Privacy & terms
Cookie Policy
VaxFinder uses as little browser storage as it can. Here's every cookie and storage item we use, what it's for, and how long it lasts.
- Effective date:
- October 4, 2026
- Last updated:
- October 4, 2026
Overview
Cookies are small text files a website stores in your browser. “Session storage” is similar but lives only in the open browser tab and is cleared when you close it. We use both only where needed, plus optional measurement tools that stay off unless they're configured and you agree.
Right now, optional measurement is not enabled.
Strictly necessary
These are needed for the site to work, so they don't need your consent. None of them are used for advertising.
| Name | Type | Purpose | How long |
|---|---|---|---|
vs_consent | Cookie (first-party) | Remembers whether you allowed or declined optional measurement. Set only when you make a choice. | 180 days |
vs_staff | Cookie (first-party, HttpOnly) | Keeps VaxFinder staff signed in to the operator tools. Never set for the public. | Up to 8 hours; ends after 30 minutes of inactivity |
vs:request-draft | Session storage | Keeps your in-progress request if you go back or reload. It never contains your phone, email, or names. | Until you submit or close the tab |
vs:confirmation | Session storage | Shows your reference number and access code once on the confirmation page. | Until you close the tab |
vs:search | Session storage | Passes your ZIP code, city, or rounded location from one page to the pharmacy search, so it isn't put in the web address. | Until you close the tab |
vs:idempotency | Session storage | A random one-time key that stops a double click from sending your request twice. | Until the request is sent, or you close the tab |
vs:visit | Session storage | Groups anonymous page views and request milestones into one team activity alert. No form answers or contact details are sent. | Until you close the tab |
Analytics — Google Analytics 4
Status: not currently enabled.
If we enable it, Google Analytics would help us understand which pages are useful. It would load only after you choose “Allow measurement,” and never on the request pages, the data-request page, or staff pages. We'd send page addresses without query strings, with Google signals and ad personalization turned off, and never anything you type into a form. Google Analytics sets its own first-party cookies (such as _ga); Google's documentation describes how long they last.
Separately, we count a few anonymous events on our own server — such as “a search returned results” — as daily totals with no cookie and no user identifier.
Our team also receives short visit alerts through Telegram, grouped by a random tab identifier kept in session storage. The alerts show page paths, campaign labels, device type and request milestones, without contact details or form answers. The server holds the grouping in memory for up to three hours.
Advertising measurement — Google Ads
Status: not currently enabled.
If we advertise and enable it, Google Ads conversion measurement would tell us only that a request was sent after someone clicked one of our ads — a single event with no value, no request details, and nothing you typed. It would load only after you allow measurement, and the request pages never load it themselves. We don't use remarketing, build audiences from visitors, upload customer lists, or allow ad personalization.
Map tiles — OpenFreeMap
The pharmacy search shows a list by default. If you open the map view, your browser requests map images (“tiles”) directly from OpenFreeMap (opens in a new tab). Like any website request, this reveals your IP address and the area of the map you're viewing to the tile host. If you'd rather not, use the list view — it has the same information.
Changing your choice
Use the “Cookie settings” link in the footer of any page to change your choice at any time. Because optional measurement isn't enabled, the link currently brings you to this page — there's nothing to turn off.
Browser controls
You can block or delete cookies and site data in your browser settings. Blocking strictly necessary storage may mean your in-progress request isn't saved if you reload the page. Closing the tab clears session storage. Your browser's help pages explain how.
Global Privacy Control
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale or sharing of your personal information. We don't sell or share personal information in any case. If we enable optional measurement, we'll also treat GPC as a “no” to it.
More about how we handle information is in our Privacy Policy.