Cookie Policy
Last updated: September 2026
The Short Version
VPS Snaps sets cookies only where the site cannot function without them: keeping you signed in, remembering that a browser has passed two-factor authentication, and protecting the provider connection flows from cross-site request forgery.
There are three things on these pages that are not necessary, and all of them run unless you turn them off: Google Analytics, which tells us which pages people read, and the Meta and Reddit advertising pixels, which tell us whether our advertising reaches anyone and let us show a follow-up advertisement to someone who has already read a page here. There is a one-click opt-out further down this page. Use it and none of them is loaded at all — no cookie is written and nothing is sent to Google, Meta or Reddit.
Being direct about the advertising ones, because it is the sort of thing policies usually bury: Meta and Reddit each learn that this browser visited this site, and can recognise it again elsewhere on their own platforms. Each is told three things specifically — that a page was viewed, that the pricing page in particular was viewed, and, if you go on to sign up, that an account was created. Not your email, not your name, not what you back up: the fact, and nothing attached to it. That is what makes advertising here affordable, and it is a real cost to your privacy rather than a nominal one. Opting out costs you nothing on this site.
This used to work the other way round — a banner on arrival, and nothing loaded until you clicked Allow. That changed in September 2026. Saying so plainly because the alternative is a policy that quietly stops matching the site, and if you declined under the old banner, that decision still stands: this change does not opt you back in.
None of them runs inside the application itself. Once you are signed in and using VPS Snaps, there is no measurement of any kind — what you back up, when, and how often is not something we send anywhere. The pixels and Google Analytics exist on the marketing pages and nowhere else.
Separately from the pixels, and whether or not you opt out of them, we report a completed purchase back to the advertising platform that sent you here, if one did. That happens on our servers when a payment succeeds, not in your browser, and it carries your email address in hashed form and the amount — nothing about your account or what you back up. If you did not arrive from one of our advertisements, nothing is sent at all.
One cookie exists purely so we can tell which of our own pages and links bring people to sign up. It is set only if you arrive with campaign parameters on the URL or from an external link, it holds nothing but those parameters, it cannot be read by JavaScript, it is never sent to anyone else, and it is deleted the instant you create an account. If you would rather it were not set, blocking cookies for this site costs you nothing except having to sign in each visit.
Cookies We Set
vpssnaps_session
Keeps you signed in. Holds a signed token identifying your session — no personal data is stored in the cookie itself.
Lifetime: Until you sign out or it expires
vpssnaps_device
Remembers that this browser already passed two-factor authentication, so you are not challenged on every visit.
Lifetime: Until you sign out of this device
do_oauth_state
Protects the DigitalOcean connection flow against cross-site request forgery. Written when you start connecting a provider and read once on return.
Lifetime: Minutes — deleted as soon as the connection completes
linode_oauth_state
The same protection for the Linode connection flow.
Lifetime: Minutes — deleted as soon as the connection completes
gce_oauth_state, gce_oauth_project_id
The same protection for the Google Compute Engine flow, plus the project you selected so it survives the round trip to Google.
Lifetime: Minutes — deleted as soon as the connection completes
vs_consent
Written only if you use the opt-out below. Holds a single word — denied, or granted if you later switch measurement back on — and is what stops Google Analytics and the Meta and Reddit pixels loading on this browser. If you have never used that control, this cookie does not exist.
Lifetime: 6 months
_ga, _ga_XXXXXXXX
Google Analytics. These are Google's cookies, not ours, and they are what tells us which pages people read before signing up. They are set on the marketing pages unless you opt out below, in which case the script is not loaded at all and neither is ever written.
Lifetime: Up to 2 years, set by Google
_fbp, _fbc
The Meta pixel. These are Meta's cookies, not ours. _fbp identifies this browser to Meta so we can tell whether our ads reach anyone and show follow-up ads to people who have already read a page here; _fbc is set only if you arrived by clicking one of those ads, and holds that click's identifier. Both are set on the marketing pages unless you opt out below, in which case the pixel is not loaded at all.
Lifetime: _fbp up to 90 days, _fbc up to 90 days, both set by Meta
_rdt_uuid
The Reddit pixel. Reddit's cookie, not ours. It identifies this browser to Reddit so we can tell whether our advertising there reaches anyone, and show a follow-up advertisement to someone who has already read a page here. Reddit is told that a page was viewed, that the pricing page in particular was viewed, and that an account was created if you sign up — nothing else. Set on the marketing pages unless you opt out below, in which case the pixel is not loaded at all.
Lifetime: Up to 90 days, set by Reddit
vs_attr
Remembers which link brought you here — the campaign parameters on the URL you arrived through, or the site that linked to you — so that if you go on to create an account we know which of our own pages earned it. Set only if you arrive with those parameters, never readable by JavaScript, never shared with anyone, and deleted the moment you register.
Lifetime: 30 days, or until you create an account — whichever comes first
Cloudflare
This site is served through Cloudflare, and our sign-up form uses Cloudflare Turnstile to block automated abuse. Cloudflare may set its own cookies to tell genuine visitors from bots and to keep the site available during an attack.
These are security cookies, not tracking cookies — Turnstile is specifically designed to verify a visitor is human without profiling them or following them across sites.
Things That Are Not Cookies
Your light or dark theme preference is kept in your browser's local storage rather than a cookie. It never leaves your device and is never sent to us.
Opting Out
This switches off Google Analytics and the Meta and Reddit advertising pixels for this browser. It takes effect immediately — no reload, no confirmation step — and is remembered for six months in the vs_consent cookie described above. It is reversible, because an opt-out you cannot undo is a trap.
It applies to this browser only, since the preference lives in a cookie. Clearing your cookies clears it too, which is an unavoidable consequence of not asking you to create an account to express a preference.
Blocking the two scripts in your browser or with an extension works just as well and does not depend on us honouring anything. Nothing on these pages breaks either way.
Controlling Cookies
Every browser lets you view, block and delete cookies. Because the cookies above are required for the service to work, blocking them has direct consequences:
- Blocking vpssnaps_session means you cannot stay signed in.
- Blocking vpssnaps_device means two-factor authentication is requested every time.
- Blocking the OAuth state cookies means connecting a provider will fail, because the security check on return cannot complete.
The marketing pages — everything you can read without signing in — work with all cookies blocked.
Changes
If we add a cookie, this page changes in the same release. It is written from the application's actual behaviour rather than kept as a generic template, so the list above is the list.
Contact
Questions about cookies or tracking: [email protected].