Basket, 0 items
AccountLegal
Everything this site keeps on your device, listed from the code rather than described from memory.
This site can set two cookies. Neither is set until something you do asks for it, and each can be turned off again at any time.
The first is set only if you arrive through an ambassador’s referral link: it records the referral code you followed, so that a later order can be credited to the person who sent you. It holds that code and nothing else — no name, no identity, no figure — and it expires on its own after 90 days. It is the row named vtl.referral-code.v1 in the table below.
The second is set only if you turn on the “Analytics” category in cookie preferences, which is off by default. Turning it on loads Google Analytics 4 through Firebase, which sets a pair of cookies — _ga and a companion beginning _ga_ — to count visits, which pages and products are opened, and the steps of an order that completes. Until you turn the category on, the Google Analytics code is not loaded at all: no request is made to Google’s analytics servers and neither cookie is set. Turning it off again stops the measurement immediately.
Everything else on the list is your browser’s own storage rather than a cookie: what is in your basket, that you have seen the research-use notice, and, once you are signed in, that you are signed in.
There is no advertising pixel on this site. Nothing here is used for advertising, and nothing follows you to another website.
This table is generated from the code, not written by hand, so it cannot quietly go out of date: a new item cannot be added to the site without a row appearing here to describe it.
| Name | Kind | What it holds | If you clear it |
|---|---|---|---|
vt-admin-rail-collapsed | localStorage | The literal string "1" when the signed-in admin has collapsed the left navigation rail on this device; "0" when expanded. | The rail opens expanded again on the next visit. Nothing else is affected. |
vt-labs.ruo-acknowledged.v1 | localStorage | The date and time the research-use and age notice was cleared on this device by entering a date of birth that meets the minimum age — for example "2026-09-03T09:14:22.000Z". | The notice shows again on the next page load, and asks for a date of birth again. |
vt-labs.ruo-date-of-birth.v1 | localStorage | The date of birth entered at the research-use notice, as a plain date — for example "1990-04-23". Only written when the date entered meets the minimum age; a date that does not is never written. | The notice shows again on the next page load, and asks for a date of birth again. |
vt-labs.ruo-consent-claim.v1 | localStorage | A small record naming the notice, the version of it, and a hash of its text — the browser’s claim of which wording of the research-use + age notice it showed when the visitor confirmed. No personal data: it is a hash of static site copy, not of anything the visitor typed. | No functional loss. A form submitted afterwards simply carries no consent claim — the server accepts the message either way and records no verified consent for it. |
vtl.cart.v1 | localStorage | A JSON object mapping SKU to quantity. No price, no product name, no line total. | The basket is empty on the next visit. Nothing else is affected. |
firebaseLocalStorageDb | indexedDB | The signed-in session (tokens, refresh state) when someone IS signed in. Opened empty the moment the page loads, on every route: it exists even for a visitor who has never seen a sign-in form. | Signs the browser out of any Firebase session, the same as using a private window. No effect on a visitor who was never signed in. |
vtl.referral-code.v1 | cookie | The normalised referral code this browser arrived under — e.g. "JANE10" — and nothing else. No ambassador identity, no rate, no money figure, no visitor identity. The code is a label the server resolves; on its own it says only which link was followed. | The visitor is simply not attributed on their next order. Nothing else changes — no page breaks, no price moves, and the customer’s own discount is unaffected because that comes from the code they type, not from this cookie. |
vtl.cookie-consent.v1 | localStorage | Your answer to the cookie question: which optional categories you allowed, the version of the question you were asked, and when you answered. Nothing about you, and no record of anything you did on the site. | You are asked again on the next page load, and nothing optional is written in the meantime — an absent answer is read as "not allowed", never as "allowed". |
_ga | cookie | A randomly generated number identifying this browser to Google Analytics, and the time it was first generated. A second cookie is set alongside it whose name begins “_ga_”, holding the same kind of value for this site’s own analytics property. Neither holds your name, your email address, your delivery address or anything you typed into a form. | Nothing on the site changes and no price moves. Your next visit is counted as a new one rather than a returning one. |
firebase-heartbeat-database | indexedDB | The SDK’s own record of which Firebase products/versions this page has loaded. | No visible effect on the site. |
vt-labs.account-marketing-not-saved.v1 | localStorage | The date and time your marketing-email answer, given when you created your account, failed to save on the server — for example "2026-09-04T09:14:22.000Z". Written only when that happens; never written on an ordinary sign-up. | No effect on your account. If your marketing preference genuinely was not saved, account settings would say only that you have not been asked before, rather than that the save failed — the setting itself is unaffected either way. |
vt-labs.announcement-dismissed.v1 | localStorage | The date and time you closed the announcement strip at the top of the page on this browser — for example "2026-09-09T09:14:22.000Z". Nothing else: no identifier, nothing about you, and no record of what you looked at. Written only if you press its close button; if you never close it, nothing is written at all. | The announcement strip appears again on the next page load, and can be closed again. Nothing else is affected — no price moves, no basket changes, and nothing you have told the site is lost. |
vt-labs-catalogue-collapsed-… | localStorage | The literal string "1" when an admin has collapsed that catalogue FORMAT's section on this device; absent when expanded. One key per format (Injectable, Nasal Spray, …) — the suffix naming which format is never anything a visitor typed. | Every format opens expanded again on the next visit. Nothing else is affected. |
vt-labs-orders-collapsed-… | localStorage | The literal string "1" when an admin has collapsed that orders-board SECTION on this device; absent when expanded. One key per section — the suffix naming which section is never anything a visitor typed. | Every section opens expanded again on the next visit. Nothing else is affected. |
vt-labs-enquiry-draft-… | localStorage | The admin's in-progress, unsent reply text for one enquiry thread. One key per enquiry id — the suffix is that enquiry's own id, never anything the customer typed. The customer's own message is never written to localStorage; it lives only server-side. | That thread's composer opens on the blank sign-off template again, as if never drafted. No effect on the enquiry itself — this key never held the customer's message, only the admin's unsent reply. |
The two cookies above are the things here you are asked about, and you can change either answer at any time — “Cookie preferences” in the footer of every page reopens the question. Turning a category off stops the cookie it controls being set, and deletes it if it is already there.
Everything else on the list is your browser’s own storage and is there to make the site work, so there is no switch for it that would do anything. Clearing your browser’s site data for this domain removes every item above; the consequences of clearing each one are in the last column.
Lawful basis, how long anything is kept, who it is shared with and the rights you have over it are in the privacy notice. This page describes only what sits on your device.