# Cookie policy

> Every cookie and browser storage item Statsy and its tracking script use, what each is for, how long it lasts, and how cookieless mode works.

Canonical page: https://statsy.co/cookies  
Last updated: 14 September 2026

Every cookie and storage item Statsy uses, what it is for and how long it lasts. Nothing is hidden.

## The short version

- Our marketing pages set no cookies. Signing in sets only what keeps you signed in and remembers your workspace.
- In Full mode the script sets one first-party cookie, `statsy_vid`, for up to a year.
- In cookieless mode nothing that identifies the visitor is stored in the browser.
- The script sets no third-party cookies and does not track visitors across websites.
- Site owners choose the mode and are responsible for their own notices and consent.

## 1. On statsy.co and the Statsy app

Our marketing pages set no cookies at all. When you sign in, we set only what is needed to keep you signed in and remember your choices:

| Name | Purpose | Lasts | Type |
| --- | --- | --- | --- |
| `better-auth.session_token` | Keeps you signed in. HttpOnly and Secure. | 7 days, renewed while you use Statsy | Strictly necessary |
| `statsy_org` | Remembers which workspace you last opened. | 1 year | Functional |
| `statsy.sidebar.collapsed` | Remembers whether you collapsed the sidebar (browser storage, not a cookie). | Until cleared | Functional |
| `theme` | Remembers light or dark mode (browser storage, not a cookie). | Until cleared | Functional |

In production the session cookies carry the `__Secure-` prefix. None of these are used for advertising or shared with anyone.

## 2. On websites that use the Statsy script

What the script stores in a visitor’s browser depends on the tracking mode the site owner picks:

| Name | Mode | Purpose | Lasts |
| --- | --- | --- | --- |
| `statsy_vid` | Full (and Auto outside the EU/UK) | A random first-party identifier so return visits and purchases connect to the same visitor. | 1 year |
| `statsy_sid` | Full (session storage) | Groups page views from one browser tab into a session. | Until the tab closes |
| `statsy_last` | Full (session storage) | Time of the last event, to end a session after 30 minutes of inactivity. | Until the tab closes |
| `statsy_mode` | All modes (session storage) | Caches which tracking mode applies, so the script does not ask on every page. | Until the tab closes |
| `statsy_consent` | When the site asks for consent (local storage) | Remembers the visitor’s consent choice passed to Statsy by the site. | Until cleared |
| `statsy_optout` | When a visitor opts out (local storage) | Stops the script from sending anything from this browser. | Until cleared |

In cookieless mode nothing that identifies the visitor is stored in the browser; sessions are grouped on our servers instead. The script sets no third-party cookies and does not track visitors across different websites. By default it sends nothing when the browser sends Do Not Track or Global Privacy Control, unless the site owner has switched that off.

## 3. For site owners

You decide which mode your site uses and you are responsible for telling your visitors and, where the law requires it, asking for consent. Cookieless mode avoids cookies and persistent identifiers, which in many cases removes the need for a consent banner for analytics, but rules differ by country and by how you configure Statsy. If in doubt, ask your adviser. See the [privacy policy](https://statsy.co/privacy#visitor-data) for what the script collects.

## 4. How to control them

You can clear or block cookies and browser storage in your browser settings. Blocking the session cookie on statsy.co will sign you out. On a site using Statsy, turning on Do Not Track or Global Privacy Control reduces or stops what the script stores. Questions: <support@statsy.co>.

---

Statsy (https://statsy.co) · Contact: support@statsy.co