1.The cookies we set
Property Vault sets only cookies that are strictly necessary for something you asked for: opening a record shared with you, or a registered professional signing in to the Homes pilot at propertyvault.world/homes. Reading this site or sending a form sets none.
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
__Host-pvl_<link id> | Set when you open a shared Vault link. It lets this browser keep opening the record the link was shared for: a shared link works only in the browser that first opened it, so a forwarded link cannot be used elsewhere. It holds the link's secret, never your name. | Strictly necessary | Until the link expires, and never more than 30 days; opening the original link again sets it again |
__Host-pv_session | The sign-in cookie. Set when a professional signs in; keeps you signed in between pages. It holds a random identifier, and our server keeps only a hash of it; never your name, email or password. | Strictly necessary | Ends after 12 hours without use and at most 7 days after sign-in, or when you sign out |
__Host-pv_kd | Set after a professional completes a full sign-in. It remembers this browser as a known device for the account, so that someone trying many passwords cannot lock you out. It never skips your password or second factor. You can remove a device under Security in the admin. | Strictly necessary (security) | 90 days |
All three are HttpOnly, SameSite=Lax and Secure and use the __Host- prefix: page scripts cannot read them, other sites cannot send them, they travel over HTTPS only, and the browser refuses them unless they come from our own host. An altered or expired value is rejected; signing out deletes the sign-in cookie. Until 12 November 2026 an older link cookie named pvl_<link id> is still accepted and replaced by the new name. Owner accounts are built and switched off; their sign-in cookie will be added here before they are switched on.
There are no analytics, advertising or social-media cookies and no local storage. The Homes pilot counts record and document opens on the server, without a cookie: the kind of device and the day, and in the access log a keyed hash of the connection's IP address (never the address itself). No country is recorded. Forms on this site send your answers to our enquiries inbox (see Website forms in our Privacy Policy). Our typefaces are served from our own server; no third party is contacted when you read this site.
2.Cookie settings: how to control them
Under the Privacy and Electronic Communications Regulations, a cookie strictly necessary for a service you asked for needs no consent, so there is no cookie banner. If we ever add a non-essential cookie, such as analytics, we will ask first, before it is set, and list it here.
You can block or delete cookies in your browser's privacy settings. Blocking __Host-pvl_ cookies stops a shared record link from opening in this browser. Blocking __Host-pv_session stops a professional staying signed in. Blocking __Host-pv_kd means this browser is treated as a new device at each sign-in. Nothing else is affected.
3.Changes
Each version is numbered and dated at the top of this page, and changes the same day the cookies do. Counsel is reviewing this policy alongside our Privacy Policy and Terms of Service.
4.Contact
Questions about cookies go to hello@propertyvault.world. How we secure the session is set out on Security.