Cookie Policy
Last updated: 18 August 2026
1. The short version
We set five cookies. Four are required for the product to function at all, and one remembers whether you prefer light or dark mode. We run no advertising cookies, we sell data to nobody, and the marketing site loads no third-party trackers.
There is no consent banner on the marketing site because there is nothing on it to consent to. Inside the product, the cookies below are either strictly necessary or a preference you set yourself.
2. What a cookie is here
A cookie is a small file a site stores in your browser and reads back on later requests. We also use localStorage, which works similarly but is not sent to the server, for the theme preference and for draft content the editor keeps so an accidental refresh does not lose your work. Everything in this policy applies to both.
3. What we set
| Cookie | Purpose | Category | Party | Retention |
|---|---|---|---|---|
| sb-access-token | Carries your signed-in session. Every authenticated request presents it; without it the server has no way to know the request is yours. | Strictly necessary | First party | Session, refreshed on use |
| sb-refresh-token | Obtains a new access token when the current one expires, so you are not signed out every hour. | Strictly necessary | First party | Up to 30 days |
| zeno-org | Remembers which organisation workspace you last used, so the app opens where you left it rather than at a chooser. | Strictly necessary | First party | 12 months |
| zeno-consent | Records the cookie choices you made, so we do not ask again on every visit. Refusing cookies has to be remembered somewhere, and this is where. | Strictly necessary | First party | 12 months |
| theme | Stores your light or dark preference so the page does not flash the wrong theme before the app loads. | Preference | First party | 12 months |
Session cookies are cleared when you close the browser. The rest expire on the schedule above unless you clear them sooner. All are set with Secure, with HttpOnly where the value is never needed by client-side code, and with SameSite restrictions that prevent them being sent from another site.
4. What we do not set
No advertising or retargeting cookies. No cross-site tracking identifiers. No social media pixels. No data broker or audience-matching tags. We do not participate in real-time bidding, and we have no advertising business that would give us a reason to.
Under the CCPA and comparable laws, we neither sell nor share personal information, so there is no opt-out to offer. That is a description of how the business works, not a setting.
5. Analytics
We measure aggregate page views on the marketing site to understand which pages are useful. This is collected without cookies and without cross-site identifiers, so there is nothing here to consent to or refuse. We do not build a profile of you and cannot single you out from it.
Inside the product we use PostHog to record which features are used, so we know what to keep building. Those events are tied to your account rather than to an advertising identifier, are never sold or shared, and are covered by section 3.4 of the Privacy Policy. Product analytics is a legitimate interest, and you can object to it under section 12 of that policy.
6. Third parties
The marketing site loads no third-party scripts. Inside the product, embedded content you choose to add — a video in a document, for example — may set its own cookies under the provider’s policy. That only happens where you have added the embed, and removing it removes the cookies.
Payment pages are hosted by Paddle as merchant of record, and set their own cookies for fraud prevention and to complete the checkout. Those are governed by Paddle’s policy.
7. Refusing cookies
The preference cookie can be cleared at any time through your browser settings, and the theme simply reverts to following your operating system.
The four strictly necessary cookies cannot be refused while remaining signed in, because they are what being signed in consists of. Clearing them signs you out; it does not break anything, and nothing is lost.
Every major browser lets you block or delete cookies per site. Doing so for zenohq.io will log you out and reset your theme preference, and will have no other effect. Most browsers also offer a do-not-track signal; we honour Global Privacy Control where it is sent, though as section 4 explains there is nothing for it to switch off.
8. Changes
If we add a cookie, this table changes before the cookie ships, and the date at the top of this page changes with it. If we ever introduce a cookie that is not strictly necessary or a preference you set, we will ask for consent first rather than adding a row and hoping you read it.
9. Contact
Questions about this policy go to privacy@zenohq.io. See also our Privacy Policy, our Data Processing Addendum, our Terms of Service, and how to delete your data.