Cookie Policy

A cookie is a small text file that a website stores on your device when you visit. Cookies help the site remember preferences, keep you authenticated, and measure how the platform is used.

Zerqano also uses localStorage — a browser-based key/value store — for cosmetic preferences (theme, font) that persist across sessions without being transmitted to the server on every request. The same consent principles apply.

Under the UK Privacy and Electronic Communications Regulations (PECR), the EU ePrivacy Directive, and GDPR Article 5(1)(b) (purpose limitation), we must obtain informed consent before setting any non-essential technology. Consent is collected through our cookie banner shown on your first visit and can be withdrawn at any time.

The following table is a complete inventory of every cookie and local-storage key set by Zerqano. We do not set any undisclosed tracking technologies.

We do not use Google Analytics, Facebook Pixel, or any cross-site tracking technologies. We do not sell or share cookie-derived data with data brokers or advertising networks.

Authentication cookies (sb-access-token, sb-refresh-token) are issued by our Supabase back-end when you sign in. They are marked HttpOnly, Secure, and SameSite=Lax — these attributes prevent CSRF attacks and ensure credentials are never exposed to JavaScript running on the page. Clearing them signs you out immediately.

Functional localStorage keys (zerqano-public-theme, zerqano-public-font) record your display preferences on public pages. This data is entirely local — it is never sent in HTTP requests and never reaches our servers. Clearing it resets the page to its default theme and font.

We use PostHog (self-hosted, first-party analytics) to understand how visitors navigate the platform and which features are used most. PostHog is configured with the following privacy settings:

• No DOM scraping. We do not capture text from form fields, inputs, or content areas.
• No session replay. Mouse movements, scrolling behaviour, and keystrokes are never recorded.
• IP anonymisation. IP addresses are truncated to /24 precision and deleted after 90 days.
• Consent-gated initialisation. PostHog only loads after you have explicitly accepted analytics cookies via our banner.
• First-party only. Analytics data is stored on our own infrastructure — never shared with advertising networks.

We do not use Google Analytics, Facebook Pixel, or any other cross-site analytics or behavioural tracking service on zerqano.com.

We honour the browser-level Do Not Track (DNT) signal. When your browser sends a DNT: 1 header, our analytics provider (PostHog) is not initialised regardless of any prior consent — effectively treating DNT as a withdrawal of optional analytics consent for that session.

We also support the Global Privacy Control (GPC) signal (see globalprivacycontrol.org), treating a GPC:1 header as an opt-out of analytics tracking and any data sharing, consistent with CCPA/CPRA requirements for California residents.

For questions about this Cookie Policy, to withdraw consent, or to request deletion of analytics data associated with your account: