Cookie Policy
What the site sets
The public ZENVORA pages do not set a cookie for analytics, advertising, or a marketing pixel. There is no analytics product and no marketing email tool on this site. Because of that, these pages do not show a blocking cookie banner. A banner would pretend to control trackers that were not added.
If a non-essential cookie is added later, it has to stay off until a person turns it on, and the control has to actually stop that cookie. This version does not add one.
Local storage and session storage
These are not cookies. They are mentioned here so the browser behaviour is clear.
When you sign in on a page that can reach the ZENVORA API, the API sets an HttpOnly session cookie. This website cannot read that cookie, and it does not save the session token in local storage. The browser sends the cookie with later account requests. The page learns whether you are signed in from the account service, not by reading a token. Leaving Remember me unchecked keeps the session for 24 hours. Checking Remember me keeps it for 30 days. Signing out deletes that session. Sign out of all devices deletes every session for the account and does not delete the account.
On an HTTPS API, the cookie is Secure and SameSite=None, so this site and the API can be different hosts. The API allows credentialed requests from https://hellozenvora.vercel.app and https://zenvora-public.vercel.app, plus local development origins. It does not allow every origin, and it does not use a wildcard.
On a plain HTTP API used while developing, browsers do not keep a Secure cookie. The API then sets an HttpOnly cookie without the Secure flag. That cookie is still not written to local storage. It is sent only with requests to the same site as the API. A page opened on a different host name does not stay signed in through that cookie. This site does not copy the token into local storage to work around that.
Accounts and saved translations use the ZENVORA API on this website. A normal visit does not create a session until you sign up or sign in.
The forgot-password page can keep a reset code in session storage under zenvora.resetToken when the ZENVORA API returns one. That storage ends when the browser session ends, and the page removes it after a successful reset. No email is sent. This static host does not return a code.
Font request
The pages load the Outfit typeface from Google Fonts. Your browser requests that file from Google. ZENVORA does not set a cookie as part of that request and does not control Google’s response. The request is for the typeface, not for an advertising tag.
The static site is hosted on Vercel. Vercel may keep its own connection logs. That is separate from a ZENVORA cookie.
What you can do
You can clear cookies, local storage, and session storage in the browser. You can sign out, or sign out of all devices, on the account page when the account service is reachable. You can stop using the site. There is no consent switch on this page because there is no optional tracker to switch off.
Questions: zenvorafounder@gmail.com.