Cookies
Last updated: 7 September 2026
velvet-thermostat uses only the cookies it needs to log you in and keep forms safe, plus one optional display preference kept in your browser. There are no analytics, advertising or tracking cookies, and nothing is shared with a third party.
What is set
| Name | Type | Purpose | Lifetime | Category |
|---|---|---|---|---|
velvet_session |
Cookie (HttpOnly, Secure) | Keeps you signed in to the hub and the agent after you log in. | Up to 180 days; ends sooner if unused for 30 days or you sign out. | Strictly necessary |
velvet_csrf |
Cookie (Secure) | Protects login and account forms against cross-site request forgery. | Short-lived; refreshed as you use the forms. | Strictly necessary |
velvet_flow |
Cookie (HttpOnly, Secure) | Carries an in-progress sign-in between steps (for example the two-factor prompt). | 15 minutes. | Strictly necessary |
velvet-theme |
Browser localStorage (not a cookie; never sent to the server) | Remembers a light / dark choice if you use a theme control. | Until you clear it. | Functional preference |
vt.swcleaned |
Browser sessionStorage (not a cookie) | One-time flag so an old, now-removed service worker is only cleared once per tab. | The current tab session. | Strictly necessary |
Why there is no consent banner
Under PECR in the UK and Article 5(3) of the ePrivacy Directive in the EU, storage
that is strictly necessary to provide a service the user asked for does not
require consent. Every cookie above is in that category. velvet-theme is a
preference you set yourself and never leaves your browser. So no banner is shown. If a
non-essential cookie is ever added, a consent step will be added with it.
Controlling cookies
You can block or delete cookies in your browser settings. If you block
velvet_session or velvet_csrf, signing in will not work. The
public front page sets nothing, so blocking cookies there has no effect.