---

title: "Cookie Policy"

product: "Delivery Zone"

version: "1.2"

last_updated: "2026-07-27"

effective_date: "2026-07-27"

status: "current"

---

Cookie Policy — Delivery Zone

Version: 1.2

Last updated: 2026-07-27

Effective date: 2026-07-27

---

1. What Are Cookies

Cookies are small text files stored in your browser by websites you visit. They are widely used

to make websites work correctly or to remember your preferences between visits.

---

2. How We Use Cookies

We use a minimal set of cookies that are strictly necessary for the service to function.

We do not use cookies for tracking, advertising, analytics, or any purpose other than

authenticating you as a logged-in user.

---

3. Cookies We Use

| Cookie Name | Purpose | Type | Duration |

|---|---|---|---|

| dz_access | Short-lived access token for the current session. Identifies your logged-in session. | Strictly necessary | 1 hour |

| dz_refresh | Refresh token used for silent re-authentication without requiring you to log in again. | Strictly necessary | 30 days |

Attributes applied to both cookies:

• HttpOnly — the cookie cannot be read by JavaScript running in the browser, reducing XSS risk.
• Secure — the cookie is only sent over HTTPS connections (not set on localhost in development).
• SameSite=Lax — applied in production and in local development.
• Path — dz_access is scoped to / (all paths); dz_refresh is scoped to /api/auth only, limiting its transmission to authentication endpoints.

These cookies are set by our backend API domain and are used exclusively for session management.

---

4. What We Do Not Use

We do not use any of the following:

• Third-party tracking or advertising cookies
• Analytics cookies (e.g., Google Analytics, Matomo, Plausible)
• Marketing or retargeting cookies
• Social media cookies (e.g., Facebook Pixel, LinkedIn Insight)
• A/B testing cookies
• Preference or personalisation cookies beyond session state

Because we use only strictly necessary cookies, EU cookie law (the ePrivacy Directive, as

implemented in Finnish law) does not require us to display a cookie consent banner for these

cookies. We explain our use here in the interest of transparency.

If we introduce analytics, advertising, social media, A/B testing, or other non-essential

cookies or similar technologies in the future, we will update this policy and request consent

where required before using them.

---

5. Other Third-Party Network Requests (Not Cookies)

Some pages load resources directly from third-party servers. These are not cookies and do not

store anything in your browser, but we disclose them here for transparency:

• Google Fonts — our website and dashboard load font files directly from Google's servers

(fonts.googleapis.com, fonts.gstatic.com). This sends your device's IP address to Google

as part of that request. See Google's privacy policy

for how Google handles this.

• Cloudflare Turnstile — our dashboard loads Cloudflare's bot-verification script

(challenges.cloudflare.com) to protect account registration from automated abuse. On most

pages this loads without showing you any visible challenge.

Neither of these sets a cookie or stores anything in localStorage or sessionStorage.

---

6. Local Storage

In addition to cookies, the dashboard application uses browser localStorage to store small

pieces of non-sensitive preference data. Because localStorage also stores information on your

device, we describe it here for transparency even though it is not a cookie.

| Key | Purpose |

|---|---|

| dz:selected-org-id | Your currently selected organisation ID, so you do not need to reselect it on each visit. |

| dz-theme | Your UI theme preference (light or dark mode). |

No personal data, authentication tokens, or payment credentials are stored in localStorage.

You can clear localStorage via your browser's developer tools or settings without affecting

your account.

---

7. How to Control Cookies

You can configure your browser to block or delete cookies at any time. Note that blocking the

dz_access or dz_refresh cookies will prevent you from logging in to the service dashboard.

See your browser's help pages for current instructions on blocking or deleting cookies.

---

8. Further Information

For more information about how we use your personal data, including legal bases and your rights,

see our Privacy Policy.

For questions about cookies, contact: privacy@deliveryzone.fi