1.Summary
We do not use advertising cookies, marketing cookies, or third-party analytics cookies. We do not track you across other websites, and we do not sell or share your browsing data.
Everything we store in your browser is either strictly necessary to sign you in or a preference you set yourself. Because none of it requires consent under the ePrivacy Directive or UK PECR, we show a short notice rather than a consent banner that blocks the page.
2.Cookies we set
A cookie is a small file a site stores in your browser and sends back on later requests. We set exactly one.
| Name | Purpose | Type | Expires |
|---|---|---|---|
sz_refresh | Keeps you signed in between visits. Holds a rotating refresh token used only to issue new short-lived access tokens. | Strictly necessary, first-party | 30 days, or immediately on sign-out |
This cookie is hardened as follows:
- httpOnly - unreadable by JavaScript, so a script injected into the page cannot steal it.
- Secure - sent only over HTTPS in production.
- SameSite=Lax - not sent on most cross-site requests, which blocks common cross-site request forgery.
- Path-scoped to /api/v1/auth - sent only to the sign-in and refresh endpoints, not on every API call.
- Rotated on use, with replay detection: reusing an old token revokes the whole chain.
3.Browser storage we use
We also use localStorage, which stays on your device and is never automatically transmitted to us. It falls into two groups.
| Key | Purpose | Category |
|---|---|---|
access_token | Your short-lived sign-in token, so a page refresh does not sign you out. | Strictly necessary |
| Recent projects and queued jobs | Shows your recent work and in-flight job progress after a reload. Cleared when you sign out. | Functional |
| Map preferences - origin airport, marker size, layer order and visibility, zone colours, drawer width | Remembers how you had the map set up. | Functional (your own settings) |
| Interface preferences - list sort order, expanded panels, dismissed tips | Remembers your interface choices. | Functional (your own settings) |
When you sign out, we clear your token and wipe recent projects, job queue, undo history, and notifications, so the next person to use the same browser does not inherit your session or your work.
4.Third parties
- Stripe - when you open the checkout or billing portal, you are taken to a Stripe-hosted page. Stripe sets its own cookies there, including for fraud prevention, under its own policies. Stripe does not set cookies on our pages.
- Sentry - our error monitoring, where enabled, does not set cookies. It transmits error diagnostics only when an error occurs, with tokens, passwords, and authorization headers filtered out.
- Map tiles - the map is drawn from map data served by our own infrastructure. Loading it sends no request to a third party, and no cookie is set for it.
5.Your choices
You can clear or block cookies and local storage in your browser settings, and most browsers let you do this per site.
Because our cookie and token storage are strictly necessary, blocking them will sign you out and prevent you from using the Service. Clearing only the functional preference keys is safe - you will simply get the default map and interface settings back.
We honour Global Privacy Control signals. Since we do not sell or share personal information or run behavioural advertising, there is nothing for the signal to switch off, but no such processing will be introduced without updating this policy first.
6.Changes and contact
If we ever introduce cookies that are not strictly necessary - analytics, for example - we will update this policy and ask for your consent first, before those cookies are set.
Questions: privacy@groundzones.com. See also our Privacy Policy.