Cookie Policy

1. Strictly necessary

Authentication cookies issued by Zipper’s session service keep you signed in to the dashboard. They are first-party, HttpOnly, SameSite=Lax, and required to operate the Service.

A CSRF-adjacent session identifier is used on state-changing dashboard actions.

The Visitor Queue sets a first-party queue-position cookie (zip_vid) and, after a solved browser check on a protected path, a short-lived clearance cookie (prefix tz_wv_). Both are strictly necessary to run the line, are HttpOnly and SameSite=Lax, and expire with the queue TTL.

2. Portcullis

The Portcullis widget may set a short-lived first-party clearance cookie on the embedding site (name prefix tz_pc_) so a solved challenge can be reused on the same page flow. It is not an advertising cookie and expires with the token TTL.

3. Analytics

The marketing site does not load third-party advertising pixels. First-party, aggregated page counters may be used. You can reject non-essential cookies in the banner; necessary cookies cannot be disabled.

Cookie rules are still settling: the EU's Digital Omnibus would add a single-click way to refuse non-essential cookies, but it is not yet law as at 12 November 2026, so we follow the ePrivacy rules in force today.