Legal
Cookie policy
Last updated: 27 October 2026
In short
- Only technical cookies: sign-in, security and flyers.
- No ads, profiling or social network cookies; visits are counted without cookies: that's why there's no banner.
- The site sets no cookies: it only remembers the team you picked.
- You can clear them in your browser any time, but the app won't work without its cookies.
Cookies are small files a site saves in your browser. localStorage and sessionStorage do the same: they are two places in the browser where a page can keep data. This page lists everything zeroshot.it and the Zero Shot app (app.zeroshot.it) save on your device.
We only use technical tools, needed to run the site and the game and to protect them from abuse. No advertising, profiling or social network cookies. We count visits with Umami, on our own server, without cookies or storing anything on your device (see the privacy policy). That's why, as set out in the Italian data protection authority's cookie guidelines (10 June 2021) and Art. 122 of the Italian Privacy Code, we don't ask for consent and there is no banner.
The controllers are Davide Ghiotto, Andrea Mazza and Yi Zhang: for any question write to [email protected]. How we use the data collected is explained in the privacy policy.
The zeroshot.it site
The site sets no cookies. It saves a single item in your browser:
| Name | Type | What it's for | Duration |
|---|---|---|---|
zs-landing-strain | localStorage | Remembers the team you picked, to colour the page. It is never sent to us. | Until you clear it |
The app.zeroshot.it app
Cookies
All are first-party cookies, set by our own server and not readable by other sites.
| Name | What it's for | Duration |
|---|---|---|
__Secure-better-auth.session_token | Keeps you signed in to your account. | 30 days |
__Secure-better-auth.session_data | A signed copy of the session, so the database isn't queried on every request. | 2 minutes |
zs_dev | A random browser identifier, for security: it spots many accounts opened from the same browser to cheat. It holds no name or email, but it is linked to the activity log of the accounts used from that browser. It is not used for advertising. | 400 days |
zs_flyer | Only if you came from a flyer QR: remembers which flyer, to note it on your account. | 30 days |
Data saved in the browser
| Name | Type | What it's for | Duration |
|---|---|---|---|
zs-device | localStorage | A random device identifier, sent with requests for security (like zs_dev). | Until you clear it |
zs-team | localStorage | Your team's colour, so the app opens in your colours straight away. | Until you clear it |
zs:invite | localStorage | The QR you arrived from (a player's invite or a hunt), until you join the game. | Until you join the game |
zs:perk-snooze:* | localStorage | Hides a game tip you skipped for a while. | 4 hours |
zs-agenda-offset | sessionStorage | The difference between your phone's clock and the server's, for the agenda. | Until you close the tab |
The app is a PWA: to work on the conference's slow network it caches its own files (pages, scripts, images) in the browser through a service worker. These are not personal data.
Cloudflare
Traffic goes through Cloudflare, which may set technical security cookies to recognise bots, such as __cf_bm (30 minutes) or cf_clearance. Cloudflare manages them under its own cookie policy.
Links to other sites
If you open an external link, such as our Instagram profile or social profiles shared by another player, that site uses its own cookies under its own rules.
How to clear them
You can clear cookies and saved data in your browser settings, under site data. Clearing the app's data signs you out, and you'll need a new code by email to get back in. Blocking the app's cookies prevents you from playing.