1. General approach
The checked Beta configuration includes no advertising analytics, marketing pixels or behavioral ads. Login and requested functions use technical cookies and browser storage. Free access does not mean no data. This notice describes technical cookies and storage used by available functions.
2. Potentially necessary technologies
The session cookie holds an authentication token, not a password or private chat key. Its hash is stored server-side. Google/Apple login is not connected in this Beta, so provider cookie code is inactive. Push is disabled; optional support is opened only following the user’s explicit choice. Stripe webhook intake is server-to-server and sets no visitor browser cookies. Stripe-hosted Checkout is planned only after an explicit support choice; Stripe describes technologies used on its own website.
3. Cookie and technology register
| Name / tool | Operator and purpose | Actual duration |
|---|---|---|
__Host-zad_session | ZAD authentication; HttpOnly, Secure, SameSite=Strict, path /. zad_local_session is the development HTTP variant, not the public HTTPS cookie. | Up to 7 days from issue, revocable earlier. |
IndexedDB zad-dm, stores keys and mail | ZAD private chat key and local plaintext history; no automatic sync. | No application expiry, until browser data is removed or lost. |
localStorage zad-gps | ZAD coordinates after optional GPS activation; used in fuel API requests. | No automatic expiry, until removed using available controls or browser site-data settings. |
localStorage zad-setup-done | ZAD installed-app setup completion. | Until local data is cleared. |
sessionStorage zad-client | ZAD app navigation marker. | Tab/browser session depending on device. |
Cache Storage zad-public-shell-… (versioned cache) and service worker | ZAD public shell, icons, fonts and static assets. Service worker excludes APIs and user media; this is not a promise about every browser cache. | Until cache replacement, update or browser deletion; no guaranteed fixed lifetime. |
Not active: zad_oauth_google/zad_oauth_apple (code specifies 10 minutes, only when configured OAuth starts), loading Stripe Checkout on the social, and push. Old blog references to zad_csrf, zad_vote and eight-hour sessions do not describe this installation.
4. Consent and controls
Strictly necessary technical tools for requested functions generally need information rather than prior consent. New non-essential tools require an appropriate legal basis and blocking until consent where required. Map loading is optional and initiated through controls on the Fuel page.
GPS is requested following your action; device permission is not blanket consent. “Carica la mappa”, or voluntary GPS search, enables OpenFreeMap with OpenMapTiles/OpenStreetMap data and HTTPS requests to tiles.openfreemap.org for styles, fonts and vector tiles. The provider receives the IP address and viewed area; ZAD credentials and chat are not sent. OpenFreeMap states that the map service does not use cookies. The provider receives map requests; see the Privacy Policy for external recipients and applicable rights. “Avvia” opens Google Maps and can include origin/destination coordinates. Source and WhatsApp links open third-party services on request.
Manage cookies and site data through browser settings. Logout revokes the session but does not automatically erase IndexedDB. Clearing site data can irreversibly lose chat keys and history. It does not replace account deletion on the server.
5. Contact and updates
Controller: Marco Zulian, VAT no. 03334690801; zaditalialibera@zulianarchitetturadigitale.eu. Checked DNS/MX point to Register.it; no Cloudflare cookies were seen in the unauthenticated homepage response headers. This does not exclude every possible cookie. The technologies listed here must be updated when new integrations change browser storage.