Cookie Notice

Every cookie and browser-storage item the Zero Human website and Ori Studio use, what each one is for, and how long it lasts. No advertising or analytics cookies.

Version 1.0Last updated 16 October 2026

Draft for legal review. This policy describes how Ori works today, and is being reviewed by counsel before the pilot opens. Details in brackets are still being finalised.

The short version

We use three cookies, all essential: they keep you signed in and make Google, Apple and Microsoft sign-in work.
We don’t use advertising cookies or analytics cookies. Product analytics run on our servers, without cookies.
A few small items in your browser’s storage remember choices such as light or dark theme.

This summary helps you read the document. The full text below is what applies.

1. Cookies#

Name	Purpose	Lasts	Type
`zh_session`	Keeps you signed in. Holds a random token; we store only its hash	30 days, or until you sign out	Essential
`zh_oauth`	Protects a Google, Apple or Microsoft sign-in from forgery while you’re away at the provider	10 minutes	Essential
`zh_pending`	Carries the result of that sign-in back to the page you started from	15 minutes	Essential

Essential cookies don’t need consent, because the service can’t work without them. They’re all first-party, httpOnly (scripts can’t read them) and Secure on our live site.

2. Browser storage#

Key	Purpose	Where
`zh-theme`	Light or dark theme	Local storage
`zh-ref`	The referral code from a link someone shared, so they get credit when you join	Local storage
`zh-pending-brief`	A brief you typed before signing in, so Ori can start from it. Removed once used	Local storage
`zh-studio-dir`	Left-to-right or right-to-left layout in the Studio	Local storage
`zh-banner`	Hides the launch banner after you close it	Session storage (cleared when you close the tab)

You can clear these from your browser’s settings at any time. Nothing breaks; you’ll just see the defaults again.

3. Third parties#

Sign-in providers. If you continue with Google, Apple or Microsoft, their pages set their own cookies under their own policies.
Bot protection. On sign-in and forms, Cloudflare Turnstile may run a privacy-preserving check to stop automated abuse. Cloudflare’s privacy policy applies to that check.
No advertising networks, social-media pixels, session-replay tools or third-party fonts are loaded on our pages.

4. How we measure without cookies#

To understand how people use Ori, we record events such as “started a brief” on our own servers. Visitors who aren’t signed in are counted with an identifier that changes every day and can’t be reversed into an IP address. When you sign up, that day’s events are linked to your account so we can see how the pilot funnel works. See the Privacy Policy.

Version history

Version	Date	What changed
1.0	16 October 2026	First full version. Analytics moved to cookieless measurement.

Privacy & dataPrivacy PolicyWhat personal data Zero Human AI collects when you use Ori and our website, why, who we share it with, how long we keep it, and the rights you have in the GCC, the EU and UK, and the US.SecuritySecurityHow Zero Human AI protects Ori and your data: infrastructure, encryption, access control, application and sign-in security, monitoring, vulnerability management, incident response and business continuity.

Questions about this document? Write to info@zerohuman.co.