Two ways to embed the board, and they do not store the same thing. The script embed sets no cookie at all and keeps a signed token in the host page's own local storage, written only once a visitor votes, comments or suggests something. The iframe embed sets one cookie, vf_anon, because the board inside an iframe is a page rendered by VoteFirst's server, and the server reads the visitor's identity from that cookie.
What does the script embed store?
Nothing, until a visitor writes something.
votefirst.js loads any of its seven widgets with a plain read request, and that request carries credentials: 'omit', so no cookie goes with it and none could be set in response even if the server tried. Reading the board leaves nothing behind.
The first time the same visitor votes, comments or suggests a feature, the widget calls ensureIdentity(), which asks the API for an anonymous token and writes it to localStorage under the key vf.anon.<your-project-slug>. Every later vote, unvote, comment or suggestion from that browser sends the same token back in a header, X-VF-Anon, so the board recognises the same visitor without a cookie and without anything sent with credentials.
That write is scoped to your project and to your own page's origin. A visitor who only reads never gets a token at all.
What does the iframe embed store?
One cookie, vf_anon. The iframe is a page rendered by VoteFirst's server inside yours, and the server reads the visitor's identity from that cookie with every request.
The cookie is set the moment the iframe's page loads, not only on a vote, because the page itself needs an identity to attach votes to before it knows whether the visitor will write anything. It is HttpOnly, lasts 365 days, and on the live service is Secure with SameSite=None, which is what a browser requires before it keeps a cookie set inside a third party iframe.
| Embed | Cookie | Browser storage | Written when | Analytics loaded |
|---|---|---|---|---|
Script (votefirst.js) |
None | localStorage, key vf.anon.<project> |
First vote, comment or suggestion | None |
Iframe (?embed=true) |
vf_anon, HttpOnly, 365 days |
None | Every page view | None |
Does no cookie mean no banner?
Not by itself. The EU's ePrivacy rule covers storage read from or written to a visitor's browser, and that includes localStorage, not only cookies.
What the script embed stores is a single signed token, written to remember a visitor's own vote so the count stays right if they come back, and nothing else goes into it. Whether that still needs a line in your own cookie or privacy notice is a question for your own legal adviser.
What happens if storage is blocked or cleared?
The widget keeps working. votefirst.js probes localStorage on load, and if the browser refuses it, a private window with storage turned off is the usual case, the token lives in memory for the length of that page instead. The visitor can still vote and comment; they come back tomorrow as a new anonymous voter rather than the same one, because nothing was kept past the page closing.
Clearing the stored token has the same effect going forward. The votes already cast stay on the board under the identity that cast them; only the next vote from that browser gets a new one. How anonymous visitors are identified has the full detail, including how to clear an identity on purpose from your own sign out flow.
The script tag
<link rel="stylesheet" href="https://app.votefirst.app/embed/votefirst.css">
<script src="https://app.votefirst.app/embed/votefirst.js"></script>
<script>
VoteFirst.init({ project: 'your-project-slug', key: 'your-embed-key' });
VoteFirst.board('#votefirst-board', { board: 'ideas' });
</script>
<div id="votefirst-board"></div>
The three step quickstart walks through getting the key and mounting any of the seven widgets this script draws.
What does it cost?
Nothing beyond your plan. Both embeds are on the nine dollar plan, fourteen day trial with a card at signup, and neither needs the higher one.