Version 2 (14 Oct 2026) compared with version 1 (12 Oct 2026)

When you sign in with Google, Vietlume receives your email, name and profile picture from Google — not your contacts, calendar or anything else. Only an email address Google has verified can open an account. Vietlume keeps the identifier Google assigns to your account, so it recognises you next time, even if you change your email. If that email already has a Vietlume account created with a password that has never signed in with Google, the first Google sign-in removes the old password and signs out every device: whoever holds the mailbox Google verified owns the account. You can set a new password under Account → Security.

Name · What it is for · How long Cookies vibe_refresh_token vietlume_rt · Keeps you signed in in. Scripts on the page cannot read this cookie (httpOnly); the browser sends it only to Vietlume's own sign-in endpoint · 30 days vietlume_session · Tells the page this browser is signed in, so it can restore the session on reload; holds no sign-in token · 30 days vietlume_session_hint · Shows your name and picture at the top as the page loads · 30 days vietlume_visual_theme · The colour theme you picked · 180 days trip_editor_prefs · Remembers how you view the trip editor (tab, compact or roomy, map) · 1 year Language, view mode, home light/dark · Remembers display choices · 1 year On-device storage vietlume:anon_session_id · Random id for usage statistics · Until you turn statistics off vietlume.room.* · Keeps your seat in a group draw room · Until you sign out or clear browser data vietlume.advisorMemory.v1 · Lets the suggestion assistant remember your earlier answers · Clearable in the assistant vietlume_support · Remembers the support card was shown during this visit · Until the tab closes vietlume_near_me · Remembers that you chose to stop, or start again, using your location on Vietlume · Until you clear browser data vietlume_discover_window · Discover by this week, this month or next month — when you are not signed in · Until you clear browser data vietlume_studio_seen_level · Remembers the Studio tier you were congratulated on, so it is not shown again · Until you clear browser data vietlume_lodging_draft, vietlume_lodging_after_* · Your stay declaration draft (business details, rooms, prices) and the part waiting to apply once you are confirmed as owner · Until it is sent or applied, or you clear browser data Place cache, daily draws, sound · Faster loading, small preferences · Until you clear browser data

If you sign in with Apple, Vietlume receives from Apple an identifier, your email (possibly Apple’s private relay address) and your name if you choose to share it. If that email already has a Vietlume account created with a password that has never signed in with Apple, the first Apple sign-in removes the old password and signs out every device. You can set a new password under Me → Security.

All connections use HTTPS. Passwords are hashed, never stored readable. One session per device; signing out ends that session on the server. Changing your password signs out every other device. On the web, the token that keeps you signed in sits in a cookie that scripts on the page cannot read; access tokens last one hour. Vietlume staff accounts (admin, operator, editor) sign in with a password and a two-step code from an authenticator app. The app's secret key is encrypted before it is stored; recovery codes are stored only as hashes. Photos you upload are stripped of hidden information, including where they were taken. Only operators with a moderation role can see reports.