Cookie Policy

The short version

Zircca uses cookies it needs to work — keeping you signed in, remembering your language, and completing a password change — and, if you accept, Google Analytics cookies to learn which screens get used.

Analytics cookies are not loaded until you say yes. If you decline, the script is never even downloaded: this is not a checkbox that switches off something already running. You can change your mind at any time from the privacy policy.

Strictly necessary

Without these the application cannot tell who you are from one screen to the next, so they cannot be turned off.

• sb-…-auth-token: your session. It keeps you signed in without retyping your password on every page. It is issued by Supabase, our authentication provider, and is removed when you sign out.
• zircca-idioma: the language you read the application in. Without it, every load would renegotiate it with your browser and your choice would be lost. It lasts one year.
• zc_recuperacion: a temporary marker that exists only while you change your password from the link in the email. It is removed when you finish.

Analytics, and only if you accept

We use Google Analytics 4 to learn which screens get used and where visits come from. It sets its own cookies — _ga and _ga_ followed by the property identifier — so the same person is not counted twice. They last up to two years and are issued by Google.

We send it the screen path and the campaign parameters of the link the visit arrived through, and nothing else. The address is cleaned before it is sent: case, record and account identifiers are replaced, and anything typed into a search box inside the application, email addresses and invitation links are stripped. Google never receives a patient name or a case identifier.

What is stored and is not a cookie

Your theme — light or dark — and private mode, the one that blurs amounts and names so you can record a demo, are kept in your browser's local storage. It never travels with a request, so it never reaches our servers: it stays on that device.

How to change your mind

The privacy policy has a button to decide again about analytics cookies. Withdrawing permission costs exactly what granting it did, which is how it should be.

You can also delete or block them from your browser settings. It is worth knowing what happens: deleting the session cookie signs you out, and blocking all of them means the application cannot keep you signed in. That is not a limitation we chose — without a way to recognise you between two screens there is no working application.

Changes

If we add any other cookie that is not strictly necessary, we will update this document and ask you before installing it, not after.