Legal
Cookie policy
Effective 2026-06-23
Cookies are small text files stored in your browser. Alongside cookies we also use a few related technologies, such as your browser’s local storage. This policy explains every cookie and similar technology Vessel Hunter (“we”, the controller) sets, why we set it, the legal basis for doing so, how long it lasts, and how you can manage it. It covers both our public website and the signed in platform.
How we ask for your consent
When you first visit, a banner lets you accept all cookies, reject everything that is not strictly necessary, or choose per category. Strictly necessary cookies are set without consent because the site cannot function without them. Anything in the Analytics or Marketing category is set only after you opt in, and never before. You can change or withdraw your choice at any time, and withdrawing is as easy as granting it (see Managing your preferences). Your choice is remembered on your device, so we do not ask again on every visit.
Cookies we use
| Category | Cookie(s) | Purpose & provider | Duration |
|---|---|---|---|
| Necessary | __Secure-next-auth.session-token __Host-next-auth.csrf-token __Secure-next-auth.callback-url | First party. Keep you signed in, protect the sign in form against cross site request forgery, and return you to the right page after login (NextAuth.js). On non HTTPS local development the same cookies appear without the __Secure- / __Host- prefix. Strictly necessary, so they cannot be switched off. | Up to 30 days with “Remember me”, otherwise 1 day. CSRF and callback cookies last for the browser session. |
| Necessary | vh_support_anon | First party. Lets you keep access to your own support chat conversation if you message us without being signed in. HttpOnly; holds a random identifier only, no personal data. Strictly necessary for the support chat you started. | 30 days |
| Analytics | _ga _ga_<id> _gid | Third party. Google Analytics 4 measures page visits and traffic sources so we can understand how the platform is used. Set only after you consent, and removed again if you withdraw. Provider: Google LLC (United States); data transferred under the European Commission’s Standard Contractual Clauses. Loaded only if Analytics is both consented and configured. | _ga / _ga_<id>: up to 2 years. _gid: 24 hours. |
| Marketing | None | We set no marketing or advertising cookies. This category is reserved for future use and stays off unless you opt in to it here first. | Not applicable |
Legal basis
- Necessary cookies are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive because they are strictly necessary to deliver the service you asked for. The underlying processing relies on our performance of the contract and our legitimate interest in keeping the service secure (GDPR Article 6(1)(b) and (f)).
- Analytics cookies are set only with your consent (GDPR Article 6(1)(a) and ePrivacy Article 5(3)). You may withdraw consent at any time; this does not affect the lawfulness of processing carried out beforehand.
Local storage and similar technologies
A few features keep small values in your browser’s local or session storage rather than in a cookie. These never leave your device, carry no tracking identifiers, and are not shared with anyone:
vh.consent.v1records your cookie choices so we can honour them and not re prompt you. Removing it brings the banner back.vh_support_cidkeeps your place in the support chat so the conversation survives a page reload.- A small number of functional values remember things like a dismissed notice, a tutorial you snoozed, or your recent searches inside the signed in app. These are convenience only.
Services that do not use cookies
Some third party resources load without setting any cookie. We still list them here for full transparency, since loading them sends your IP address to the provider:
- Plausible Analytics gives us privacy friendly, aggregate visitor counts. It stores no cookies, sets no identifier, and collects no personal data, so it runs without a consent gate. Provider: Plausible Insights OÜ, hosted in the European Union.
- Map tiles on the in app maps are served from CARTO’s content delivery network (CARTO, United States). They load only when you open a map inside the platform, set no cookies, and receive only the request needed to draw the map.
- Fonts (Manrope, JetBrains Mono) are fetched on our server at build time via
next/font/googleand self hosted. No font request is made from your browser; no cookies or fingerprinting are involved.
Managing your preferences
You can review or change your choices at any time by clicking at the bottom of any page. When you withdraw analytics consent we update Google’s consent signal and actively delete the associated _ga cookies from your browser. You can also use your browser’s built in controls (Settings, then Privacy) to block or delete cookies and clear local storage; clearing our consent value will bring the banner back on your next visit. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Changes to this policy
We may update this policy when we add cookies, retire existing ones, or change a provider. Material changes are reflected in the effective date above, and where the change concerns cookies that need consent we will ask again before setting them.
Contact and complaints
Questions about this policy: contact@vesselhunter.io. For your data subject rights and how we handle personal data more broadly, see our privacy policy. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your local supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
Questions? Get in touch.