Veridat uses cookies and browser storage to keep the site and the app working and, only if you say yes, to see how the site is used and to measure our ads.
Your choice
When you first visit, a banner asks what you're happy with. "Accept all" and "Reject all" carry equal weight, and "Manage" lets you choose Analytics and Advertising separately; both are off until you switch them on. Until you choose, no analytics or advertising tag loads and no optional cookie is set. We remember your choice for 6 months, then ask again.
You can change it at any time with "Cookie settings" in the footer, or here. Switching a category off removes its cookies on our site and stops its tags.
Necessary
These keep the site working (signing in, security, remembering your cookie choice) and cannot be switched off. They are not used for analytics or advertising.
Analytics and Advertising
Analytics shows us which pages are visited and which buttons are used. Advertising tells us whether one of our ads led to a visit, a sign-up or a report request. Neither is ever sent your email address, your name, your company name, the copy you check, the web addresses you check or the claims found in them, and tags never run inside the signed-in app.
Every cookie and storage key
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
vd_consent | Veridat | Remembers your cookie choice. | 6 months | Necessary |
veridat-session | Veridat | Keeps you signed in with your email and password. | 12 hours | Necessary |
veridat-auth-source | Veridat | Records how you signed in, so signing out clears the right session. | 12 hours | Necessary |
next-auth.session-token, next-auth.csrf-token, next-auth.callback-url (with a __Secure- or __Host- prefix on our site) | Veridat (Auth.js) | Signing in with Google or GitHub: the session, protection against forged requests, and where to return afterwards. | Session to 12 hours | Necessary |
vd_report | Veridat | Keeps a Claim Risk Checker report with you while you sign up, so its claims reach your new workspace. | 90 days | Necessary |
veridat-tz | Veridat | Your time zone, so dates show in your local time. | 1 year | Necessary |
veridat-home-seen-<workspace> | Veridat | In the app: when you last opened a workspace's home page, to show what changed since. | 1 year | Necessary |
Cloudflare Turnstile | Cloudflare | Tells people from automated abuse on the contact form and the report request. Cloudflare may set its own cookies on challenges.cloudflare.com. | Session | Necessary |
veridat_anonymous_id (local storage) | Veridat | A random ID for the Claim Risk Checker's usage limits (10 checks an hour). Not linked to you. | Until you clear it | Necessary |
veridat:project-draft:<workspace> (local storage) | Veridat | In the app: a project you started but have not saved yet. | Until saved or cleared | Necessary |
Panel state keys (local storage) | Veridat | In the app: whether you opened, collapsed or dismissed a help panel. | Until you clear it | Necessary |
veridat:trial-toast:<date> (session storage) | Veridat | In the app: shows the trial notice once. | Until you close the tab | Necessary |
vd_attr | Veridat | Where your first visit came from (the campaign in the link, whether it came from an ad, the page you landed on and the site that sent you), so we can count which campaigns lead to sign-ups. Never shared. | 90 days | Analytics |
vd_signup_event | Veridat | Set when you create an account, so the sign-up is counted once, then deleted. | Up to 15 minutes | Analytics |
_ga | Google Analytics | Tells visits from the same browser apart. | 2 years | Analytics |
_ga_<ID> | Google Analytics | Keeps track of the current visit. | 2 years | Analytics |
_gcl_au, _gcl_aw | Google Ads | Links a sign-up or report request to the Google ad that was clicked. | 90 days | Advertising |
Product events
Separately from cookies, Veridat records small events on its own servers (for example, that an account was created or a check was run) to understand how the product is used. They never hold pasted copy, evidence contents or file names.