Cookie Policy
Effective date: 2026-10-08
The current VI Engine app uses a small number of browser storage mechanisms. Customer and FounderSpace authentication now rely on HttpOnly cookies, while localStorage and sessionStorage are reserved for workspace selection, short-lived presence flags, and other non-secret UI state.
Your choice
Necessary storage is always on. Analytics (PostHog, with masked session replay) stays off until you accept Analytics. Your choice and its date are stored in localStorage under vi-cookie-consent. Use Cookie settings in the footer to change it. Withdrawing consent stops PostHog straight away. If storage is unavailable, the choice lasts only for this page. Scrubbed Sentry error reporting remains active; Sentry replay, browser tracing and logs are disabled.
Current first-party cookie
| Name | Why it exists | Current behavior |
|---|---|---|
| vi_access_token | Short-lived customer access token used to keep protected dashboard routes authenticated. | Set by the backend as an HttpOnly first-party cookie and refreshed by the auth flow when the session rotates. |
| vi_refresh_token | Longer-lived refresh token used by the backend to renew the customer session. | Set by the backend as an HttpOnly first-party cookie scoped to the auth endpoints. |
| vi_founderspace_session | Internal FounderSpace session cookie established after internal credentials are verified. | Set by the backend as an HttpOnly cookie scoped to /api/admin so the frontend does not need to persist raw FounderSpace credentials. |
Other browser storage used by the app
- localStorage stores selected workspace context and cached UI state such as billing or onboarding snapshots.
- sessionStorage stores lightweight presence flags, temporary form state, and other non-secret session hints.
- Only after you accept Analytics, configured PostHog uses first-party browser storage for product analytics. Its session replay masks form inputs and all rendered text, including message/comment bodies. Replay is disabled on authentication, billing, settings, connections and inbox pages and respects Do Not Track and the PostHog opt-out. URLs with query strings or identifier-like path segments are not recorded.
Storage and security boundaries
- No customer access or refresh token is stored in browser-readable storage.
- No raw FounderSpace admin credential is persisted in localStorage or sessionStorage.
- When PostHog is configured, its analytics storage is separate from authentication and is not used for route gating.
Third-party pages
Official social-platform authorization pages, identity providers, or payment/check-out pages may set their own cookies while you are on those domains. Those cookies are controlled by the third party, not by this frontend.
Contact
Questions about browser storage or cookies? Email privacy@viengine.social.