Legal
Last updated: [Date]
Cookies are small pieces of data stored in your browser by a website you visit. They can be used to remember who you are between page loads, or to track behavior across sites. This policy explains exactly what Vellumail uses cookies for.
Vellumail does not use advertising or analytics cookies, and does not allow any third party to set tracking cookies through our site or account portal. The only cookies we set are the ones our webmail and account portal need in order to keep you signed in and to protect your account from cross-site request forgery:
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
psession |
Account portal (account.vellumail, marketing site) | Keeps you logged into the account/billing portal between page loads, and underpins CSRF-token protection on portal forms. | Session (deleted when your browser is closed, or on sign out) |
msession |
Webmail | Keeps you logged into webmail between page loads, tracks which mailbox you're actively viewing (including a switched-to shared mailbox), and underpins CSRF-token protection on webmail forms. | Session (deleted when your browser is closed, or on sign out) |
Both cookies are marked HttpOnly (not readable by
JavaScript), Secure (only sent over HTTPS), and
SameSite=Lax, and contain only a random session identifier -
never your password, mail content, or Keys.
Webmail also uses your browser's local storage (not a cookie, and never sent to our servers) to remember the last unread-mail count you've seen, so new-mail notifications only fire for mail you haven't already been shown. See our notifications help page.
Because our cookies are strictly necessary to keep you signed in, blocking or deleting them will simply sign you out and may prevent forms in the account portal or webmail from submitting. Every browser lets you view, delete, or block cookies through its settings; consult your browser's help documentation for how.
If we ever introduce a cookie or script beyond what's listed above - for example, optional analytics - we will update this page first and, if required by law, ask for your consent before it's set.
Questions about this policy can be sent to privacy@vellumail.example [replace with your real privacy contact address].