This policy explains cookies and browser storage for Version Compare, including email sign-in and customer-site browser integrations. For information we process, read the Version Compare privacy policy. The corporate website hosting this notice has a separate DoNoHarm cookie policy.
After you confirm an email sign-in link, Version Compare sets the first-party cookie vc_session on the sign-in host. It contains a random session token, not your email address, and lets the server recognise your signed-in session. The server stores a hash of that token associated with your account membership.
By default, this is a browser-session cookie. If you select “Keep me signed in” when confirming your email link, it lasts for up to 30 days on that device. All sign-ins expire after 30 days at the latest. Your browser may restore session cookies when reopening a previous session. The cookie has a path of /. It is HttpOnly, so page scripts cannot read it, and uses SameSite=Lax. On HTTPS it also has the Secure attribute. No parent-domain attribute is set. Signing out clears the cookie and revokes the session. This cookie is for account access, not for assigning customer-site experiment alternatives.
Sign-in and invitation links expire after 15 minutes and can be used once. They are links sent by email, not separate cookies. Blocking vc_session prevents the account service from keeping you signed in.
Version Compare's browser integration does not set experiment cookies or use localStorage. It uses one sessionStorage key named vc:<public-site-id> on the customer's first-party origin, scoped to the browser's page session. The suffix is the public Version Compare site identifier.
This stores up to 64 assignment records containing the experiment identifier, selected alternative identifier, server-issued exposure identifier, and expiry time. The runtime uses these records to remember the selected alternative and attribute a goal to an earlier exposure. It does not assign a general-purpose visitor identifier or use fingerprinting.
Each assignment has a fixed 30-minute lifetime from creation. Expired entries are removed when the runtime reads or updates the stored assignments, not by a background deletion timer. Browser session storage normally ends when the tab closes, but browser restoration can preserve session state. Closing a tab is therefore not an absolute deletion guarantee, and these limits do not set the retention period for server-side experiment records.
The hosted browser integration contacts Version Compare for experiment information and reporting. First-party storage does not mean that experiment data stays on the customer's servers. Clearing browser storage does not delete experiment records already received by the hosted service.
A website operator can mark a link with data-vc-handoff to an approved connected origin. The runtime can add a random, single-use token in the URL fragment as __vc. It is valid for 120 seconds and bound to the destination origin and page path. It can transfer up to 32 already observed, unexpired assignments, rather than creating a new visitor identifier.
On arrival, the runtime removes __vc from the address bar before redeeming the token and storing the transferred assignments on the destination origin. This is an explicit navigation handoff, not a third-party cookie or a way to recognise independent visits to unrelated sites or devices. It still links the relevant experiment measurements across the connected sites.
Version Compare's public marketing and documentation pages use DoNoHarm's self-hosted Ackee service at ackee.donoharm.world. Ackee does not set visitor-measurement cookies. Its server still processes connection information and derives a daily identifier from the IP address, user-agent, and tracked domain. See Ackee's documentation. We do not load the marketing tracker on Version Compare's sign-in, authentication, account administration, or backoffice pages. This is separate from the experiment storage described above, not a claim that the whole service is cookie-free.
The customer-side aggregate proxy and server/CDN adapters are planned features. Their storage names, expiry, and attribution rules are not yet final. The proxy is intended to keep visitor assignment and attribution on the customer's side and report grouped counts, rather than individual visitor events, to Version Compare. It is not the behaviour of the hosted browser integration.
Customer-side processing and cookie-free analytics do not by themselves establish a consent exemption or guarantee anonymity. Website operators must consider their own use and applicable requirements, including any consent needed before experiment storage is used.
You can block or remove cookies and clear site storage in your browser. Doing so can sign you out, change a selected experiment alternative, or prevent a success from being attributed to an earlier exposure. It does not delete records already received by the service. Contact the customer website operator about their experiment storage, or contact us about your Version Compare account.
We do not collect information where we can help it.
If you have any questions, feel free to email us at webmaster@donoharm.world.