Using cookies

Recognize returning visitors with a cookie, once your visitors have given their consent.

By default, Vemetric doesn’t use cookies. Anonymous visitors are recognized by a hash of their IP address, their user agent and a daily rotating salt, so they count as new visitors on the next day.

If you’ve collected the necessary consent from your visitors, you can allow cookies. Vemetric then recognizes returning visitors for up to 13 months, which makes retention and attribution more robust.

Enabling cookies

Set the allowCookies option when you initialize Vemetric, for example with the HTML script:

<script
  defer
  src="https://cdn.vemetric.com/main.js"
  id="vmtrc-scr"
  data-token="YOUR_PROJECT_TOKEN"
  data-allow-cookies="true"
></script>

Or with the JavaScript SDK:

vemetric.init({
  token: 'YOUR_PROJECT_TOKEN',
  allowCookies: true,
});

The option is available in all frontend SDKs. Only enable it after your visitors have given their consent where that’s required.

The cookie

The cookie is set by the Vemetric hub, not by the script, and can’t be read by JavaScript on your website.

• Name: __Host-vuid_ (without a proxy) or __Secure-vuid_ (with a proxy), followed by a short identifier of your project
• Content: a random visitor id, nothing else
• Lifetime: 13 months
• Attributes: HttpOnly, Secure, SameSite=None, Partitioned

Every project has its own cookie, so a visitor’s id in one project is never used in another project.

Partitioned per website

Without a proxy, the cookie belongs to hub.vemetric.com, which is a third party on your website. Vemetric sets it as a partitioned cookie: browsers keep a separate copy for each website, so the cookie set on your website is never sent from other websites that use Vemetric. Subdomains of your website, like example.com and app.example.com, share the same copy.

Browsers that don’t allow partitioned cookies, like Safari before version 26.2, don’t store the cookie, so Vemetric can’t connect the page views of their visitors. Using a proxy avoids this, because the cookie is then set by your own domain.

With a proxy

When you use a proxy, the cookie is a first-party cookie on your website’s domain, for example yourdomain.com. This works for proxies on a subdomain like hub.yourdomain.com as well as for proxies on a path like /_v, and visitors are recognized across all subdomains of your website.