Information under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and Article 13 GDPR.
Last updated 2026-09-08
How consent works here
Strictly necessary cookies are set without consent, because the service cannot be delivered without them. Section 25 paragraph 2 number 2 TDDDG allows this for storage that is strictly necessary to provide a service the user has expressly requested.
Everything else stays off until you switch it on in the banner. The analytics category starts PostHog, listed in full below. The marketing category still activates nothing at all, because no such tool is integrated; the switch exists so that adding one later cannot happen silently.
Your decision is stored for six months in the cookie velticCookieConsent and in local storage. You can change it at any time through the Cookie settings link in the footer, which reopens the banner.
Strictly necessary cookies
- Name
- veltic-session-token
- Purpose
- Keeps you signed in to the dashboard. HttpOnly, Secure and SameSite Lax, so it is never readable from JavaScript.
- Lifetime
- Until the session expires, by default two hours
- Set by
- Dashboard
- Name
- velticCookieConsent
- Purpose
- Remembers the choice you made in this banner so you are not asked on every page.
- Lifetime
- Six months
- Set by
- Marketing site
- Name
- velticGoogleOAuthState
- Purpose
- Protects the Google sign in against cross site request forgery by pinning the state parameter to your browser.
- Lifetime
- Ten minutes
- Set by
- Dashboard
- Name
- __Host-velticBackendOverride
- Purpose
- Only set for a master user who points the dashboard at a preview backend. Signed with a server side secret, never accepted from the client.
- Lifetime
- Until the override is cleared
- Set by
- Dashboard
| Name | Purpose | Lifetime | Set by |
|---|---|---|---|
| veltic-session-token | Keeps you signed in to the dashboard. HttpOnly, Secure and SameSite Lax, so it is never readable from JavaScript. | Until the session expires, by default two hours | Dashboard |
| velticCookieConsent | Remembers the choice you made in this banner so you are not asked on every page. | Six months | Marketing site |
| velticGoogleOAuthState | Protects the Google sign in against cross site request forgery by pinning the state parameter to your browser. | Ten minutes | Dashboard |
| __Host-velticBackendOverride | Only set for a master user who points the dashboard at a preview backend. Signed with a server side secret, never accepted from the client. | Until the override is cleared | Dashboard |
Browser storage that is not a cookie
The dashboard keeps a few interface preferences in local storage. They never leave your browser, are not sent with any request and are not used to recognise you.
- Key
- velticTheme
- Purpose
- Whether you chose the dark or the light theme
- Key
- selectedProjectId
- Purpose
- The project you last worked in, so a page opens where you left it
- Key
- selectedDatabaseId
- Purpose
- The database the data tools were last pointed at
- Key
- velticRealtimeProject
- Purpose
- The project selected on the realtime page
- Key
- velticCookieConsent
- Purpose
- The full consent record, including the timestamp of your decision
| Key | Purpose |
|---|---|
| velticTheme | Whether you chose the dark or the light theme |
| selectedProjectId | The project you last worked in, so a page opens where you left it |
| selectedDatabaseId | The database the data tools were last pointed at |
| velticRealtimeProject | The project selected on the realtime page |
| velticCookieConsent | The full consent record, including the timestamp of your decision |
Analytics
Product analytics run on PostHog. Nothing is loaded and no cookie is written until you enable the analytics category; switching it off again stops collection and clears the identifier. Data is ingested exclusively through the European endpoint eu.i.posthog.com and stored in the European Union.
Session recording is switched off in code, not merely unconfigured. Your IP address is discarded before an event is stored, and the automatic capture of clicks and page text is disabled, so only the events named in our own catalogue are sent.
The dashboard and the public pages share the domain veltic.app, which means one decision covers both.
- Name
- ph_<projectToken>_posthog
- Purpose
- Holds the pseudonymous device identifier and the pending event queue, so repeat visits can be counted without a login.
- Lifetime
- Twelve months
- Set by
- PostHog, after you enable analytics
| Name | Purpose | Lifetime | Set by |
|---|---|---|---|
| ph_<projectToken>_posthog | Holds the pseudonymous device identifier and the pending event queue, so repeat visits can be counted without a login. | Twelve months | PostHog, after you enable analytics |
Marketing
No advertising or attribution cookie is set and no third party pixel is embedded. The marketing category is present for the same reason as analytics: so that a future change is visible and requires your consent.
Blocking cookies in your browser
Every browser can block or delete cookies. Blocking the strictly necessary session cookie means you cannot stay signed in to the dashboard, because there is no other mechanism that keeps the session. Blocking the consent cookie means the banner appears again on every visit.