Cookie Policy

Cookies are small text files a website asks your browser to store and send back on later visits. They are what lets a site remember that you are signed in, or that you prefer dark mode. Local storage is a related browser feature that keeps data on your device but does not send it to the server automatically.

All four are first-party — set by this site, readable only by this site.

Strictly necessary

zorforge-session

Identifies your session so the site can keep you signed in and protect your account. Marked HttpOnly, so JavaScript cannot read it, and restricted to same-site requests. Expires after 120 minutes of inactivity. Without it, signing in is impossible.

XSRF-TOKEN

Carries a cross-site request forgery token so the site can verify that forms were submitted by you rather than by another site acting in your name. Readable by JavaScript by design, since the page needs to send it back. Lasts for the session.

Preference

appearance

Remembers whether you chose the light theme, the dark theme, or to follow your system setting. Read on the server before the page renders, which is what stops the screen flashing white before dark mode applies. Expires after 365 days. Holds one of three words and no identifier.

sidebar_state

Remembers whether you left the account-area sidebar open or collapsed. Expires after 7 days. Holds true or false and nothing else.

The two preference cookies are deliberately excluded from our cookie encryption, because they must be read before the page renders and contain nothing worth protecting.

We use exactly one local-storage entry, also called appearance, holding light, dark, or system. It mirrors the preference cookie so your theme applies instantly on repeat visits. It never leaves your device.

We use no other browser storage — no session storage, no IndexedDB, and no device fingerprinting.

This site sets no:

• analytics or measurement cookies;
• advertising, retargeting, or conversion cookies;
• social media or embedded-content cookies;
• cross-site or third-party tracking cookies of any kind.

There are no third-party scripts, pixels, iframes, or embeds on this site, and our typeface is served from our own servers rather than a font CDN — so visiting this page does not disclose your IP address to anyone but us.

Consent banners exist because most sites set tracking cookies that require your permission. We do not set any. The cookies above are either strictly necessary to deliver a service you asked for, or store a preference you chose yourself by clicking a theme toggle.

Rather than interrupt you with a dialogue that has only one real answer, we have documented everything on this page. If we ever introduce a cookie that needs consent, we will ask for it first.

You can delete or block cookies in your browser settings — every major browser has controls under Privacy or Security, usually per-site.

Blocking the two preference cookies is harmless: the site falls back to your system colour scheme and an expanded sidebar. Blocking the session and CSRF cookies will prevent you from signing in or submitting forms, but the public pages will still work normally.

If we add, remove, or change a cookie, we will update this page and the "last updated" date above. Our Privacy Policy explains how we handle personal information more broadly.

Questions about cookies on this site can go to [email protected].