Cookie & Local Storage Policy
Last Updated: September 28, 2026
This Cookie Policy explains how VestWealthy, Inc. (“VestWealthy,” “Company,” “we,” “us,” or “our”) uses cookies, local storage technologies, and third-party trackers when you access or use our website, APIs, and associated services (collectively, the “Services”).
1. What Are Cookies and Local Storage?
- Cookies: Small text files placed on your computer or mobile device by a web server when you visit a website. Cookies allow the website to recognize your session, maintain security controls, and prevent unauthorized actions (such as Cross-Site Request Forgery).
- Local Storage: HTML5 Web Storage (
localStorageandsessionStorage) allows data to be saved locally within your browser. Local storage items are not automatically transmitted to our servers on every web request, but remain stored on your device until cleared.
2. First-Party Essential Cookies Set by VestWealthy
VestWealthy uses strictly necessary authentication and security cookies powered by our authentication infrastructure. These cookies are essential for maintaining user security, preventing unauthorized access, and enabling account functionality. Because these cookies are strictly necessary for the operation of the Services, they cannot be disabled without breaking site functionality.
| Cookie identifier | Type & scope | Purpose & function |
|---|---|---|
__Secure-authjs.session-token(on | Strictly necessary (HttpOnly, Secure) | Keeps you signed in. Without it, every page except the front door and the legal pages sends you to sign in again. An encrypted token, not your account identifier in readable form. HttpOnly, so page scripts cannot read it. |
__Host-authjs.csrf-token(on | Strictly necessary (HttpOnly, Secure) | Protects sign-in and sign-up against cross-site request forgery. A request carrying the wrong token is rejected. HttpOnly and session-scoped. |
__Secure-authjs.callback-url(on | Strictly necessary (HttpOnly, Secure) | Remembers where you were heading before you were asked to sign in, so you land back there afterwards. Session-scoped, and sanitised — an off-site value cannot be used to redirect you somewhere else. |
__Secure-authjs.pkce.code_verifier(on | Strictly necessary (HttpOnly, Secure) | Holds the secret half of a proof key while a sign-in is in progress, so the callback can prove it is the same session that started it. Short-lived (about 15 minutes). Only set when a sign-in is handed off to an external identity provider. |
__Secure-authjs.state(on | Strictly necessary (HttpOnly, Secure) | Carries the anti-forgery value across a sign-in handed off to an external identity provider, so a third party cannot start one on your behalf and hijack the callback. Short-lived (about 15 minutes). Only set when a sign-in is handed off to an external identity provider. |
__Secure-authjs.nonce(on | Strictly necessary (HttpOnly, Secure) | Replays the value an external identity provider returned with the sign-in, so a captured identity token cannot be presented a second time. Only set when a sign-in is handed off to an external identity provider. |
Note: the __Secure- and __Host- prefixes are enforced in production environments operating over HTTPS to ensure enhanced browser security guarantees.
All six are set by the authentication library rather than by VestWealthy code directly, which is why their names carry a vendor prefix. Why two names: the __Secure- and __Host- prefixes are prefixes a browser will only accept from a secure origin, and they carry guarantees with them — that the cookie arrived over HTTPS, and that it was not narrowed to a path by a subdomain. A browser will not honour them on plain http://, so during local development the same cookies appear without the prefix. They are the same cookies with the same contents; only the name changes.
How long they last. A sign-in session is short-lived by default — about thirty minutes from the moment you sign in, not thirty minutes of idle time — and the session token and the cookie that carries it are given the same lifetime, so a token can never outlive its own cookie. The duration is configurable between one minute and thirty days. Signing out clears the session.
3. Local Browser Storage Usage
We use HTML5 browser localStorage to save your interface preferences and locally created user data. This data resides exclusively on your client device and is not collected, stored, or processed on server databases.
| Storage key | Type | Data stored |
|---|---|---|
vw_theme | Local Storage | Whether you chose the light or dark theme. |
vestwealthy:watchlist:screener-stars | Local Storage | Tickers you starred while not signed in, so they survive a page reload. |
vestwealthy:followed-sources | Local Storage | News sources you chose to follow. |
vw_community_posts_v1 | Local Storage | Community posts you have written. These never leave your device — nobody else can see them unless they use it, and clearing your browser data deletes them. |
vw_seen_announcements | Local Storage | Announcements you have already dismissed, so you are not shown them again. |
4. Analytics, Tracking, and Advertising Cookies
4.1 First-party analytics
VestWealthy does not set first-party analytics cookies, session recording scripts, or behavioral tracking pixels.
4.2 Third-party advertising cookies (Google AdSense)
Where advertising is configured on this deployment, our website displays programmatic advertising served by Google AdSense. Third-party advertising vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to users based on their visit to our site and/or other sites on the Internet.
- Users may opt out of personalized advertising by visiting Google Ads Settings or AboutAds.info.
- These third-party cookies are set under Google’s own policies and are not set by VestWealthy in response to anything you do here. Blocking third-party cookies in your browser prevents them, and does not affect the functionality of this site.
5. Managing and Clearing Cookies & Storage
You can manage or disable cookies and local browser storage through your browser settings:
- Clearing session cookies: logged-in users will be signed out upon clearing the
session-tokenor clearing browser cookies. - Clearing local storage: clearing your browser cache or site storage history will erase stored user preferences, saved guest watchlists, and locally drafted community posts.
- Browser settings: most web browsers allow you to block cookies entirely or receive warnings before a cookie is stored. Refer to your browser’s help documentation (Chrome, Firefox, Safari, Edge) for specific instructions.
6. Contact & Related Legal Notices
For additional information regarding how your data is processed, please consult our companion documents:
For legal or privacy inquiries, contact legal@vestwealthy.com.