Cookie Policy
Effective date: July 19, 2026 · Version 1.0
This Cookie Policy explains how Vishto Technologies Private Limited ("Vishto", "we", "us"), a company incorporated in India, uses cookies and similar on-device storage technologies on the Vishto website at https://vishto.com (including when installed as a Progressive Web App) and the Vishto mobile app (together, the "Service"). It applies to you as a user of the Service ("you"). This policy should be read together with our Privacy Policy, which describes how we handle personal data more broadly, and our Terms of Service.
The short version: Vishto sets no third-party advertising cookies, no analytics cookies and no cross-site tracking technologies. The storage we do use is first-party and functional — it keeps you signed in, remembers your language, makes sharing and offline use work, and limits how often our own ads repeat.
1. What cookies and similar technologies are
- Cookies are small text files that a website places on your device. They are sent back to the site on later visits so it can, for example, recognise that you are signed in. A "first-party" cookie is set by the site you are visiting (vishto.com); a "third-party" cookie is set by a different domain.
- localStorage is a browser storage area where a site can keep small pieces of data on your device. Unlike cookies, this data is not sent to our servers with every request; it stays in your browser until you or the site clear it.
- sessionStorage works like localStorage but is automatically cleared when you close the browser tab.
- IndexedDB is a browser database used for larger structured data — for example, saving items you add while offline so they can sync later.
- Service worker cache is storage used by the Service's service worker to keep the app shell (pages, scripts, styles) on your device so the Service loads quickly and works offline as a PWA.
Throughout this policy, "cookies" refers to all of the above unless we say otherwise.
2. How Vishto uses these technologies
The table below is the complete inventory of the cookies and storage the Service uses in the browser. All of it is stored under the vishto.com origin on your device. Everything in it is set by Vishto itself, with one exception: the Firebase authentication state entry is written and read by Google's Firebase Authentication software, and only if you choose to use the optional Google sign-in. Google acts as our service provider for that sign-in; see our Privacy Policy for how we describe Google Firebase Authentication as a processor.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Session cookie | First-party cookie (essential) | Keeps you signed in to your account. Marked Secure in production and SameSite=Lax. | Approximately 30 days |
| preferred-language | localStorage | Remembers your chosen interface language. | Until cleared |
| vishto-ad-seen-ID | localStorage | Frequency capping for our own first-party startup ads: it records that a particular startup ad has been shown to this browser, so the same ad is not shown to you repeatedly. It is not used to build a profile of you and is not readable by any other site. | Until cleared |
| pending-share, pending-share-auth, share-success, pending-group-invite | localStorage | Transient state so that shared-list and group-invite flows complete correctly (for example, if you follow a share link before signing in). | Transient; cleared when the flow completes or storage is cleared |
| pwa-admin-intent, pwa-last-admin-route | localStorage | App navigation state for the installed PWA. | Until cleared |
| vishto_auth | localStorage | A flag indicating signed-in state, used by the app interface. | Until cleared or sign-out |
| vishto-banner-dismissed-ID | sessionStorage | Records that you dismissed a banner ad, so it stays dismissed for the rest of your current browsing session. | Current browser session |
| vishto-offline | IndexedDB | Queues product saves you make while offline so they can be uploaded when you reconnect. | Until synced or cleared |
| Firebase authentication state | IndexedDB | Maintains your sign-in state if you use the optional Google sign-in (Google Firebase Authentication). Written by Google's Firebase software. Only present if you use Google sign-in. | Until sign-out or cleared |
| Service worker cache | Cache storage | Stores the app shell so the Service loads fast and works offline as an installable PWA. | Until updated or cleared |
2.1 The Vishto mobile app
The mobile app does not use browser cookies. It stores the equivalent information in the app's own storage area on your device, for the same purposes described above: your signed-in state and authentication tokens, your language preference, transient state for share and invite flows, saves queued while you are offline, a record of which of our own ads have been shown so they are not repeated, and cached content so the app opens quickly. You can clear this storage through your operating system — on Android via Settings → Apps → Vishto → Storage → Clear storage, and on iOS by offloading or deleting the app — or by uninstalling the app.
3. What we do not do
- No third-party advertising cookies. The ads you see on Vishto (startup splash, banners, sponsored cards, feed ads) are served by Vishto's own first-party ad system. No ad network places cookies or identifiers on your device through the Service.
- No analytics cookies. We do not use Google Analytics or any other third-party analytics service.
- No tracking pixels and no cross-site behavioural advertising. Ad impressions and clicks are counted on our servers and aggregated into daily totals. We do not build a per-user advertising profile, and nothing we store on your device is used to follow you across other websites.
- No sale or sharing of personal information. We do not "sell" personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined in the CCPA/CPRA. No cookie or identifier we place on your device is used for either purpose. See the California section of our Privacy Policy for the related rights.
Two of the items in Section 2 relate to how our own ads are displayed rather than to a feature you have separately asked for: vishto-ad-seen-ID (startup-ad frequency capping) and vishto-banner-dismissed-ID (remembering that you dismissed a banner). We describe them here plainly rather than characterising them as strictly necessary. They contain no identifiers shared with third parties and are not used for profiling or cross-site tracking, but they are advertising-delivery storage and we do not claim otherwise.
4. Legal bases and the EU/UK consent position
For users in the EU, UK and other regions with equivalent rules, personal data processed through the storage listed in Section 2 — principally your session cookie and sign-in state, which are online identifiers tied to your account, together with associated server logs such as IP address and user agent — is processed on the following bases: performance of our contract with you for sign-in, account security and features you actively use (sharing, group invites, offline saves), and our legitimate interests in operating, securing and funding the Service for the remaining functional storage. See the corresponding section of our Privacy Policy for the lawful basis applying to each processing purpose.
Under the EU ePrivacy Directive (Article 5(3)) and the UK Privacy and Electronic Communications Regulations (Regulation 6), the requirement to obtain consent before storing information on, or reading information from, a user's device applies to first-party and third-party storage alike. The exemption depends on whether the storage is strictly necessary to provide a service the user has explicitly requested, not on who set it. On that standard, the sign-in, language, share/invite, offline-queue and app-shell items in Section 2 are used to deliver features you have requested, while the two ad-related items identified in Section 3 are advertising-delivery storage and are not presented by us as exempt.
Vishto does not currently present a cookie consent banner. You can remove or block any of the storage described in this policy at any time using the controls in Section 6.
Where personal data associated with this storage is transferred outside your country — for example because a service provider such as Google Firebase Authentication operates internationally — we rely on the transfer mechanism described in our Privacy Policy.
5. Do Not Track and Global Privacy Control signals
Some browsers can send a "Do Not Track" (DNT) signal or a Global Privacy Control (GPC) signal. These signals exist so that users can object to being tracked across websites and to the sale or sharing of their personal information for advertising.
The Service does not track you across third-party websites and does not allow third parties to collect personal information about your activity across sites through the Service, and, as stated in Section 3, we do not sell or share personal information for cross-context behavioural advertising. Because there is no such activity to switch off, the Service does not currently behave differently depending on whether a DNT or GPC signal is present. This disclosure is made for the purposes of California Business and Professions Code section 22575(b). See the California section of our Privacy Policy for further detail.
6. Links to stores and other third-party sites
Product links in the Service take you to third-party retailer and store websites. Once you leave the Service, those sites set their own cookies and use their own storage under their own policies, which we do not control and which this Cookie Policy does not cover. Where we earn a commission on purchases made after you follow a link from the Service, the retailer may use its own cookies to attribute that purchase, and we disclose the commercial relationship as required. Outbound links to Amazon carry Vishto's affiliate tag; see our Terms of Service for the affiliate disclosure.
7. How to control or clear cookies and storage
You are always in control of what is stored on your device.
- Browser settings. Every major browser lets you view, block, and delete cookies and site data. Look for the relevant option in your browser: in Chrome, Settings → Privacy and security → Cookies and other site data (or "Delete browsing data"); in Firefox, Settings → Privacy & Security → Cookies and Site Data; in Safari, Settings/Preferences → Privacy → Manage Website Data; in Edge, Settings → Cookies and site permissions. Clearing "site data" or "storage" for vishto.com removes our cookies, localStorage, sessionStorage, IndexedDB data, and service worker cache.
- Signing out of Vishto ends your session and clears your signed-in state.
- Mobile app. Use your operating system's app storage controls as described in Section 2.1, or uninstall the app.
- Uninstalling the PWA removes locally stored app data on most platforms.
- Your account and content. You can delete individual content and your account from within the Service. Vishto does not currently offer a one-click download of your data; if you would like a copy of the personal data associated with your account, you can request it by writing to support@vishto.com.
Consequences of clearing or blocking. Because our storage is functional, removing or blocking it affects how the Service works: you will be signed out, your language preference will reset, dismissed banners may reappear and startup ads may show again, in-progress share or invite flows may be lost, queued offline saves that have not yet synced may be lost, and offline/PWA loading will not work until the app shell is re-cached. If you block the session cookie entirely, you will not be able to stay signed in.
8. Children
The Service is not directed to children under 13, and Vishto does not knowingly use cookies or device identifiers to collect personal information from children under 13. If we learn that we have done so, we will delete the information. Please see the children's privacy section of our Privacy Policy, which sets out how we handle such cases and how a parent or guardian can contact us.
9. Changes to this Cookie Policy
We may update this Cookie Policy from time to time — for example, if we add, remove, or rename an item in the inventory in Section 2. When we do, we will update the effective date and version number at the top of this page, and for material changes we will take reasonable steps to bring the update to your attention within the Service. The inventory in Section 2 is intended to remain a complete and accurate list of what the Service actually uses.
10. Contact and grievances
Questions about this Cookie Policy or our use of on-device storage can be sent to support@vishto.com.
In accordance with applicable Indian law (including the Information Technology Act 2000 and rules thereunder, and the Digital Personal Data Protection Act 2023), you may also raise a complaint or grievance with us:
Complaints — Email: support@vishto.com
You may raise a complaint by writing to us at the email address above, describing the issue and, where relevant, the account or page concerned. We will acknowledge your complaint within 24 hours of receipt and will resolve it within 15 days of receipt, in line with Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021. Where other applicable rules set a different period for a particular type of complaint, we will meet the shorter of the applicable periods.
11. Related documents
For details of what personal data we collect, why, who we share it with (our service providers), how long we keep it, and your rights — including rights under the DPDP Act, GDPR/UK GDPR, and the CCPA/CPRA — please see our Privacy Policy. Your use of the Service is governed by our Terms of Service. This Cookie Policy is governed by the laws of India, and the competent courts in India have jurisdiction over any dispute arising from it.