Cookie Policy
How ZyloCode uses cookies
Last updated November 2, 2026
The short version
ZyloCode only uses what it needs to sign you in, keep your account secure and remember your preferences. We do not use advertising cookies, and we do not run analytics or tracking scripts.
Sign-in cookies
These cookies are set by Auth.js, the sign-in system ZyloCode uses. The service cannot work without them, so they cannot be switched off. On the live site their names start with __Secure- or __Host- because they are only sent over HTTPS.
Session token (authjs.session-token)
Keeps you signed in.
Lasts: Up to 30 days, or until you sign out
CSRF token (authjs.csrf-token)
Protects sign-in forms against cross-site request forgery.
Lasts: Until you close the browser
Callback URL (authjs.callback-url)
Returns you to the right page after signing in.
Lasts: Until you close the browser
Sign-in checks (authjs.pkce.code_verifier, authjs.state, authjs.nonce)
Used only during Google or GitHub sign-in, to check the sign-in really came from you.
Lasts: About 15 minutes
Browser storage
A few settings are saved in your browser's storage. They stay on your device and are not sent to our servers with each request. Your projects are stored with your account, not in the browser.
Theme
Remembers whether you chose the light or dark theme.
AI model preferences
Remembers the model settings you picked in the workspace.
Scroll position (session storage)
Takes you to the right section after moving between pages. Cleared when you close the tab.
Payments
When you buy a plan, checkout happens on Creem, our payment provider. Creem may set its own cookies on its checkout pages, which its own privacy and cookie policies cover.
Managing cookies
You can block or delete cookies in your browser settings. If you block the sign-in cookies, you will not be able to sign in. Clearing your browser storage resets your theme and AI model preferences.
Contact
Questions about this policy? Email support@zylocode.com. See also our privacy policy and terms of service.