Cookie Policy
The cookies and browser storage we use.
Last updated: October 11, 2026
Overview
Zugo uses cookies and browser storage to make the Service work, to remember your settings and, depending on your choice, for analytics and advertising by Google, Meta and TikTok. Where you are decides the default. In the European Economic Area, the United Kingdom and Switzerland, and if we cannot tell where you are, analytics and advertising cookies are set only after you click "Accept". Everywhere else they are on from your first visit until you turn them off. You can change your choice at any time with the "Cookie settings" link at the bottom of the site. Each item below says what it is for and how long it lasts.
1. Strictly necessary
Your sign-in session is kept by Supabase, our authentication provider, in your browser's local storage (sb-<project>-auth-token) until you sign out; without it you cannot log in or use your account. zugo-consent (local storage) remembers your cookie choice and when you made it, so that we can respect it, until you change it or clear the site's data. zugo-consent-tab (session storage, until you close the tab) remembers that your region has already been checked in this tab, so we ask for it once per tab. When you connect an outside account or sign in with Aevin, a security cookie (__Host-zg_oauth or zugo_aevin_pkce) protects that step and expires after 10 minutes.
2. Preferences
Local storage entries whose names start with zugo- remember your settings and unfinished work in this browser: zugo-theme and zugo-lang (theme and language), zugo-onboarded (whether you finished the introduction), zugo-starter (whether your free starter credits were claimed), and others that hold your drafts, recent projects and interface state. They stay in your browser until you clear them and are not shared with advertisers.
3. Invitation and partner links
If you arrive through a friend's invitation link (?ref=) or a partner's link (?via=), we keep that code in local storage (zugo-ref, or zugo-via together with zugo-via-click and zugo-via-hit, which make sure a click is counted once), so that the person who sent you is credited when you sign up. An invitation code is kept until it is used, a partner code for up to 90 days. They hold the code and a time, nothing that identifies you, and are not shared with advertisers.
4. Our own analytics, without cookies
Our own analytics, Pulse, sets no cookie. It keeps a random session ID in session storage (zp_s), which your browser deletes when you close the tab and which we replace after 30 minutes of inactivity. It runs whatever you choose, because it follows no one across sites and shares nothing with advertisers; what it records is described in our Privacy Policy. Vercel Web Analytics, our hosting provider's page-view counter, sets no cookie either.
5. Google Analytics
Set only when analytics is allowed: _ga (2 years) tells visitors apart, and _ga_<ID> (2 years) keeps the state of your visit. The Google tag that sets them is loaded through Google Tag Manager, which sets no cookie of its own. While analytics is not allowed, the tag neither sets nor reads these cookies and sends Google only signals without an identifier.
6. Google Ads
Set only when advertising is allowed, each for 90 days: _gcl_au, an identifier Google Ads uses to link a sign-up or purchase to an ad; _gcl_aw and _gcl_gb, which keep the Google Ads click identifier from the address you arrived at (gclid, or gbraid and wbraid on some devices); and related _gcl_ cookies such as _gcl_dc and _gcl_gs. The same click information may also be kept in local storage under _gcl_ls.
7. Meta (Facebook and Instagram)
Set only when advertising is allowed, each for 90 days: _fbp identifies this browser to Meta for measuring and targeting ads, and _fbc keeps the Meta ad click identifier (fbclid) when you arrive from an ad on Facebook or Instagram.
8. TikTok
Set only when advertising is allowed, each for 13 months from last use: _ttp identifies this browser to TikTok for measuring and targeting ads; ttcsid and ttcsid_<pixel code> keep the state of your visit; ttclid keeps the TikTok ad click identifier when you arrive from a TikTok ad; _tt_enable_cookie checks that your browser accepts cookies.
9. How you reached us
Set only when advertising is allowed: zugo-touch (local storage, 90 days) keeps the first and the latest way you reached us, that is the time, the campaign tags, ad click identifiers, the referring site and the page you landed on. It lets an ad you clicked on Monday still count when you sign up on Wednesday. Without that permission this record lives only in the open tab (zugo-touch-tab, session storage) and disappears when you close it; what we keep with your account once you sign in is described in our Privacy Policy. Two more entries make sure a sign-up, a first build or a purchase is reported once, whatever you choose, and never leave your browser: zugo-ad-once (local storage, until you clear the site's data) holds short one-way fingerprints of your account ID and of payments already reported, and zugo-ad-tab (session storage, until you close the tab) remembers what this tab has already reported and how you chose to sign in.
10. The platforms' own cookies
When their tags run, Google, Meta and TikTok may also read or set cookies on their own domains, such as Google's IDE and NID, Meta's fr and TikTok's _ttp on tiktok.com, to recognise you if you use their services. Those cookies belong to them and are covered by their own policies, linked from our Privacy Policy; browsers that block third-party cookies block them too.
11. Changing your choice
Use the "Cookie settings" link at the bottom of the site to allow or refuse analytics and advertising at any time. Refusing stops the tags, and our reports about you to the platforms, from then on; cookies the tags already set stay until they expire or you clear them. You can clear or block cookies and site data in your browser settings at any time; clearing the sign-in session signs you out, and blocking strictly-necessary storage may stop sign-in from working. You can also limit ads in the platforms' own settings (Google's My Ad Center, the ad preferences in Meta's Accounts Center, the ad settings in TikTok) and through aboutads.info/choices and youronlinechoices.eu.
12. Abuse prevention
When you claim free credits, we send a one-time device signal that is hashed on our server (we store only the hash, never raw identifiers) to limit free-credit fraud. It is not a persistent tracking cookie. See our Privacy Policy for detail.
13. Pages published through Zugo
Pages published on Zugo carry a view counter so their owner can see their own traffic. It stores no cookie and no raw IP address, only the page path, the referring site's host name, and a coarse device class. It is on by default and can be turned off per project on request; the detail is in our Privacy Policy.
14. Changes & contact
We may update this policy and will revise the date above. Questions: support@zugo.dev.
Language
This document is published in English and in Russian. The English version is the controlling version: if the two differ in meaning, the English text governs. The Russian translation is provided so you can read what you are agreeing to, and we will correct any translation error you report to support@zugo.dev.