Cookie Policy
Effective Date: January 1, 2026
Last Updated: March 28, 2026
1. Introduction
This Cookie Policy explains how the VirtuOZ web application (operated with EvoPay branding where applicable) uses HTTP cookies and similar browser storage. It applies when you use the site in a browser.
2. Cookies we set
The Platform uses first-party cookies with the following names:
- vtoz_access_token — short-lived access token for authenticated API and page requests after sign-in.
- vtoz_refresh_token — refresh token used to obtain new access tokens without logging in again on each visit.
- vtoz_csrf_token — anti-CSRF token; must be present on mutating form submissions.
- vtoz_locale — remembers your selected UI language.
- vtoz_wallet_country — stores wallet country / region context for the session.
- vtoz_trusted_device_id and vtoz_trusted_device_token — optional pair used when you choose “remember this device” for MFA; they identify and authorize a trusted browser for a limited period.
Cookies are set with Secure and HttpOnly (where applicable for tokens), and
SameSite policies appropriate for web session security. Exact lifetimes follow server configuration (for
example, refresh tokens may last up to 30 days; trusted-device tokens align with the “remember this device” period).
3. Theme preference (not a cookie)
The light/dark theme toggle may store your choice in the browser’s localStorage under the key
vtoz_theme. This is not sent automatically to the server like a cookie.
4. What we do not use
We do not use advertising or third-party analytics cookies in this web shell. If embedded payment or identity flows introduce additional cookies in the future, this policy will be updated and, where required, consent will be collected before non-essential cookies are set.
5. Managing cookies
You can block or delete cookies through your browser settings. Blocking essential session cookies will prevent you from staying signed in or submitting forms securely.
6. Changes
We may update this Cookie Policy when our use of cookies changes. The “Last Updated” date at the top will be revised accordingly.