Cookies
Last updated: September 2, 2026
A cookie is a small text file a website stores in your browser. VaxCheck sets only the cookies it needs to work. There are no advertising cookies, no analytics cookies, no tracking pixels and no third-party trackers of any kind, on any page. We do not use Google Analytics, Meta Pixel or anything like them, and we do not build profiles of visitors.
Because every cookie below is strictly necessary for something you asked for — staying signed in, seeing your country's edition — none of them requires your consent under US state privacy laws, Canada's PIPEDA or Quebec's Law 25, or the EU ePrivacy rules. That is why the notice at the bottom of the page has one button and no “accept all”: there is nothing optional to accept.
Every cookie we set
| Cookie | Set when | What it does | Lasts | Who gets it |
|---|---|---|---|---|
sb-xplazurradahumgmstwl-auth-token (and numbered parts) | When a shop signs in | Keeps a shop's staff signed in to the dashboard. Without it every page would ask you to sign in again. | Session, refreshed while you use the dashboard | Shops |
__Host-vc_owner | When a pet owner opens their records link | Keeps a pet owner signed in to the records portal at /my-pets. HttpOnly and host-locked, so scripts and other sites cannot read it. | 7 days | Pet owners |
__Host-vc_dest | When a pet owner asks for a sign-in link | Remembers, for a few minutes, which page to return to once the emailed link is tapped. | 45 minutes | Pet owners |
vc_location | When a multi-location owner picks a location | Which of your locations the dashboard is showing. HttpOnly. | 1 year | Shops |
vc_country | When you choose United States or Canada | Shows the country edition you picked — which Terms, Privacy Policy, guides and prices you see. Until you choose, the edition follows the country of your connection and nothing is stored. | 1 year | Everyone |
vc_notice | When you dismiss the cookie notice | So the notice does not come back. | 1 year | Everyone |
vc_news_seen | When a shop dismisses the "what's new" card on the dashboard | Remembers which announcement you dismissed, so the card returns only when there is something new. HttpOnly. | 1 year | Shops |
vc_ref | When you arrive from a pet card, a door-policy page or a clinic page | Remembers that a pet owner's card or a policy page brought you here, so we can tell whether those features bring shops in. Holds one word (for example “petcard”); nothing about you. HttpOnly. | 30 days | Visitors who arrive from those pages |
“HttpOnly” means the cookie is sent to our server but cannot be read by any script on the page. “__Host-” is a browser rule that locks a cookie to this exact site over HTTPS only.
Cookies set by someone else
Three pages hand you to another company for one step. Each sets its own cookies, under its own policy, and we receive none of them:
- Cloudflare Turnstile, on the sign-in forms. The small bot-check widget runs inside a frame from Cloudflare and may store a token there to remember that you passed. It replaces the picture puzzles other sites use. Cloudflare's policy.
- Stripe, when you pay. Checkout and billing happen on Stripe's pages, which set Stripe's fraud-prevention cookies. Stripe's policy.
- Google Wallet and Apple Wallet, only if you add a pet card to your phone's wallet; the hand-off happens on their pages.
Nothing else on the site loads from a third party at all. QR codes are drawn by VaxCheck on our own servers, not fetched from an image service, so opening a page with a QR code on it tells nobody but us.
Browser storage
We do not use local storage, session storage or any other browser storage to identify you. Files you pick for upload are read in your browser only long enough to send them.
How to clear or block cookies
Every browser lets you delete cookies for one site or block them. If you block ours, the site still works for reading, but you will not be able to stay signed in, and your country edition will reset on each visit. The country picker in the header lets you change that choice at any time; the choice is stored in the cookie named above and nowhere else.
Changes
If we ever add a cookie, it is added to this table before it ships; a self-test in our code fails otherwise. Adding any analytics or advertising cookie would also require a consent choice, which we would build and describe here first.
See also our Privacy Policy and Terms of Service.
Vital Brands Inc. · 363 N Sam Houston Pkwy E, Suite 125, Houston, TX 77060 · hello@vaxcheck.app