the 90-day retention period.
You can also delete site data in your browser settings. Clearing the saved choice makes the banner appear again. Blocking the essential sign-in cookie may prevent sign-in; declining optional analytics does not.
6. Changes and contact
We update the date above when this policy changes. For questions about cookies, storage or personal data, contact privacy@vapetax.co.uk.