Cookie & Storage Policy

This page describes the cookies and browser local storage the site uses. We describe each item by its real mechanism — a token in local storage is not a cookie — and classify it.

What we store

• Authentication token — stored by Supabase in local storage (not a cookie). Strictly necessary.
• Checkout — Stripe may set cookies (e.g. __stripe_mid/__stripe_sid) only if its script runs on-site; payment is otherwise handled on Stripe's hosted pages. Strictly necessary.
• Security — Cloudflare sets security cookies (__cf_bm, cf_clearance) to protect the site. Strictly necessary.
• UI preferences — zl_theme, zl_density, zeroday-global-filters, and your saved/active scenarios, in local storage. UI customization (your choices).
• Developer instrumentation — zl_plotly_direct is read-only and opt-in (query parameter / environment); it is not written for end users. Not necessary; not active for you.

Consent

Spanish and EU rules on storing/reading information on your device (art. 22.2 LSSI-CE; art. 5(3) ePrivacy) are technology-neutral and, per the AEPD Guía de cookies (2024), cover local storage as well as cookies. Whether a consent banner is required is conditional: the strictly-necessary exemption applies only after we confirm every storage operation is strictly-necessary or part of a service you requested — including confirming Stripe's script scope and which security cookies fire. We do not assert the exemption as settled; our storage audit is the basis for this position.

Analytics

Our analytics provider, Plausible, is cookieless: it sets no analytics cookies and stores nothing in your browser, so no consent is needed for measurement. It produces aggregate, non-identifying counts; we do not claim it processes “no personal data” — see the Privacy Policy.

Controlling storage

You can clear cookies and local storage in your browser settings; clearing the auth token signs you out. Questions: [email protected].