Legal
Cookie Policy
Last updated
Every cookie and every piece of browser storage VetTOC sets, what each is for and how long it lasts, and how to remove them.
In short
VetTOC sets only the cookies and browser storage it needs to do something you ask for: keep you signed in, finish a sign-in, and remember the display settings you pick, and keep the pages you have opened on this device so you can read them without a connection. That is all.
It uses no analytics, advertising, tracking or social media cookies, and lets no other company set cookies through its pages. If you only read the catalog, your browser holds only the offline-reading cache described in the storage inventory - pages you have opened and their assets, nothing signed-in.
Because every entry is strictly necessary, VetTOC does not show a cookie banner or ask for consent. Why no consent is needed explains.
What cookies and browser storage are
A cookie is a small piece of text a website asks your browser to keep and send back with later requests. Local storage is a similar store in your browser that only the website's own pages can read, and that is never sent anywhere on its own. The law treats both the same way, so this policy covers both. The table below covers cookies, browser storage such as local storage, and the browser's offline page cache.
Everything VetTOC sets
This is the complete list. All of it is first party: set by VetTOC, for VetTOC's own pages, and never shared with anyone.
| Name | Purpose | Provider | Duration | Category |
|---|---|---|---|---|
__Host-vettoc-sessionCookie | Keeps you signed in. It holds this browser's sign-in key and nothing else, and is HttpOnly, so no script on the page can read it. Set when: You sign in. | VetTOC, first party | Until the sign-in ends: at most 30 days, sooner after 14 days unused, and at once when you sign out. | Strictly necessary |
vettoc-sign-in-sent-toCookie | Remembers the address a sign-in, sign-up or password reset link was just sent to, so the check-your-email page can show it and you can spot a typo. It is sent only to sign-in pages. Set when: You ask for one of those links. | VetTOC, first party | 15 minutes, or 30 for a password reset link. Deleted when you sign in. | Strictly necessary |
vettoc-sign-in-nextCookie | Remembers which page you asked to sign in from, such as the household or compare page, so the link brings you back there. It holds a name from a fixed list, never an address. Set when: You ask for a sign-in link from a page other than the sign-in page. | VetTOC, first party | 15 minutes. Deleted when you sign in. | Strictly necessary |
vettoc-google-flowCookie | Holds a random check value for a Google sign-in you started, which must match what Google sends back. It stops anyone else from finishing a sign-in in your browser. Set when: You choose Continue with Google. | VetTOC, first party | 10 minutes. Deleted when you come back from Google. | Strictly necessary |
vettoc-type-scaleLocal storage | The text size you picked under Display, so every page opens at that size. It never leaves your browser. Set when: You press Smaller or Larger. | VetTOC, first party | Until you clear this site's data in your browser. | Strictly necessary |
vettoc-contrastLocal storage | That you turned high contrast on under Display. It never leaves your browser. Set when: You turn high contrast on. | VetTOC, first party | Until you turn high contrast off, or clear this site's data in your browser. | Strictly necessary |
vettoc-personal-stateSession storage | Holds, for this tab only, the signed-in state the pages read after they paint, so moving between pages does not redraw the account menu and the saved toggles from nothing: your email address, your session's anti-forgery token, the ids of your bookmarks and saved places, whether your plan includes them, and where benefits sit on your household's roadmap, with the household's name. It never leaves your browser. Set when: A page reads your signed-in state while you are signed in. Nothing is kept while nobody is signed in. | VetTOC, first party | Until the tab closes, or a page finds you signed out; signing out or deleting your account clears it as soon as you land. | Strictly necessary |
vettoc-web-v2Cache storage | Keeps the catalog pages you have opened, and the site's own files they need, so they still read without a connection. Pages rendered while you are signed in are never kept, so the cache holds no signed-in content; a best-effort cleanup runs only when sign-out lands through a full page request, which the app's server-action sign-out does not produce. Set when: The first time you open the site. | VetTOC, first party | Until the browser evicts it or a newer visit replaces it; signing out does not reliably delete it. | Strictly necessary |
The sign-in cookies are HttpOnly, so no script can read them, and are sent only over HTTPS. The sign-in cookie's name begins with __Host-, which tells browsers to accept it only from VetTOC's own address, over HTTPS.
Other companies
Google Maps address suggestions. Wherever VetTOC offers to find a place from a street address - on state pages, when comparing counties or a move, and in the legislation page's search for your representatives - the page loads Google Maps from Google's servers to suggest addresses as you type. On the main page and on county, town, territory, country and federal pages, that happens only once you move into the address box. Google receives your IP address, the details any browser sends with a request, and what you type into that box. We checked in a browser: Google Maps sets no cookies and no storage, on VetTOC or on Google's own domains. Google handles that data under the Google Privacy Policy.
Sign in with Google. If you choose Continue with Google, your browser goes to Google's own site, which uses its own cookies under Google's policies. VetTOC receives only your verified email address.
Payments. Once paid plans are charged, paying on the website happens on Stripe's own pages, which use their own cookies to take the payment and prevent fraud, under Stripe's policies. Paying in an app happens in the App Store or Google Play.
Fonts and email. VetTOC serves its own fonts, so reading the site does not contact a font service; only the Google Maps address box loads a font of its own from Google. VetTOC's emails carry no tracking pixels, and their links go straight to VetTOC.
Why no consent is needed
The ePrivacy Directive (2002/58/EC, Article 5(3)), as each EU and EEA country applies it, and the UK's Privacy and Electronic Communications Regulations require consent before a site stores or reads anything on your device, unless it is strictly necessary to provide a service you have explicitly asked for.
Everything in the list above is set only when you sign in, ask for a link, start a Google sign-in, or change a display setting, and only to do that thing - with one exception: the offline-reading cache, which is set the first time you open the site and only to keep the pages you have opened readable without a connection. So VetTOC asks for no consent and shows no banner.
Where these entries hold personal data, such as the sign-in key or the address a link was sent to, we process it under the GDPR because it is needed to provide the service you asked for (Article 6(1)(b)), and to keep accounts secure, which is in your and our legitimate interest (Article 6(1)(f)).
If VetTOC ever adds a cookie that is not strictly necessary, such as for analytics, it will ask first, with Accept and Reject offered equally, set nothing until you accept, and let you change your mind at any time from a link at the foot of every page. This policy will be updated before that happens.
How to control or delete them
Because nothing is set on the strength of consent, there is no consent to withdraw. You can still remove everything at any time:
- signing out deletes the sign-in cookie;
- turning high contrast off deletes its setting;
- clearing this site's cookies and data in your browser deletes all of it. See the help for Chrome, Firefox, Safari or Edge.
You can also block cookies for VetTOC. The catalog, its filters and its tools still work, but you will not be able to sign in, and display settings will not be remembered if storage is blocked too.
In the VetTOC apps
The iOS and Android apps do not use cookies. They keep your sign-in key in the device's secure keychain, and the offline pack and other data for features you use in the app's own storage. All of it is needed for what you asked the app to do, and deleting the app deletes it.
Who is responsible
The data controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS]. Write to [CONTACT EMAIL] with any question about cookies or your data.
Your rights under the GDPR
If the GDPR or the UK GDPR applies to you, you have the right to:
- get a copy of the personal data we hold about you (access);
- have it corrected if it is wrong (rectification);
- have it deleted (erasure), which you can also do yourself by deleting your account from the account page;
- have its use limited while a question about it is settled (restriction);
- receive it in a machine-readable form, or have it sent to someone else (portability);
- object to its use where we rely on legitimate interests (objection); and
- withdraw consent at any time where we rely on consent.
VetTOC makes no decision about you by automated means that has legal or similarly significant effects. To use any of these rights, write to [CONTACT EMAIL]. We answer within one month. You can also complain to the data protection authority where you live or work, or, in the UK, to the Information Commissioner's Office.
The Privacy page says what VetTOC stores about you, why and for how long.
Changes to this policy
We update this policy whenever VetTOC changes what it sets, before the change goes live. The date at the top of this page says when it last changed.