Cookie policy
Version 2026-11-09, last updated 2026-11-15
zdr.sh uses two technical cookies and a few preferences in your browser. No analytics, no advertising, no third-party tracking. This page is part of the privacy policy.
1. The cookies#
| Cookie | Purpose | Duration | Properties |
|---|---|---|---|
__Host-rd_session | keeps you signed in to the dashboard | 7 days without use, and never more than 90 days from sign-in; 15 minutes while the second authentication factor is pending | technical, first-party, Secure, HttpOnly, SameSite=Lax |
__Host-rd_csrf | protects requests that change data from cross-site attacks, with a double-submit token | until the browser is closed | __Host- prefix, Secure, HttpOnly, SameSite=Strict |
A session ends after 7 days without use, and in any case 90 days after you signed in. Using the dashboard keeps a session alive, but never past that absolute life; signing in again starts a new one. You can end a session sooner from the security page of your account, which lists every session and the device it belongs to.
There is no consent cookie: your choices about the response cache and the memory vault are settings of your account, kept on our servers and never in the browser. The website sets no other cookie, and no cookie follows you to other sites.
2. What we keep in your browser#
The dashboard keeps some preferences and temporary values in the browser, needed for the features you use. They are not used to track you.
| Key | Where | Purpose | Duration |
|---|---|---|---|
theme | localStorage | remembers the light or dark theme | until you clear it |
account | localStorage | remembers the account selected in the dashboard | until you clear it |
session-ended | localStorage | tells the other tabs of this browser that a session ended, so they sign out too | until you clear it |
rackduck.banner.dismissed | localStorage | remembers that you closed the maintenance notice | until you clear it |
rackduck.cookies.notice | localStorage | remembers that you dismissed the cookies notice, for the version of its text | until you clear it |
referral_code | sessionStorage | keeps the referral code during sign-up | until the tab is closed or sign-up ends |
password_reset_notice | sessionStorage | shows the password reset notice once | until the tab is closed or it is first used |
3. Why there is no banner#
These are technical tools: the site cannot work without them, so they need no consent banner. A top-up is a crypto transfer you send from your own wallet, so no payment page of ours sets a cookie. If we ever added analytics or advertising tools, we would ask for your consent first.
4. The notice on the public pages#
No consent banner is needed and none is shown. The public pages and the dashboard carry a dismissible line above the footer that says what this page says, with a link here. It reads: This site uses only the technical cookies the sign-in and the security need. No analytics, no advertising, no tracking. Dismissing it remembers the dismissal in the rackduck.cookies.notice key, for the version of the text: if the wording changes, the notice shows once more. Nothing else is recorded, and dismissing the notice changes no setting.
5. Managing them#
Your browser settings let you see, block and delete cookies and site data. Without the session cookie you are signed out, and without the CSRF cookie you cannot send a withdrawal from the withdrawal page, which you can still do by email; the public pages keep working. Clearing the preferences restores the default theme and language.
6. Contact#
The version and date at the top identify the text in force; material changes are announced by email before they apply. For questions, write to support@rackduck.sh.