Cookie Policy

The short version

Zircca uses cookies it needs to work — keeping you signed in, remembering your language, and completing a password change — and, if you accept, measurement cookies: Google Analytics, to learn which screens get used, and the Meta pixel, to learn which of our ads work.

Measurement cookies are not loaded until you say yes. If you decline, the scripts are never even downloaded: this is not a checkbox that switches off something already running. You can change your mind at any time from the privacy policy, and when you do we delete any that were already set.

Strictly necessary

Without these the application cannot tell who you are from one screen to the next, so they cannot be turned off.

• sb-…-auth-token: your session. It keeps you signed in without retyping your password on every page. It is issued by Supabase, our authentication provider, and is removed when you sign out.
• zircca-idioma: the language you read the application in. Without it, every load would renegotiate it with your browser and your choice would be lost. It lasts one year.
• zc_recuperacion: a temporary marker that exists only while you change your password from the link in the email. It is removed when you finish.

Measurement, and only if you accept

They are loaded by Google Tag Manager, the container where both are configured. These are they:

• _ga and _ga_ followed by the property identifier: Google Analytics 4, so the same person is not counted twice. They last up to two years and are issued by Google.
• _fbp and _fbc: the Meta pixel, to attribute a visit to the Facebook or Instagram ad it arrived through. They last up to three months and are issued by Meta. The second only appears if you arrived through an ad.

What gets sent to them

The screen path and the campaign parameters of the link the visit arrived through, and nothing else. The address is cleaned before it is sent: case, record and account identifiers are replaced, and anything typed into a search box inside the application, email addresses and invitation links are stripped. Neither Google nor Meta ever receives a patient name or a case identifier.

One send does not go through your browser: when a subscription is paid, our server notifies Meta of that purchase with the administrator's email turned into an irreversible code. It only goes out if you had accepted measurement, and withdrawing that permission switches it off too.

What is stored and is not a cookie

Your theme — light or dark — and private mode, the one that blurs amounts and names so you can record a demo, are kept in your browser's local storage. It never travels with a request, so it never reaches our servers: it stays on that device.

How to change your mind

The privacy policy has a button to decide again about analytics cookies. Withdrawing permission costs exactly what granting it did, which is how it should be.

You can also delete or block them from your browser settings. It is worth knowing what happens: deleting the session cookie signs you out, and blocking all of them means the application cannot keep you signed in. That is not a limitation we chose — without a way to recognise you between two screens there is no working application.

Changes

If we add any other cookie that is not strictly necessary, we will update this document and ask you before installing it, not after.