Privacy & Cookies
Last updated: 12 July 2026
This page explains what personal data VerJSON processes, which cookies and browser-storage keys we set, and the rights you have under the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive.
1. Who we are
Controller: VerJSON.
Contact: privacy@verjson.dev
Service: verjson.dev,
docs.verjson.dev, and related subdomains.
2. What personal data we process
- Account data — email address, display name, and, if you use SSO, the identifier your provider returns (e.g. Google account ID).
- Content you create — documents, versions, comments and workspace metadata you author in the editor.
- Session data — the encrypted Supabase auth token used to keep you signed in.
- Operational logs — request logs kept by our infrastructure providers for security and abuse prevention (IP address, user agent, timestamps). Retained for up to 30 days.
We do not run any advertising, marketing or product-analytics trackers (no Google Analytics, no Meta Pixel, no Mixpanel/PostHog/Segment, etc.).
3. Legal bases (GDPR Art. 6)
- Contract performance (Art. 6(1)(b)) — creating an account, signing you in, and storing the documents you author.
- Legitimate interests (Art. 6(1)(f)) — security, abuse prevention, and keeping the service running.
- Consent (Art. 6(1)(a)) — only when you explicitly connect a third-party integration (e.g. Google Drive, OneDrive, Jira, Confluence, GitHub, Crowdin). You can disconnect any integration at any time.
4. Cookies and browser storage
Under the ePrivacy Directive (Art. 5(3)), storage that is strictly necessary to deliver a service you asked for does not require a consent banner. Everything VerJSON stores in your browser today falls into that category, which is why you don’t see a cookie pop-up.
Cookies
| Name | Purpose | Scope | Retention |
|---|---|---|---|
sb-<project>-auth-token(and numbered chunks .1, .2, …) |
Strictly necessary. Encrypted Supabase session so you stay signed in across verjson.dev, docs.verjson.dev and other subdomains. |
.verjson.dev, SameSite=Lax, Secure |
30 days, refreshed on activity. Deleted on sign-out. |
Local & session storage
| Key | Purpose | Retention |
|---|---|---|
sb-* |
Fallback auth session on hosts where the cross-subdomain cookie is not available (preview environments, localhost). | Until sign-out or browser clear. |
verjson_local_documents, verjson_local_versions, verjson_local_release_notes |
Documents you explicitly save to “Local Storage” instead of the cloud. Never sent to our servers. | Until you delete them, or until sign-out if you don’t choose “Keep on this device”. |
verjson_open_tabs_pinned_v1 |
Remembers which editor tabs you pinned. | Until you sign out or clear it. |
| Editor/UI preferences | Small keys used to remember theme, layout and editor settings. | Until you clear browser storage. |
You can delete all VerJSON storage at any time via your browser settings, or by signing out and declining “Keep on this device”.
5. Sub-processors
We use the following providers to run the service. Data-processing agreements and, where relevant, EU Standard Contractual Clauses are in place with each of them.
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Authentication, database, storage, edge functions | EU |
| Railway | Application hosting (API and docs services) | EU / US |
| Cloudflare | DNS, CDN, edge proxy, DDoS protection | Global edge |
| Lovable | Application platform, AI Gateway (only used when you invoke AI features) | EU |
Optional integrations you enable yourself (Google Drive, OneDrive, GitHub, Jira, Confluence, Crowdin) act as additional processors under your own account, on your explicit consent.
6. International transfers
Where a sub-processor operates outside the EEA, transfers rely on the European Commission’s Standard Contractual Clauses (2021/914) and, where applicable, supplementary technical measures such as encryption in transit and at rest.
7. Retention
- Account and content: kept while your account is active. Deleted within 30 days after you delete your account.
- Auth cookies: 30 days sliding window.
- Operational logs: up to 30 days.
- Published documentation: kept until you unpublish or delete it.
8. Your rights (GDPR Art. 12–22)
You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and the right to withdraw consent at any time for anything based on consent. To exercise any of these, contact privacy@verjson.dev. You also have the right to lodge a complaint with your local supervisory authority.
9. Security
Data is encrypted in transit (HTTPS/TLS) and at rest at the storage layer. Access to production data is limited to the controller. Suspected security issues can be reported to security@verjson.dev.
10. Changes
We may update this page as the service evolves (for example, if we ever add analytics — at which point we will introduce a consent banner and gate any non-essential scripts until you opt in). Material changes will be announced in-app.