1.Summary
We do not use advertising cookies, marketing cookies, or third-party analytics cookies. We do not track you across other websites, and we do not sell or share your browsing data.
Our cookies are strictly necessary to sign you in, so they need no consent, and the one that could outlast your visit does so only if you tick Keep me signed in. Everything else - your map and interface settings - is stored only after you accept this policy.
2.Cookies we set
A cookie is a small file a site stores in your browser and sends back on later requests. We set one that keeps you signed in, and two short-lived ones that exist only while you are signing in with Google. All three are set by our API at api.groundzones.com, which is part of the same site.
| Name | Purpose | Type | Expires |
|---|---|---|---|
sz_refresh | Keeps you signed in. Holds a rotating refresh token used only to issue new short-lived access tokens. | Strictly necessary, first-party | When you close your browser, or 30 days if you tick “Keep me signed in”; immediately on sign-out |
sz_oauth | Set only when you choose to sign in with Google. Ties Google’s answer back to the sign-in you started in this browser, so it cannot be replayed into another. | Strictly necessary, first-party | 10 minutes, or as soon as the sign-in finishes |
sz_google_pending | Set only on a first sign-in with Google, while you accept the terms. Holds the Google account details until your account is created, so nothing is stored before you agree. | Strictly necessary, first-party | 15 minutes, or as soon as your account is created |
All three are hardened as follows:
- httpOnly - unreadable by JavaScript, so a script injected into the page cannot steal it.
- Secure - sent only over HTTPS in production.
- SameSite=Lax - not sent on most cross-site requests, which blocks common cross-site request forgery.
- Path-scoped to /api/v1/auth - sent only to the sign-in and refresh endpoints, not on every API call.
- Rotated on use (the sign-in cookie), with replay detection: reusing an old token revokes the whole chain.
3.Browser storage we use
We also use localStorage and sessionStorage, which stay on your device and are never automatically transmitted to us. Session storage is emptied when you close the tab.
| Key | Purpose | Category |
|---|---|---|
gz.cookieConsent | That you accepted this policy, which version, and when. It is how we know not to ask again. | Strictly necessary |
access_token | Your sign-in token, valid for 15 minutes and renewed while you use the Service, so a page refresh does not sign you out. Stored whether or not you accept this policy, because signing in needs it. | Strictly necessary |
| Recent projects and queued jobs | Shows your recent work and in-flight job progress after a reload. Cleared when you sign out. | Functional |
| Map preferences - origin airport, marker size, layer order and visibility, zone colours, drawer width | Remembers how you had the map set up. | Functional (your own settings) |
| Interface preferences - light or dark theme, list sort order, project tile size, expanded panels, dismissed tips | Remembers your interface choices. | Functional (your own settings) |
| The number of airports you chose on the pricing page or at signup | Presets the pricing slider to your own figure. | Functional (your own settings) |
| A one-time message in session storage | Carries a confirmation across the page reload that follows restoring a snapshot. Removed as soon as it is shown. | Functional |
When you sign out, we clear your token and wipe recent projects, job queue, undo history, and notifications, so the next person to use the same browser does not inherit your session or your work.
Our visit statistics use neither cookies nor browser storage. We count views of our public pages on our own server, and nothing is stored on or read from your device to do it. What is recorded is set out in Section 2.3 of the Privacy Policy.
4.Third parties
- Stripe - when you open the checkout or billing portal, you are taken to a Stripe-hosted page. Stripe sets its own cookies there, including for fraud prevention, under its own policies. Stripe does not set cookies on our pages.
- Google - if you choose to sign in with Google, you are taken to Google's own sign-in page, where Google sets its cookies under its own policies. We load no Google script on our pages, and Google sets no cookies on them.
- Sentry - our error monitoring, where enabled, does not set cookies. It transmits error diagnostics only when an error occurs, with tokens, passwords, and authorization headers filtered out.
- Map tiles - the map is drawn from map data served by our own infrastructure. Loading it sends no request to a third party, and no cookie is set for it.
5.Your choices
When you first visit, we ask whether you accept this policy. Until you do, we store nothing in your browser except, once you sign in, the sign-in cookie and token above. Everything works either way; without your agreement your settings are simply not remembered between visits. A Decline is not stored anywhere, so we will ask again on your next visit.
When you sign in, you choose whether to tick Keep me signed in for 30 days. If you do not, the sign-in cookie is deleted when you close your browser.
You can give or withdraw your consent here at any time. Withdrawing clears everything it allowed us to store in this browser; it does not sign you out.
You can also clear or block cookies and local storage in your browser settings, and most browsers let you do this per site.
Because our cookie and token storage are strictly necessary, blocking them in your browser means you cannot sign in to the Service. Clearing only the functional preference keys is safe - you will simply get the default map and interface settings back.
We honour Global Privacy Control signals: a browser that sends one is left out of our visit statistics. We do not sell or share personal information or run behavioural advertising, so there is nothing else for the signal to switch off, and no such processing will be introduced without updating this policy first.
6.Changes and contact
If we ever introduce cookies that are not strictly necessary - analytics, for example - we will update this policy and ask for your consent first, before those cookies are set.
Questions: privacy@groundzones.com. See also our Privacy Policy.