Skip to content
ZeonHome

Legal

Cookie Policy

Cookies and browser storage used on Zeon web properties today.

Effective October 10, 2026

Introduction

This Cookie Policy describes technologies Zeon uses on accounts.zeon.so, app.zeon.so, institute subdomains, and related Zeon sites that link here. We do not use advertising or cross-site targeting cookies on these properties.

Cookies and storage

Cookies are small files on your device. We also use browser local storage and session storage on institute apps for UI state—these are not cookies but store data locally.

Strictly necessary cookies

Required to sign in and stay secure.

  • auth-token and refresh-token (httpOnly): session after Google or GitHub sign-in; access token about 15 minutes; refresh token up to about 7 days.
  • zeon-device (httpOnly): recognized-device cookie for sign-in flows (long-lived, signed).
  • oauth_state, oauth_flow, auth_return_to, oauth_login_hint, auth_step_up_intent: short-lived OAuth and return-path cookies during sign-in.
  • csrf-token (readable cookie on institute app hosts): paired with X-CSRF-Token for some API writes when the CSRF middleware applies; JWT cookie auth alone does not require CSRF on all routes.

Functional storage (not advertising)

  • accounts.zeon.so — localStorage key zeon.accounts.lastUsedGoogleAccounts: up to four recent Google account labels on your device (~30-day TTL per entry) for faster repeat sign-in.
  • Institute apps — localStorage/sessionStorage for UI preferences (examples in code: sidebar width, calendar prefs, planner session keys). Data stays on your device for convenience.

Third-party cookies

  • Google sets cookies when you use Google OAuth (see https://policies.google.com/technologies/cookies).
  • GitHub may set cookies when GitHub sign-in or linking is enabled.
  • LiveKit and WebRTC infrastructure may use storage required to connect to live classes on livekit.zeon.so or embedded classroom clients.
  • bKash or other payment gateways may set cookies only during an enabled payment redirect.

Analytics

We do not deploy third-party advertising or analytics cookies (for example Google Analytics) on accounts.zeon.so. Operational metrics come from first-party server logs and application data.

Your choices

Use browser settings to delete cookies and site data. Blocking auth-token or refresh-token cookies prevents sign-in. Remove remembered Google accounts from the sign-in UI or clear site data for accounts.zeon.so.