Voidhash Cookie Policy

Version 1.0 · Effective from 14 October 2026

1. About this policy

1.1 This policy explains which cookies and similar technologies Voidhash s.r.o., ID No. (IČO) 23738944, Chudenická 1059/30, 102 00 Prague 10, Czech Republic ("Voidhash", "we") uses on voidhash.com, including the documentation and the Voidhash dashboard ("Dashboard"), which run on the same website.

1.2 In short: we use only cookies and browser storage that are strictly necessary for the website to work or that remember settings you choose yourself. We do not use analytics, advertising or third-party tracking cookies. Because nothing we use requires consent, we do not ask for it.

1.3 Section 9 is intended for our Customers and explains what the Voidhash SDKs and paywalls store on their apps and websites. How we process personal data is described in our Privacy Policy at voidhash.com/legal/privacy.

2. What cookies and similar technologies are

2.1 A cookie is a small text file that a website stores in your browser and that the browser sends back to the website with later requests. Local storage and session storage are similar browser features that let a website keep data in your browser; data in session storage is deleted when you close the tab or browser, data in local storage stays until it is deleted.

2.2 First-party cookies are set by the website you visit; third-party cookies are set by another domain. Session cookies expire when you close the browser; persistent cookies stay for a set period. All cookies and storage listed in section 5 are first-party.

3. Legal basis

3.1 Under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, implementing Article 5(3) of Directive 2002/58/EC, information may be stored in or read from your device only with your consent, unless the storage or access is strictly necessary for transmitting a communication or for providing a service you have explicitly requested.

3.2 All cookies and storage we use fall under this exemption, so they do not require consent. Where they involve personal data (for example a sign-in session linked to your account), we process it to perform our contract with you (Art. 6(1)(b) GDPR) or on the basis of our legitimate interest in providing a secure website that works as you set it up (Art. 6(1)(f) GDPR).

4. Categories we use

4.1 Strictly necessary. These keep you signed in, protect the sign-in process against forgery and complete the sign-up flow. Without them you cannot sign in to the Dashboard.

4.2 Preferences. These remember choices you make, such as light or dark theme, whether the sidebar is expanded or your recently opened items. They serve only to provide the interface the way you set it up.

4.3 Analytics — currently not used. We do not measure visits with analytics cookies or tools.

4.4 Advertising and social media — not used. We do not use advertising pixels, retargeting or social media plugins, and our fonts are hosted by us.

5. Cookies and storage on voidhash.com

Name	Type	Purpose	Lifetime	Category
`wos-session`	Cookie, HttpOnly	Encrypted sign-in session (provided through our authentication provider WorkOS)	For the duration of the sign-in session	Strictly necessary
`workos-access-token`	Cookie	Short-lived hand-over of the access token after sign-in	60 seconds	Strictly necessary
`workos-initial-auth`	Cookie	Initial sign-in state; deleted once read	60 seconds	Strictly necessary
`vh-oauth-state`	Cookie, HttpOnly	Protection against cross-site request forgery and the return address when signing in with GitHub, Google or Microsoft	10 minutes	Strictly necessary
`vh-session`	Cookie	Session for the self-hosted local mode of Voidhash Community only; not set on voidhash.com	30 days	Strictly necessary
`voidhash.email-verification`	Session storage	Keeps a pending email verification during sign-up	Until the browser tab is closed	Strictly necessary
`sidebar_state`	Cookie	Remembers whether the sidebar is expanded	7 days	Preferences
`theme`	Local storage	Light or dark theme	Until deleted	Preferences
`voidhash.command-menu.recent`, `voidhash.project-environment.<id>`, `voidhash.paywalls.view`, `voidhash.designer.*`, `voidhash.asteroids.best`	Local storage	Interface preferences: recent items, selected environment, list view, designer settings, high score in the built-in game	Until deleted	Preferences

6.1 Since we use only the cookies and storage listed above, there is nothing that requires your consent, and we do not show a consent banner.

6.2 If we ever decide to use cookies or similar technologies that are not strictly necessary (for example to measure website traffic), we will first update this policy and the table above, and we will use them only after you have actively agreed. You will be able to accept or reject them with equally simple choices, your consent will be valid for 12 months, and you will be able to withdraw it at any time as easily as you gave it.

7. Third-party pages

7.1 When you sign in or sign up, you may be redirected to pages hosted by our authentication provider WorkOS and, if you choose social sign-in, to GitHub, Google or Microsoft. These pages may set their own cookies, which are governed by those providers' policies.

7.2 If you manage payment details for a Voidhash plan on pages provided by our payment providers, those pages may set their own cookies under the providers' policies.

8. Controlling cookies in your browser

8.1 You can view and delete cookies and site data and block cookies in your browser settings. Help pages: Chrome (support.google.com/chrome), Firefox (support.mozilla.org), Safari (support.apple.com) and Edge (support.microsoft.com).

8.2 If you block or delete strictly necessary cookies, you will not be able to sign in to the Dashboard. If you delete preference storage, your interface settings return to their defaults.

9. For Customers: storage created by the Voidhash SDKs and paywalls

9.1 When you integrate the Voidhash SDKs into your app or website, they store data on your End Users' devices: on the web, in the local storage of your website's domain (identity — an anonymous identifier and any user identifier you set — cached entitlements, feature flags and paywalls, and a queue of events waiting to be sent); in mobile apps, in the app's own storage on the device (for example UserDefaults on iOS). Paywalls shown through the SDKs use this storage. The SDKs do not set third-party cookies and do not read advertising identifiers.

9.2 In this case you are the controller and we process the data on your behalf. You are responsible for informing your End Users and for obtaining any consent required under Section 89(3) of Act No. 127/2005 Coll., Article 5(3) of Directive 2002/58/EC or similar laws in your End Users' countries. Our position is as follows: purchase processing (transaction validation, restoring purchases, entitlements, and the identifiers and on-device storage they need) is part of the service the End User requested and is strictly necessary; revenue analytics is computed on our servers from those transactions and needs no additional on-device storage or event collection; usage analytics (automatic events, custom events, paywall impressions and interactions, person traits) may require consent depending on the jurisdiction and how you use it. Deciding whether consent is needed, obtaining it and passing the result to the SDK, using the controls described at voidhash.com/legal/sdk-data, is your responsibility. Without usage analytics, metrics that rely on impressions, such as paywall conversion rates, include only End Users for whom it is enabled and may be incomplete.

9.3 A full list of what each SDK stores and sends, and guidance for App Store and Google Play privacy disclosures, is at voidhash.com/legal/sdk-data. Our processing of End User data is governed by the Data Processing Addendum at voidhash.com/legal/dpa.

10. Changes and contact

10.1 We will update this policy whenever the cookies or storage we use change. The effective date is shown at the top.

10.2 Questions: legal@voidhash.com. Related documents: Privacy Policy (voidhash.com/legal/privacy), Terms of Service (voidhash.com/legal/terms).