Cookie Policy
Last updated: 10 October 2026
The short version. This website stores up to three things in your browser under our name: your cookie choice, the region you picked if you picked one, and, if you sign in to your account page, the fact that you are signed in. Our host, Cloudflare, counts page views on our marketing pages without cookies and without identifying you, and only if you have said yes to Analytics. The rescue page runs a Cloudflare security check to keep bots out. No advertising pixels, nothing sold. If any of that changes we'll ask you first, and this page will say so before it happens.
1. What this covers
This policy covers zeropercentapp.com, including the rescue page and family invite pages. The ZeroPercent iOS app sets no cookies at all.
"Cookies" here is shorthand for cookies and the browser-storage techniques that work like them: local storage, session storage, pixels and tags. The UK rules (PECR, alongside UK GDPR) treat them the same way, and so do we.
2. The categories
Necessary: always on
The bare minimum needed for the site to work and to remember your choice. You can't turn these off, because without them the site can't do its job. They don't need your consent under PECR, and they never tell anyone else anything about you.
Analytics: off unless you say yes
Aggregated, anonymous counts of which pages get read, so we know what to write next. Never linked to you as a person. One tool uses this switch: Cloudflare Web Analytics, on our marketing pages only. It loads after you say yes, and not before. It sets no cookie and stores nothing in your browser; it sends Cloudflare the page you viewed, the page you came from and your browser type, and Cloudflare does not use it to identify you across sites. Say no, or change your mind later in cookie preferences, and it does not load from your next page onwards. It is never on the rescue, account or invite pages.
Marketing: off unless you say yes
We plan to advertise ZeroPercent on Facebook, Instagram and TikTok. A measurement pixel would tell us that an advert led someone here, so we can stop paying for the ones that don't work. It's the only reason we'd want one. None of these pixels are on the site today. When one is added it will load only if you have turned Marketing on, and it will appear in the table below with its real name, purpose and retention.
3. What we actually store today
| Name | Type | Category | What it's for | Set by | Kept for |
|---|---|---|---|---|---|
zp.consent |
Local storage | Necessary | Remembers whether you accepted or rejected, which categories, and when, so we don't ask you on every page. | ZeroPercent (first party) | Until you clear your browser data or change your choice. We re-ask if the categories change. |
zp.me.session |
Local storage, or session storage if you tick "Sign me out when I close this tab" | Necessary | Keeps you signed in to your account page at /me/, so you aren't asked for a code on every visit. Only set if you sign in there. | ZeroPercent (first party) | Until you sign out, clear your browser data, or 30 days after you signed in, whichever comes first. If you ticked "Sign me out when I close this tab", only until you close the tab. |
zp_device_id |
Local storage | Necessary | A random label for this browser, so your account page can tell which of your devices is which: when you prove your ZeroPercent PIN on a new sign-in, and for notifications. It says nothing about you or the device. Only set on /me/. | ZeroPercent (first party) | Until you clear your browser data. |
zp_platform_logged |
Local storage | Necessary | Remembers that we have already noted which kind of phone you set up on (Android, iPhone or other), so it is noted once and not on every visit. Only set on /me/. | ZeroPercent (first party) | Until you clear your browser data. |
| Notifications | Service worker and push subscription | Necessary (only if you ask for them) | Lets your account page at /me/ show you a notification, such as someone waiting to join your family, when the page is closed. Only set up if you tap Turn on notifications and your browser asks and you allow it. | ZeroPercent, delivered by your browser's push service | Until you turn notifications off for this site in your browser settings, or clear your browser data. Signing out stops us sending to it. |
zp_region |
Cookie | Necessary (a preference you chose) | Remembers which region's site you asked for when you use the country switch in the footer, so you aren't sent back to the other one. Only set if you click a region link. | ZeroPercent (first party) | 1 year, or until you clear your browser data. |
| Cloudflare Web Analytics | Script from static.cloudflareinsights.com; no storage |
Analytics (only after you say yes) | Counts page views on the marketing pages (home, US home, Android) so we know which pages get read. Loads only after you accept Analytics, and never on the rescue, account or invite pages. | Cloudflare | Nothing is stored in your browser. See Cloudflare's description and its privacy policy. |
| Cloudflare Turnstile | Script and frame from challenges.cloudflare.com |
Necessary (security) | Checks that a rescue sign-in, or a request for a sign-in code on the account page, comes from a person and not a script. Runs on the rescue page and the account page. | Cloudflare | Anything it keeps is inside its own frame, under Cloudflare's name. We cannot see it from our page. See Cloudflare's privacy policy. |
That's the whole list. The local storage entries stay on your device
and are never sent to us, except the zp_device_id label, which
your account page sends with a PIN check or a notification sign-up. The zp_region cookie is sent with each
page request, because that is how the site knows which region you asked for;
it says nothing else about you.
4. Things that are not cookies but look like them
Two honest footnotes, so nothing here is a surprise:
- Fonts. The site's typefaces are served from zeropercentapp.com itself. No font request goes to Google or anyone else.
- The rescue page. A rescue session holds a short-lived token in the page's memory so the browser can prove the session while it lasts. It is gone the moment the session ends or the tab closes. Our own code writes nothing to the borrowed phone. The Cloudflare security check on that page is in the table above. That's a security necessity, not tracking, and it's covered in the Privacy Policy.
5. Changing your mind
Whenever you like, and it takes one click. Your choice is remembered per browser, so you'd need to set it again on a different device.
You can also clear or block cookies and site data in your browser's own settings. Doing that removes your saved choice, so we'll ask again the next time you visit.
6. Third parties
One other company's code runs in your browser on this site, and it is in the table above. Cloudflare hosts the site: every page you load is served by it, and it runs the security check on the rescue page. It may keep short security logs; it sets no tracking cookie for us. It also counts page views on the marketing pages, but only once you have said yes to Analytics. We don't run advertising networks here, we don't sell data, and we don't share anything with data brokers.
If that changes, this section will name the third party, what it does, and where to read its own policy, before it goes live, not after.
7. Changes to this policy
If we add a category or a new provider, we'll update this page and ask you again rather than assume your old answer still stands. The date at the top always tells you when it last changed.
8. Contact
Questions, or something here that doesn't match what you're seeing? Tell us: [email protected]. See also our Privacy Policy and Terms of Service.
OppBox Ltd (trading as ZeroPercent), company number 17351386, registered in England & Wales.