Cookie Policy (Draft)Cookie Policy (Draft)

草稿 — 尚未經律師審核，不構成正式條款 / 草稿 — 尚未经律师审核，不构成正式条款 / DRAFT — not yet reviewed by counsel; not binding

In short: OpenVPT uses two small preference cookies (language and theme) and one security cookie that our API sets when you sign in (a random device ID), and stores your sign-in session and wallet connection in your browser's local storage. We do not use analytics or advertising cookies, and we do not use tracking pixels. When you load the site, your browser also contacts Google Fonts, and when you use wallet features it may contact a Base network RPC endpoint and, if you choose it, WalletConnect.

1. About this policy#

This Cookie Policy explains how [COMPANY LEGAL NAME] ("OpenVPT", "we", "us"), a company organized under the laws of [STATE OF INCORPORATION] with its business address at [BUSINESS ADDRESS], uses cookies and similar browser storage on:

• the OpenVPT marketplace website (the "Site"); and
• the OpenVPT back office used only by our platform staff (the "Back Office").

It should be read together with our Privacy Policy, which describes the personal information we process on our servers. This policy is effective as of [EFFECTIVE DATE].

This policy describes the software as currently built. Where a behaviour depends on how a deployment is configured, we say so.

2. What cookies and browser storage are#

In this policy, "browser storage" means cookies, local storage and IndexedDB together.

3. No analytics or advertising cookies#

As of the date of this draft:

• The Site and the Back Office do not use analytics, advertising, social media or cross-site tracking cookies.
• We do not embed analytics scripts, advertising tags or tracking pixels.
• Our API server sets exactly one cookie, the security cookie vpt_did (section 4.1). You sign in with tokens that the Site keeps in local storage (see section 5).

If we add analytics or any non-essential technology in the future, we will update this policy first and, where the law requires it, ask for your consent before using it.

4. Cookies we set#

Both cookies below are first-party (set by OpenVPT's own site), are not HttpOnly (the page itself reads them), are sent only over the site's own requests, use SameSite=Lax and Path=/, and contain only the value shown.

If you block or delete these cookies, the Site still works: it falls back to your browser's language setting (or Traditional Chinese by default) and to your operating system's light or dark setting.

4.1 Security cookie set by our API#

vpt_did is HttpOnly (page scripts cannot read it), SameSite=Lax, Secure in production, and is sent only with requests to our API's sign-in routes (/api/v1/auth). Our servers store only a salted hash of the ID, never the ID itself. If you block or delete it, you can still sign in; the next sign-in simply counts as a new device and sets a new ID.

5. Other browser storage we use#

These entries live in your browser only. They are not sent to our servers as cookies. Local storage has no expiry date: an entry stays until the code removes it or you clear your browser data.

5.1 Sign-in session#

If local storage is unavailable (for example in some private-browsing modes), you can still sign in, but the session lasts only until you close or reload the page.

5.2 Wallet connection (Site only)#

The Site uses the open-source wagmi library to connect a crypto wallet. wagmi stores its state in local storage under keys starting with wagmi.:

wagmi.store is written on every page load of the Site, because the wallet library is loaded on all Site pages; until you connect a wallet it holds only the default network setting. The other entries are created only when you connect, switch or disconnect a wallet. None of these entries contain private keys or seed phrases: your keys stay in your wallet. Category: strictly necessary for the wallet feature [CATEGORY TO BE CONFIRMED WITH COUNSEL].

5.3 WalletConnect (only if you choose it)#

WalletConnect lets you connect a mobile or desktop wallet by scanning a QR code. It is offered only when our deployment is configured with a WalletConnect project ID ([WALLETCONNECT ENABLED IN PRODUCTION: YES/NO]). When you choose WalletConnect, the WalletConnect software (provided by a third party and running on our Site) stores data in your browser:

• an IndexedDB database named WALLET_CONNECT_V2_INDEXED_DB, with entries whose keys begin with wc@2: (pairing and session records, including the encryption keys for the session with your wallet); and
• local storage entries whose keys begin with @appkit/ (for example the last wallet used, recently used wallets and the connection status).

This data is stored on our Site's origin, but its contents and lifetime are set by the WalletConnect software, not by us. It is kept until the session ends or you clear your browser data.

6. Third parties your browser contacts#

Some features make your browser contact servers that we do not operate. Those providers do not receive cookies from us, but, like any website you connect to, they receive technical data such as your IP address, browser type (user agent), the time of the request and, depending on your browser's referrer settings, the address of the page you came from (for the Site, by default normally only our domain, not the full page address). Their own privacy policies apply to what they do with it.

The host names above are taken from the libraries the Site currently uses and may change when those libraries are updated.

7. What this policy does not cover#

• Data on our servers. Account data, orders, chat messages, security logs (including IP addresses used for rate limiting and security) and similar records are described in our Privacy Policy, not here.
• Emails. Emails we send do not contain tracking pixels.
• Other websites. External links (for example to network or token documentation) lead to sites with their own policies.

8. How to control cookies and browser storage#

We do not currently show a cookie banner. This draft assumes that the items described above do not require prior consent [CONSENT APPROACH — TO BE CONFIRMED WITH COUNSEL]. You can still control everything yourself:

1. Sign out to remove vpt.tokens (or vpt.admin.tokens in the Back Office).
2. Disconnect your wallet in the Site's wallet menu. wagmi then records that you disconnected; to remove the wagmi. entries entirely, clear site data (step 4).
3. Change language or theme at any time with the switches in the header; the cookie is updated.
4. Clear site data in your browser settings (for example, "Cookies and site data" or "Storage" for our domain). This removes our cookies, local storage and IndexedDB for the Site, including WalletConnect data.
5. Block cookies or storage in your browser. The Site continues to work with default language and theme; without local storage you will need to sign in again after each reload.
6. Block third-party requests with browser settings or extensions. If you block Google Fonts, the Site uses your system fonts. Blocking the RPC endpoint or WalletConnect prevents the related wallet features.

Your browser's help pages explain these settings.

9. Do Not Track and Global Privacy Control#

The Site does not currently read Do Not Track or Global Privacy Control (GPC) signals. Because we do not use analytics, advertising or cross-site tracking technologies, there is currently no tracking for such a signal to switch off. [HOW GPC WILL BE HONORED — TO BE CONFIRMED WITH COUNSEL]

10. Changes to this policy#

We will update this policy when we change the cookies or storage we use, and we will change the "updated" date above. For material changes, we will give notice on the Site [AND BY EMAIL, IF REQUIRED].

11. Contact#

Questions about this policy can be sent to [LEGAL CONTACT EMAIL] or through our contact page (topic: legal).

Notes for counsel / 給律師的待確認事項#

These notes are for review only and will be removed before publication.

1. Consent model. The draft treats NEXT_LOCALE and vpt-theme as functional preference cookies set without prior consent, and the token and wallet entries as strictly necessary. Please confirm this is acceptable for US users (and for EU/UK users under the ePrivacy Directive / PECR if the Site is offered there). Two facts are relevant: NEXT_LOCALE is set automatically on the first localized page view, not only after a user choice; and wagmi.store is written to local storage on every Site page load, even for visitors who never use the wallet feature (it holds no wallet data until a wallet is connected). Section 8 contains a placeholder for the consent approach.
2. Google Fonts. Fonts are loaded from Google's servers on every page view, which discloses visitors' IP addresses to Google. At least one German court has found this problematic under GDPR (Munich Regional Court I, January 2022); please confirm the current position. If EU users are in scope, consider self-hosting the fonts (engineering change) or a consent step.
3. WalletConnect / Reown. The installed library can send usage events to pulse.walletconnect.org and fetch wallet data from api.web3modal.org. Confirm whether WalletConnect is enabled in production, review Reown's terms and privacy policy, and decide whether it is a "service provider" / "processor" or an independent third party, and whether its telemetry is disclosed adequately. Also consider whether third-party scripts that send usage events from the browser raise issues under US state wiretap or pen-register laws (for example the California Invasion of Privacy Act), which have been the basis of recent claims against website operators.
4. Token storage. Session tokens are in local storage rather than HttpOnly cookies. This is a security design choice, not a legal issue as such, but confirm the description in section 5.1 is adequate and consistent with the Privacy Policy and any security statements.
5. CCPA/CPRA. Confirm that no "sale" or "sharing" for cross-context behavioural advertising occurs (none is implemented today), whether a "Do Not Sell or Share" link is needed, and how GPC must be honored (section 9 placeholder). Consider other state privacy laws with similar opt-out-signal requirements.
6. GDPR / UK GDPR. If the Site will be available to EU/UK users, confirm lawful bases, whether a consent banner is required for Google Fonts and WalletConnect telemetry, and international-transfer disclosures.
7. COPPA. The draft assumes the Site is not directed at children; confirm the [MINIMUM AGE] and that this policy needs no child-specific language.
8. Blockchain data. Wallet addresses and transaction identifiers are sent to the RPC endpoint when the Site reads on-chain data, and transactions submitted by users' wallets are public on the Base network and irreversible. Confirm the disclosure wording and its cross-reference to the Privacy Policy.
9. Back Office scope. Confirm whether the staff Back Office should be covered by this public policy or by an internal employee/contractor notice.
10. Device ID cookie. vpt_did (section 4.1) is treated as strictly necessary for security (sign-in notices, abuse limits, extra verification before a wallet link). Please confirm this classification and whether it needs consent in any market we serve.
11. Placeholders to fill: [COMPANY LEGAL NAME], [STATE OF INCORPORATION], [BUSINESS ADDRESS], [EFFECTIVE DATE], [LEGAL CONTACT EMAIL], [WALLETCONNECT ENABLED IN PRODUCTION: YES/NO], [RPC PROVIDER], [HOW GPC WILL BE HONORED — TO BE CONFIRMED WITH COUNSEL], [AND BY EMAIL, IF REQUIRED], [CONSENT APPROACH — TO BE CONFIRMED WITH COUNSEL], [CATEGORY TO BE CONFIRMED WITH COUNSEL], [MINIMUM AGE].