Loading
Every cookie we set, and what it does.
EFFECTIVE · 2026-07-27
This Notice explains the cookies and similar local-storage technologies used on vivyveil.com by VivyVeil LLC. It is a more detailed version of the cookie summary in our Privacy Policy. We use the smallest set of cookies the Site needs to work, and we do not run third-party advertising trackers.
Last reviewed: 2026-07-27, against the code that actually sets each cookie. That review corrected three descriptions in §2 that had drifted from the implementation: the shopping-bag cookie holds the bag itself rather than a database key, it lasts fourteen days rather than thirty, and the language cookie is written on your first page view from an IP-derived country guess rather than only after you pick a language. We review this Notice at least annually and whenever we add a new cookie or change the purpose of an existing one; next scheduled review is 2027-07-27.
A cookie is a small text file stored by your browser on your device. Cookies allow a Site to remember things between page loads (your sign-in, your shopping bag, your language) and to perform security checks. "Similar technologies" includes localStorage and sessionStorage entries, which serve the same purpose but are scoped to your browser rather than sent to a server.
We currently set the following. Every cookie listed below is a first-party cookie — set on the vivyveil.com domain (or a subdomain we control via Cloudflare's reverse proxy). We do not set any third-party cookies.
| Name | Type | Stored where | Purpose | Lifetime |
|---|---|---|---|---|
| vivy.session_token (and __Secure-vivy.session_token on HTTPS) | Strictly necessary | First-party cookie on vivyveil.com | Maintains your sign-in across page loads. | Thirty days; refreshed on use; destroyed at sign-out. |
| vivy_cart | Strictly necessary | First-party cookie on vivyveil.com | Holds your shopping bag itself — the lines you have added, stored as base64-encoded JSON inside the cookie rather than in our database. The cookie is HttpOnly, so page scripts cannot read it. Base64 is an encoding, not encryption: treat the bag as readable by anyone with access to your browser profile. | Fourteen days. |
| vivy.locale | Functional | First-party cookie on vivyveil.com | Records which of the four languages (en / zh / ja / ko) the Site is showing you, so the choice sticks between visits. Written automatically on your first page view — every public URL carries a language prefix, and we pick the initial one from the country Cloudflare derives from your IP address, not from your browser's Accept-Language header. Using the language switcher overwrites it, and an existing value always wins over the country guess. | One year — clear anytime via the steps in §4. |
| cf_clearance, __cf_bm | Strictly necessary | First-party cookie on vivyveil.com (Cloudflare-managed via reverse proxy) | Bot-protection and DDoS-mitigation challenge state, including the challenge we run with Cloudflare Turnstile before sensitive actions. Set by Cloudflare on its own schedule, not by us. | Session to thirty minutes (Cloudflare-managed). |
Legal basis. Strictly necessary cookies are exempt from prior consent under Article 5(3) of the ePrivacy Directive 2002/58/EC — they are required for sign-in, holding your bag, and bot protection. We treat vivy.locale as functional rather than strictly necessary: it is set without asking you, because the Site cannot render a page without choosing a language, but it stores only a two-letter language code and you can clear it at any time via §4.
We do not currently run any of the following (verified as of 2026-05-30):
If we add any of these in the future, we will: (i) display a consent banner before that technology runs, (ii) update this Notice to disclose it with name, purpose, and lifetime, and (iii) update the Privacy Policy summary. We will not enable any non-essential tracking technology silently.
Browser controls. Every major browser lets you block, delete, or restrict cookies. Blocking strictly necessary cookies will prevent the Site from working. Browser-vendor settings menus move occasionally; the entry points below are accurate as of 2026-05-30, and if a path no longer matches your browser, search the browser's settings for "cookies" to find the current equivalent.
Clearing only the language preference. To clear just the vivy.locale cookie without affecting your sign-in or bag, open your browser's site-data view for vivyveil.com (Chrome: lock icon in the URL bar → Cookies and site data; equivalent in other browsers) and delete the vivy.locale entry. Your next visit will write a fresh one, because the Site has to pick a language to render in; clearing it resets us to the country guess rather than stopping the cookie. To browse without it sticking, use a private window, or block cookies for vivyveil.com — the Site will fall back to the country guess on every request.
Withdraw consent. If at any future date we ask you to consent to a non-essential cookie, you may withdraw consent through the consent banner or by clearing the relevant cookie in your browser.
Do Not Track. We do not respond to DNT headers.
Global Privacy Control. GPC is a browser-level signal recognised under the CCPA / CPRA as a valid opt-out from "sale" or "sharing" of personal information. We do not sell or share personal information and run no advertising trackers, so there is nothing on the Site for GPC to opt out of today. If that ever changes, we will honour GPC signals from day one.
Most of what feels like "tracking" on the Site is in fact stored in our own database against your account record rather than in browser cookies — your address book, your order history, your wishes, your saved payment-method references. That data is governed by the Privacy Policy, not by this Notice. The cookies listed in §2 are only the keys we need to identify you across requests so the database can return the right rows.
Questions about this Notice or about a specific cookie: support@vivyveil.com. We aim to respond within two business days.