Cookie Policy

Cookies are small pieces of information stored by a website or service in a user's web browser. They can be used to maintain authentication sessions, remember preferences, secure requests, measure service performance and provide other functionality.

Velocity may also use technologies that are similar to cookies, including localStorage, sessionStorage, pixels, error tracking SDKs, SDK-managed browser storage and other client-side storage mechanisms.

For clarity, localStorage and sessionStorage are not technically cookies. They are described in this Policy because they serve similar purposes in the Velocity web application.

We use cookies and similar technologies for the following purposes:

• Authenticate users and maintain signed-in sessions.
• Protect accounts and application resources.
• Maintain secure communication between the browser and our services.
• Capture runtime errors, uncaught exceptions, and crash diagnostics (via Sentry).
• Remember application and workspace preferences.
• Maintain user-interface state.
• Support development-environment functionality.
• Detect abuse, suspicious activity and security threats.
• Understand technical errors and service performance.
• Maintain necessary application state.
• Support third-party integrations that you explicitly enable.

Velocity generally classifies cookies and similar technologies into the following categories.

Velocity uses Clerk for authentication and session management.

In production environments, Clerk documents the following principal authentication cookies:

Clerk also uses additional short-lived cookies for internal authentication mechanisms in certain circumstances. The exact cookies may vary depending on the Clerk environment and configuration.

Clerk's documentation states that these authentication cookies are required for Clerk functionality and cannot simply be disabled without affecting authentication.

Clerk's current documentation also states that the production__sessioncookie is a short-lived session JWT, while__clientis an HttpOnly cookie associated with Clerk's Frontend API.

Do not rely on development-only Clerk cookie names in this Policy for your production deployment. Clerk specifically identifies__clerk_db_jwtas a development-instance cookie.

Velocity may use security and abuse-prevention technologies provided by services such as Arcjet, Cloudflare or other infrastructure providers.

Depending on the implementation, these providers may use cookies, request identifiers, browser storage or other technical mechanisms to identify requests, detect abuse, enforce security controls or protect the application.

We will not describe a specific cookie name here unless that cookie is actually deployed by the corresponding production configuration.

This distinction is intentional: the exact security cookies created by third-party infrastructure can change with provider versions and configuration.

Velocity may use browser localStorage or sessionStorage for application state that does not need to be transmitted to our servers.

Local-storage keys may change as the Velocity application evolves. The actual keys present in your browser may therefore differ from the examples above.

We do not recommend storing authentication secrets, payment credentials, private OAuth tokens or other highly sensitive credentials in localStorage. Client-side storage is accessible to JavaScript running in the page and can therefore increase the impact of an XSS vulnerability. Clerk itself recommends avoiding storage of session credentials in JavaScript-accessible storage such as localStorage.

Velocity may store certain workspace preferences and client state locally to improve the development experience.

Examples may include selected workspace, panel configuration, editor preferences, terminal settings, UI state and other non-sensitive client preferences.

Local browser state is separate from persistent workspace data stored on Velocity's server-side infrastructure.

Clearing browser storage does not necessarily delete your server-side workspace, account, files or billing information.

Velocity integrates with third-party services that may use cookies or similar technologies as part of their own functionality.

Third-party services operate according to their own policies and technical configurations. Their processing is not necessarily controlled by Velocity.

Some cookies and browser-storage mechanisms are essential to operating protected areas of Velocity.

If you block or delete authentication cookies, you may be signed out and may lose access to your dashboard, development environments, API features or other protected functionality.

Security mechanisms may also continue to operate regardless of optional cookie preferences because they are necessary to protect the Service.

You can control cookies and browser storage through your browser settings.

Depending on your browser, you may be able to:

• Delete existing cookies.
• Block cookies from particular websites.
• Block third-party cookies.
• Delete localStorage and sessionStorage.
• Configure automatic deletion of browsing data.
• Receive warnings before certain cookies are stored.

Browser controls may not provide the same granularity as a dedicated cookie-preference interface.

Blocking strictly necessary cookies may prevent Velocity from functioning correctly.

Where applicable law requires consent for a particular non-essential cookie or similar technology, Velocity will seek the required consent before placing or accessing that technology.

Strictly necessary technologies required to provide a service explicitly requested by you may be used without optional marketing or analytics consent where permitted by applicable law.

If Velocity introduces advertising or optional personalization tracking technologies, the applicable consent and preference mechanisms will be updated accordingly.

We do not treat a user simply continuing to browse the website as consent where applicable law requires a specific consent mechanism.

Velocity uses analytics and observability technologies to monitor platform reliability, measure performance latency, track feature adoption, and diagnose software errors.

These tools (including Sentry, PostHog, Tinybird, and Vercel Analytics) capture technical telemetry such as browser type, device characteristics, error stack traces, execution latency, page loads, and feature usage events.

• Error Monitoring & Diagnostics (Sentry): Captures runtime exceptions, call stacks, and crash telemetry. Sensitive input fields and secrets are scrubbed at the edge before transmission.
• Next.js Server Proxy Tunneling: Client-side Sentry error reports are routed through our Next.js backend proxy route to avoid ad-blocker interference and preserve diagnostic fidelity.
• Performance Tracing: Distributed tracing measures API route latency, database query bottlenecks, and client render durations.
• Session Replay Distinction: Sentry video Session Replay is disabled. Visual session replays are managed separately via PostHog with strict client-side PII and input masking.

Performance metrics and error telemetry are used exclusively to maintain service stability, identify bugs, and improve system performance.

Some browsers provide a "Do Not Track" or similar privacy preference signal.

Because there is no single universally adopted technical standard for interpreting every such signal, Velocity does not necessarily treat every browser privacy signal as a universal opt-out.

Where applicable law requires us to recognize a particular privacy signal, we will process it as required by that law.

Cookies and local browser-storage entries may remain on your device for different periods depending on their purpose.

Exact expiration periods may change as providers or application configurations change.

We use reasonable technical safeguards appropriate to the authentication and security mechanisms used by Velocity.

Where supported and appropriate, cookies may use security attributes such as Secure, HttpOnly and SameSite.

However, not every authentication cookie can necessarily be HttpOnly. For example, Clerk documents that its application__sessioncookie is intentionally accessible to Clerk's client-side SDK and is short-lived

You should keep your browser, operating system and extensions updated and avoid installing untrusted browser extensions.

Cookies and similar technologies may contain or be associated with information that can constitute personal data under applicable law.

Our processing of personal data is described in greater detail in our Privacy Policy.

The Privacy Policy explains how Velocity collects, uses, discloses, retains and protects personal data beyond the browser storage mechanisms described in this Policy.

Some technologies used by Velocity (such as Clerk, Sentry, Cloudflare, Vercel, and PostHog) are provided by companies operating internationally.

As a result, information associated with cookies, browser requests, diagnostic telemetry, or authentication sessions may be processed outside your country of residence.

The privacy practices of the relevant providers are described in their own policies.

We may update this Cookie Policy when our technology, integrations, legal obligations or cookie practices change.

When we make changes, we will update the "Last Updated" date displayed at the top of this page.

If a change requires additional notice or consent under applicable law, we will provide that notice or obtain the required consent.