Cookie Policy
Effective 26 July 2026
This policy explains everything Xhyzer stores on your device, why, and for how long. The list is short and it does not grow as you browse: no advertising, no third-party tracking, and no cookie beyond the one that keeps you signed in. We do measure how many people visit, and the section below explains how that is done without identifying you.
What we store
| Name | Kind | Purpose | Duration |
|---|---|---|---|
session |
First-party cookie, strictly necessary | Keeps you signed in after you log in with Google or with an email address. It is cryptographically signed, marked HttpOnly and SameSite=Lax, and sent only over HTTPS in production. It holds your session identity, not your credentials. | 14 days, or until you sign out |
xz-theme |
First-party local storage, preference | Remembers whether you chose the dark or the light theme. Written only when you use the theme toggle yourself. | Until you clear it |
xz-cookie-consent |
First-party local storage, strictly necessary | Records that you have seen this notice and what you chose, so we do not ask again on every page. Stores a version number, a timestamp and your choices, nothing else. | Until you clear it, or until this policy materially changes |
How we count visitors without tracking them
We measure audience ourselves, on our own servers. There is no analytics provider, no tag manager and no script from anyone else. Nothing about this is stored on your device, so it adds nothing to the table above.
When you open a page we record the page address, the time, the site that linked you (the domain only, never the full address, which can contain search terms) and any campaign tag in the link. To count a person once instead of counting every page separately, we combine your IP address and browser type into a one-way hash using a secret key that changes every day and is deleted after 48 hours. Your IP address and browser type are never written to the database, and once the key is deleted the remaining hash cannot be connected to you by anyone, including us. Audience records are kept for at most 400 days.
This is the "audience measurement" exemption European regulators describe: first party, never combined across other websites, used only as aggregate counts, and never sold or shared. That is why it does not require consent. If you would still rather not be counted, the standard Do Not Track and Global Privacy Control signals are honoured, and any tracker blocker that blocks first-party requests will also stop it.
Why we ask for information, not permission
Under the EU ePrivacy Directive, prior consent is required for storage that is not strictly necessary, and it is not required for storage that is. Everything in the table above is either strictly necessary to deliver a service you asked for, or a preference you set yourself with a deliberate click. There is no tracking to opt out of, so the banner tells you what happens rather than pretending to offer a choice that does not exist.
If we ever add anything optional, such as analytics, it will appear in the settings panel as a switch that is off until you turn it on, nothing in that category will load before you do, and refusing will be exactly as easy as accepting.
Third-party services
Xhyzer loads no third-party scripts, fonts or pixels, so no other company can set a cookie through our pages. Two flows send you to another company's own website, where that company's cookie policy applies:
Google, if you choose to sign in with a Google account. You are redirected to Google, which handles the login and returns only your email address, name and profile picture. Heleket, our payment processor, if you start a subscription. Payment happens entirely on their checkout page and we receive only a signed confirmation that it succeeded.
Changing your mind
Open the settings panel at any time with the Cookie settings link in the footer of any page. Withdrawing a permission is as easy as granting it.
You can also clear everything from the browser side: delete cookies and site data for this domain in your browser settings. Clearing the session cookie simply signs you out, and clearing the preference keys returns the theme and this notice to their defaults.
Your rights
Access, correction, deletion, portability and objection are covered in our Privacy Policy, along with how to exercise them. You also have the right to complain to your national data protection authority.
Changes
If this policy changes materially, the notice is shown again so your choice is a current one.