Last updated: 25 September 2026
This policy explains the cookies and similar technologies used on https://verbier.dev and its subdomains, including clerk.verbier.dev, which runs our sign-in service. It is provided by Fortis Ventures Ltd ("we", "us" or "Verbier"). Our Privacy Policy at /privacy explains how we handle personal data more generally.
1. What cookies and similar technologies are
1.1 A cookie is a small text file that a website stores in your browser. Your browser sends it back to that website on later requests, so the site can recognise your browser, for example to keep you signed in.
1.2 Similar technologies work in a comparable way. They include local storage and session storage, which let a website keep data in your browser, and techniques that read information from your device. In this policy, "cookies" includes these technologies unless we say otherwise.
1.3 Cookies can be:
(a) first-party, set by the site you are visiting, or third-party, set by another domain;
(b) session cookies, deleted when you close your browser; or
(c) persistent cookies, which stay until they expire or you delete them.
2. The law, and when we ask for consent
2.1 The Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") control the use of cookies. Under regulation 6(1) of PECR, a website may not store or access information on your device unless an exception in Schedule A1 to PECR applies.
2.2 Paragraph 4 of Schedule A1 contains the "strictly necessary" exception. It applies where storage or access is strictly necessary to provide an online service you have asked for, including where it is strictly necessary:
(a) to ensure the security of your device or of the service;
(b) to prevent or detect fraud; or
(c) to authenticate you automatically.
Before 5 February 2026, this exception was in regulation 6(4) of PECR.
2.3 Most of the cookies and similar technologies we use fall within that exception (sections 3 and 4). Our analytics cookies do not, so we set them only if you accept them in the banner we show on your first visit (section 5). We do not use advertising or social media cookies.
3. Cookies we use
3.1 The table below lists every cookie used on our website. All of them are strictly necessary, except the two analytics cookies, which we set only if you accept them.
| Name | Provider | Set on | Purpose | Duration | Category |
|---|---|---|---|---|---|
__session and __session_<suffix> |
Clerk | .verbier.dev | Holds a short-lived signed token showing that you are signed in, so that the dashboard and our servers can confirm who you are on each request. Set only while you are signed in. The version with a suffix does the same job for our particular Clerk instance | About 60 seconds; renewed automatically while you are signed in | Strictly necessary (authentication) |
__client |
Clerk | .clerk.verbier.dev | Identifies your browser's sign-in "client" to Clerk, which uses it to issue the short-lived __session token. Scripts cannot read it (HttpOnly) |
400 days | Strictly necessary (authentication) |
__client_uat and __client_uat_<suffix> (for example __client_uat_-fpc9KDX) |
Clerk | .verbier.dev | Records when your browser last signed in or out ("uat" means "updated at"), so that Clerk can check whether your session is still valid. It is set even when you are not signed in. The version with a suffix does the same job for our particular Clerk instance | 400 days | Strictly necessary (authentication) |
__cf_bm |
Cloudflare, on behalf of Clerk | .clerk.verbier.dev | Bot management: helps tell people apart from automated bots on our sign-in service | Expires after 30 minutes of inactivity | Strictly necessary (security) |
_cfuvid |
Cloudflare, on behalf of Clerk | .clerk.verbier.dev | Rate limiting: lets Cloudflare tell apart different visitors who share the same IP address | Session (deleted when you close your browser) | Strictly necessary (security) |
__stripe_mid |
Stripe | verbier.dev, on the checkout page only | Fraud prevention: helps Stripe assess the risk of an attempted payment | 1 year | Strictly necessary (fraud prevention) |
__stripe_sid |
Stripe | verbier.dev, on the checkout page only | Fraud prevention: helps Stripe assess the risk of an attempted payment | 30 minutes | Strictly necessary (fraud prevention) |
ph_<project key>_posthog and ph_<project key>_posthog_cpm |
PostHog, for us | verbier.dev | Analytics, only if you accept: an identifier for your browser and your current visit, so that we can see return visits and, when you are signed in, link your visits to your account (section 5). The second cookie records which details the first one holds | 1 year | Analytics (only with your consent) |
3.2 Clerk provides our sign-in, account and billing service. Cloudflare protects Clerk's service. Stripe processes card payments. We checked the cookies our website sets for signed-out visitors on 24 September 2026. The __session cookies are set only while you are signed in, and the Stripe cookies only on the checkout page. Their details come from Clerk's and Stripe's documentation.
3.3 The durations for __client, __client_uat and _cfuvid are those we observed; your browser may shorten them. During sign-in, Clerk may also set short-lived internal cookies (such as __clerk_handshake) for the same authentication purpose, which are deleted within minutes.
4. Local storage and other similar technologies
4.1 We use these local storage items:
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
__clerk_environment |
Clerk | Holds a copy of our sign-in configuration, so that Clerk's sign-in and account components can load it without fetching it every time | Stays until Clerk replaces it or you clear your browser's data for our site | Strictly necessary |
__ph_opt_in_out_<project key> |
PostHog, for us | Remembers whether you accepted or declined analytics cookies, so that we do not ask again on every page | Until you change your choice or clear your browser's data for our site | Strictly necessary |
ph_<project key>_posthog |
PostHog, for us | The same information as the analytics cookie in section 3, only if you accept | Until you withdraw consent or clear your browser's data for our site | Analytics (only with your consent) |
ph_<project key>_posthog, ph_<project key>_window_id and other items starting ph_<project key>_, in session storage |
PostHog, for us | Keep track of your visit in each browser tab, so that a recording follows the right tab, only if you accept | Deleted when you close the tab or withdraw consent | Analytics (only with your consent) |
4.2 On the checkout page, Stripe's payment form also gathers information about your device and browser, and may use storage in its own frame (on Stripe's domains), to detect and prevent payment fraud. This falls within the fraud-prevention part of the strictly necessary exception. Apart from that, the items described above and our analytics (section 5), we do not use tracking pixels or any other similar technology.
5. Analytics
5.1 We use PostHog (PostHog, Inc.) to understand how our website, including our API reference at /docs, is used, so that we can fix what confuses people and improve it: which pages are visited, which links and buttons are clicked, where people stop during sign-up or checkout, and errors in the browser. PostHog stores this data for us in its EU cloud, in Germany. It reaches PostHog through our own website (at verbier.dev/ingest), so your browser does not connect to PostHog directly.
5.2 If you accept analytics cookies, PostHog also keeps an identifier in your browser (sections 3 and 4), records your visits so that we can see where the website causes trouble, and, when you are signed in, links your visits to your account identifier. Recordings hide anything you type into forms, your API keys, your email address and the photos you try in the demo.
5.3 Until you choose, and if you decline, PostHog counts your visit without setting cookies or storing anything in your browser, apart from a record of your choice (section 4). To tell visitors apart within a day, it works out a code from your IP address and browser details together with a secret value that it replaces every day, so it cannot recognise you on a later day.
5.4 You can change your choice at any time with "Cookie settings" at the bottom of our pages. Our API reference at /docs has no cookie banner: it follows the choice you made elsewhere on our website, and until you make one it only counts your visit, as in section 5.3. If you withdraw consent, we remove the analytics identifier from your browser and stop recording your visits. Our Privacy Policy explains how long we keep analytics data (section 9) and your rights (section 11).
6. Third-party content on our documentation page
6.1 Our API reference at /docs uses a documentation viewer:
(a) jsDelivr (operated by Volentio JSD Limited) serves the viewer's script from cdn.jsdelivr.net; and
(b) Scalar (API Documentation Inc.) serves the viewer's fonts from fonts.scalar.com.
6.2 When you open /docs, your browser fetches these files directly from those providers, and they receive your IP address and standard browser information. Neither of them set any cookies in our check, and jsDelivr's privacy policy says its services do not use cookies. For how they handle your data, see section 7.4 of our Privacy Policy at /privacy.
6.3 No other page on our website loads content from third parties apart from Clerk's sign-in service and Stripe's checkout form, described above. Analytics data goes to PostHog through our own website (section 5).
7. How to control cookies
7.1 You can use your browser's settings to see, block and delete cookies and local storage, for all sites or just for ours. Your browser's help pages explain how.
7.2 Apart from the analytics cookies, the cookies we use are strictly necessary, so blocking them will stop parts of the Service working:
(a) if you block Clerk's cookies, or Cloudflare's cookies on clerk.verbier.dev, you will not be able to sign up, sign in or use the dashboard, including creating API keys and managing your plan; and
(b) if you block Stripe's cookies, checkout may not work, and you may not be able to buy or change a paid plan.
7.3 Blocking cookies should not stop you reading our website or documentation. The API does not use cookies: it authenticates requests with your API key.
7.4 Declining or blocking analytics cookies does not change how our website or the API works for you.
8. Changes to this policy
8.1 We will update this policy if we change the cookies or similar technologies we use, and publish the new version at /cookies with a new "Last updated" date.
8.2 If we change what our analytics collects or records, we will update this policy first, and ask for your consent again where the change needs it.
9. Contact
Questions about this policy: hello@verbier.dev. Fortis Ventures Ltd, C/O Aardvark Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom.