nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Cookies Used in Vanilla

One of our software's fundamental principles is not collecting or storing personal information that isn't central to the platform's functionality, and that extends to our use of cookies. We do not foresee this changing.

NOTE: Any major functional changes to our cookies policy and use will appear in our release notes.

Listed below are the cookies that your site can use.

vf_[your-site]_%

This cookie means a user is logged in. Delete this cookie and your session will end. This format is just a convention. The [your-site] is a string that represents your site, and is assigned when your site is created. The % is a random hash that gets assigned. For the rest of this article, assume that % represents vf_[your-site]_% .
Users cannot opt out of this cookie.

%-tk

This token is anonymous and is used for CSRF protection.
Users cannot opt out of this cookie.

%-Vv

This token is anonymous, and is used to track visits. It stores no data other than that the a user has visited the site. When a user visits your site, their user profile is updated with the lastVisitDate and this cookie is set.
This cookie is set to expire in 20 minutes. Whenever a page loads, we check whether this cookie is still active; if it is, we add 20 minutes to the expiry date. If it is not, we update the lastVisitDate in the user's profile and record it as a new visit.
Users cannot opt out of this cookie.

%-vA

This token is used for Analytics tracking. EU users have their data anonymized by default.
We store several pieces of information in this single cookie:
- Privacy Mode - A numeric flag, used to determine how much we anonymize a user's data when tracking analytics. This value is automatic, based on the detected country of origin.
- Session ID - A randomly-generated ID used to track signed-in-user activity. This value is reset between visits to the site.
- Secondary Session ID - A randomly-generated ID used to track events that could include guest data (e.g., page views).
- UUID - A randomly-generated ID used to uniquely identify the user. This ID can persist between site visits but only lives in the user's analytics cookie.
Analytics data collected through this cookie is stored in aggregated, anonymized form and used only to monitor, maintain, and improve the community platform and its services. The aggregated data cannot reasonably be used to identify an individual user and is not sold or distributed to third parties.

vnOz0 and vnOz1

These cookies are generated when you have the Who's Online addon or widget enabled. The purpose of this cookie is to tell the application that there is an active guest visitor, someone without a session, that has been active for at least 20 mins. No other data is kept about the user. Every time a user refreshes the page or navigates to another page this cookie is renewed and the visit is considered active. The value of the cookie is just a random hash; it does not contain any data.
These cookies follow the same analytics consent signal as the %-vA analytics cookie. If a visitor has not consented to analytics tracking, or if the site has Anonymize Data enabled, Vanilla does not set __vnOz0 or __vnOz1, and any existing copies are expired. Guests who have not opted in are not included in Who's Online guest counts.
Sites can also opt not to use the Who's Online addon or widget, in which case these cookies are not used at all.

__vnf

This cookie is used only for the Troll Management addon. It is not anonymous, and persists after a user logs out. It is only initially assigned when users log in and does not apply to users who remain guests.
This is a randomly-generated ID we use to "fingerprint" users to determine if someone is using multiple accounts. It is not derived from any PII.
Users cannot opt out of this cookie, but sites can disable the Troll Management addon.

vf-%-sid

This is a "session" cookie (sid = session ID). The value maps to a row in Vanilla's Session table. This table is used to temporarily store information for a user. Typically, this cookie is created as part of an SSO sign-in (although it can also make an appearance when users initiate the "forgot my password" workflow). Depending on the SSO method, Vanilla might need to "remember" some initial values to complete sign-in, after the user is redirected back to the site from the authentication provider.
Users cannot opt out of this cookie.

vf_hub_ENDTX

This cookie serves the same purpose as vf_[your-site]_% When a user is logged in to a site that is part of a hub/node setup, this cookie is set so that the various nodes "know" that you are logged into the hub.
Users cannot opt out of this cookie.

vf_node_ENDTX

This replaces the vf_[your-site]_% on any of the nodes of a hub/node setup. All the variations of this cookie are listed above: vf_node_ENDTX-vA, vf_node_ENDTX-tk, vf_node_ENDTX-vV.
Users cannot opt out of this cookie.

vfo_s

vfo_s is a technical cookie used by our platform's caching layer. It holds an opaque session identifier that tells the caching layer whether a page request can be served from cache or has to be generated fresh for that specific session. Without it, signed-in members could be served pages cached for other visitors, and the site would not behave correctly.It is not a preference, analytics, or marketing cookie. It stores no preferences, no personal information, and no cross-site tracking data, only the opaque identifier described above.

Why it is not blocked by your consent settings? A few characteristics support its classification as strictly necessary:

It is set as HttpOnly, meaning it cannot be read by any JavaScript on the page, so it cannot be used for tracking or analytics purposes.
It is set as Secure, so it is only ever transmitted over HTTPS.
It is first-party to your community domain only and is not shared with any third party.
Its value is an opaque identifier, not a user profile, email address, or behavioral record.

Because it is required for correct page delivery, it falls under the strictly necessary category and is set regardless of consent selections (the same as the core session cookie).

__cfduid

Cloudflare uses two cookies, both named __cfduid. These live on:
- .v-cdn.net
- Yourforums.vanillacommunities.com
These are used to identify individual clients behind a shared IP address and apply security settings on a per-client basis.
For example, if a visitor is in a coffee shop where there may be several infected machines, but the specific visitor's machine is trusted (for example, because they completed a challenge within your Challenge Passage period), the cookie allows Cloudflare to identify that client and not challenge them again. It does not correspond to any user ID in your web application, and does not store any PII.
Users cannot opt out of this cookie.

__cfruid -

Another Cloudflare cookie related to rate-limiting.
This cookie ensures that different users on the same network (sharing the same IP) doing requests to rate-limited URLs won't be counted as one user in order to avoid rate-limiting issues.
Users cannot opt out of this cookie.