Cookie Policy

Cookies are small text files set via HTTP headers or JavaScript. Similar technologies include localStorage (our consent key zdefence_consent_v1), sessionStorage (transient UI state), and — where ever introduced — pixels, SDK storage and cache entries that read or write your device. EU ePrivacy Art.5(3) and UK PECR reg.6 apply to any setting or reading of device storage, not just HTTP cookies.

This policy lists every technology by category, vendor, purpose, data, duration, country and consent requirement. If a technology is not listed here, it is not used. The tracker test (scripts/compliance.mjs --trackers) enforces this: an unlisted third-party origin in client source fails the build.

Strictly necessary storage is set without consent because it is exempt (necessary to provide the service you request and for security). Everything else is off until you turn it on. Today the site sets no analytics, advertising, session-replay, personalisation, A/B-testing, social-widget or AI storage at all.

Consequence: a new visitor with no consent, an EU/UK visitor, a California visitor, an India visitor, and a GPC-enabled browser all see the same safe default — no non-essential execution. The banner does not use manipulative UX: Accept all, Reject all and Manage preferences have equal prominence, no pre-ticked boxes, no confirmshaming, no hidden decline.

The table below is the complete inventory. 'Status today' is factual; 'If introduced' rows describe the gate that will apply before any new technology ships.

• NECESSARY — Clerk session (__clerk_*, __session): authentication and fraud prevention. Data: session identifier, expiry. Duration: session + short persistence per Clerk. Country: US. Consent: exempt, always on. Legal basis: EU ePrivacy strictly-necessary exemption; UK PECR reg.6 exemption.
• NECESSARY — Security (rate-limit, CSRF token, request ID): abuse prevention. Data: hashed IP reference, counters. Duration: minutes to 24h. Consent: exempt.
• FUNCTIONAL (opt-in, off by default) — Waitlist slot memory + consent key (zdefence_consent_v1): remembers your slot and your cookie choices on this device. Data: slot number, policy version, category decisions. Duration: 12 months. Country: device-local only, no transfer. Consent: required except where strictly necessary to remember a choice you made.
• ANALYTICS — NOT IN USE. If introduced: vendor to be listed, purpose to be listed, identifier type, retention, region, sharing. Gate: prior opt-in consent in opt-in regimes (EU/UK/BR/TH/ID/MY/PH/KR and defensive default elsewhere); honour GPC as opt-out; no cross-site tracking; no sensitive URL/query capture; no passwords/tokens to analytics.
• ADVERTISING — NOT IN USE. If introduced: same gate plus sale/sharing opt-out (/legal/your-privacy-choices) and GPC confirmation where required.
• PERSONALISATION — NOT IN USE. If introduced: same gate as analytics; withdrawal stops future personalisation.

EU/EEA (ePrivacy Art.5(3) + EDPB 05/2020): prior consent for non-essential storage; strictly-necessary exempt; reject as easy as accept; withdrawal without detriment. UK (PECR reg.6; DUAA staged exemptions — applicability to us LEGAL REVIEW REQUIRED): same posture. Brazil (LGPD + ANPD guidance): consent for non-essential. India (DPDP notice/consent framework, phased): purpose-specific consent. Thailand (PDPA consent): explicit consent. Malaysia/Indonesia/Philippines/South Korea/Israel/Mexico/Argentina: consent/notice frameworks as in the jurisdiction engine — opt-in is the defensive default. California (CCPA regs): opt-out + GPC honoured with visible confirmation; no account required for opt-out. US federal: no general cookie statute but FTC deception standard requires accurate disclosures.

When the visitor's region cannot be determined, the engine applies the strictest common denominator (opt-in). This is a defensive default, not a legal conclusion.

First visit: banner with Accept all / Reject all / Manage preferences (equal weight, keyboard-operable, focus-managed, no trap, Escape closes preferences, focus restored). Granular toggles per category with plain-language descriptions. Accept/reject/granular/withdraw decisions are versioned (policy version + text version + timestamp + jurisdiction + source page + method + anonymous ID + privacy-preserving IP reference) and written to consent_records where an account or request exists, plus device-local storage.

Withdrawal: footer 'Cookie Settings' button (every page, never only in the dismissed banner), /cookie-preferences, and /privacy-center #cookies. Withdrawal takes effect immediately for future processing and persists 12 months. Policy-version change can trigger re-consent where the notice changed materially.

Evidence minimisation: we store proof of consent, not browsing history. No more than necessary for Art.7(1)/DPDP s.6(10) accountability.

If your browser sends Sec-GPC: 1 or DNT: 1, we treat it as an opt-out of advertising and personalisation and, where required, as an opt-out of sale/sharing under CCPA/CPRA and equivalent. We show a confirmation when the signal is honoured. GPC detection is in src/lib/compliance/consent.ts detectGlobalOptOut + jurisdiction-resolver readGlobalOptOut; server handling is in the consent API.

GPC does not override an explicit opt-in you later give, but you can withdraw that opt-in at any time and GPC will again be honoured.

No third-party video, maps, CAPTCHA, support widget, scheduling tool, payment iframe, analytics, session replay, A/B testing, social widget, AI SDK, external font or CDN resource loads personal data without meeting its consent requirement. Privacy-preserving defaults: facades that load only on click (video/maps), self-hosted fonts (no Google Fonts transfer), deferred Clerk loader (/clerk-defer.js ~2kB) that injects the real bundle only when needed (immediately on /sign-in, /sign-up where the form is the page). Each embed is documented in tracking-inventory.md with vendor, technology, purpose, data, country, cookies, consent requirement, processor/controller status, contract/DPA, transfer mechanism, retention and opt-out.

Cookie/tracker tests (tests/cookies/tracker.test.ts + scripts/compliance.mjs --trackers + perf-cookies.mjs) assert: (1) new user with no consent — analytics/advertising do not initialise and no non-essential network requests fire; (2) EU/UK/California/India personas — correct regime; (3) GPC browser — opt-out honoured; (4) reject — blocked state; (5) accept analytics — initialises; (6) withdraw — future tracking blocked; (7) stored preferences persist; (8) new policy version — re-prompt. Tests inspect actual network requests/scripts, not visible text.

Consent key: 12 months, then re-ask. Necessary session: per Clerk. Functional slot memory: 12 months. Security counters: minutes to 90 days per retention-matrix.md. Any new analytics/advertising vendor will declare its duration here before it ships; 'forever' is never allowed.

Version 0.9.0-draft, last updated 2026-10-02, next review 2026-12-01. Material changes trigger a version bump, preserved history, and where required renewed consent. Contact: privacy@zdefence.com. See also Privacy Policy Sections 11/15/16 and the consent platform (src/lib/compliance/consent.ts, ConsentContext, CookieBanner, CookiePreferences).