Cookies

• Every cookie we set is strictly necessary to run the service. Under the ePrivacy rules those do not require consent, so there is no cookie banner.
• We do not use analytics, advertising, profiling or cross-site tracking cookies, and we do not embed anything that sets one.
• Nothing we store in your browser is sold, shared with advertisers, or used to build a profile of you.
• If you block our cookies you cannot sign in, because the sign-in session is one of them.

This is the complete list. Every one is set by us, on our own domain, and marked HttpOnly — meaning no script on the page can read it — with SameSite=Lax and, in production, the Secure flag.

• Session (__Secure-vanishlogs.session) — proves you are signed in, after you authenticate with Discord. Expires after 12 hours. On installations that use per-organisation subdomains it is scoped to the parent domain, so one sign-in covers your organisation’s subdomain as well.
• Active organisation (vanishlogs.org) — remembers which organisation you are looking at, for the people who belong to more than one. It is only ever used to choose among the organisations your session already proves you belong to, so it grants nothing on its own. Cleared when you close the browser.
• Role preview (vanishlogs.preview-role) — set only when an owner chooses to view the dashboard as one of their own roles, to check what that role can reach. Expires after 8 hours so a forgotten preview does not quietly become how you see your own account. A preview can only ever narrow what you can see.
• Custom-domain sign-in (__Secure-vanish.domain-session) — carries your sign-in across to an organisation’s own domain, where the main session cookie does not reach. Expires after 30 minutes and is only set if your organisation has configured a custom domain.
• Sign-in security (authjs.csrf-token, authjs.callback-url) — set by our authentication library during the Discord sign-in exchange, to stop a third-party site from forging that request and to return you to the page you started from. Short-lived and discarded once you are signed in.

There is no Google Analytics, no advertising pixel, no session recorder, no heatmap, no social embed and no third-party script that sets a cookie. The marketing pages carry the same policy as the dashboard: a page you read before signing up sets nothing at all.

This is a deliberate constraint rather than an accident of not getting round to it. The product holds other people’s incident data on behalf of server operators, and shipping a tracker alongside that would be difficult to justify to the operators who are accountable for it.

One interface preference — whether you collapsed the sidebar — is kept in your browser’s local storage rather than in a cookie. It never leaves your device, is never sent to us, and holds nothing but a single on/off value. Clearing your site data removes it and the sidebar returns to its default.

Signing in sends you to Discord, and paying sends you to Stripe. Both set their own cookies on their own domains while you are there, under their own policies, and we can neither read nor control them. We do not embed either one in our pages, so neither sets anything while you are on this site.

What we receive back from Discord — the account id, name, avatar, the roles you hold in the relevant server and, only for an owner who opts in, an email address — is described in the privacy notice.

Every browser can block or clear cookies, and you are free to do so. Because all of ours are strictly necessary, blocking them for this site means sign-in will fail rather than degrade: there is no reduced-functionality mode to fall back to. Clearing them signs you out, which is also the fastest way to end a session on a machine you no longer trust.

Signing out through the account menu clears the session cookie server-side as well, which is the more thorough option.

If we ever add a cookie that is not strictly necessary, we will ask for your consent before setting it and update this page first — not the other way round.

Questions: privacy@vanishdev.com. See also the privacy notice and the terms of service.