Cookie Policy

Last updated 27 September 2026

1.What cookies are

A cookie is a small piece of text a website saves in your browser so it recognises you next time, for example to keep you logged in. Browsers also have local storage and IndexedDB, which do a similar job but stay in your browser and are never sent to us. EU rules say a site doesn’t need your consent for storage that’s strictly needed for something you asked for, and does need it for anything else. vaultdrop only uses the first kind, so there’s nothing to accept or reject.

2.Our cookies

We set these ourselves, and the site doesn’t work properly without them:

Name	What it’s for	How long it lasts
`authjs.session-token`	Keeps you logged in. It holds an encrypted, signed session and is only set once you log in.	30 days, extended while you use the site; deleted when you log out
`authjs.csrf-token`	Stops other sites from submitting the login, sign-up and log-out forms on your behalf.	Until you close the browser
`authjs.callback-url`	Remembers which page to send you back to after you log in.	Until you close the browser

Because the site runs on HTTPS, your browser will show these with a __Secure- or __Host- prefix. None of them can be read by scripts on the page (HttpOnly), and they’re set to SameSite=Lax.

3.Browser storage

Key	Type	What it’s for	How long it lasts
`vd-cookie-notice`	Local storage	Remembers that you closed the cookie notice, so it doesn’t keep coming back.	Until you clear your browser data
`vaultdrop` database	IndexedDB	Remembers the folder you picked for “Add to Spotify” (Chrome and Edge on desktop), so you don’t have to choose it every time. It only exists if you’ve used that button.	Until you clear your browser data

What’s playing and your queue are only kept in memory. Close the tab and they’re gone.

4.Other companies' cookies

We don’t use analytics, advertising or social media cookies, and our fonts are hosted on our own server. Other companies only set cookies in these cases:

When you pay, you go to paypal.com, and PayPal uses its own cookies there to prevent fraud and finish the payment. See PayPal’s cookie statement.
If you log in with Google or Spotify, their login pages use their own cookies.
Our traffic goes through Cloudflare, which may set a __cf_bm cookie (30 minutes) or, after a security check, a cf_clearance cookie on our domain. Both are there to tell people apart from bots, not to track you. See Cloudflare’s cookie list.

Artist photos load from Spotify’s and Deezer’s servers. Like any image on the web, that sends them your IP address and browser details, but it doesn’t put any cookies on vaultdrop.

5.Turning cookies off

You can see, block or delete cookies in your browser settings, usually under Privacy or Site data. Since we only use the necessary ones, blocking them means you won’t stay logged in, but you can still browse and listen. Clearing site data also brings back the cookie notice and forgets your Spotify folder.

If we ever add optional cookies, like analytics, we’ll update this page and ask you first, and saying no will be a real option.

6.Contact

Questions about cookies: [email protected]. How we handle personal data in general is in the Privacy Policy.