Transparency · Cookies and similar tech
Cookie policy
This page explains which technologies we may place or read, how to align choices with your expectations under EU and U.S. frameworks, and how your stored preference relates to the privacy notice.
Scope and who this is for
Controller and site. The party responsible for this site is Zlexironflox, 1500 Lexington Ave, New York, NY 10029, United States, publishing at zlexironflox.ddd. The policy is written in U.S. English for a general U.S. audience, while we also provide statements that are helpful if you are in the EEA, UK, or Switzerland.
What the policy is not. This is not a contract for a paid product by itself, but it is part of the overall information we give you when you use the public pages, together with the Terms of use and the Privacy policy. It does not create any promise of a particular result from visiting the site.
Children. The site is not designed to draw data from children. If a parent or guardian believes we received preference data in error, the contact channel in the Privacy policy can be used to request its removal, subject to limited technical logs we must retain in some cases to prevent abuse.
What we mean by cookies, pixels, and local storage
Cookies. A cookie is a small text file written by a site or a third party that your browser can send with later requests. First-party cookies are set by the host you see in the address bar. Third-party cookies are set by another domain, often a vendor that we embed, such as an analytics or advertising script when you allow that category through our layer.
Pixels, tags, and similar signals. A tracking pixel, JavaScript tag, or similar may record that a page was viewed, that a file loaded, and sometimes attributes such as a random identifier, campaign label, or approximate location derived from a technical address. These signals are often classified together with cookies for policy purposes, even if they are not themselves cookies in the narrow sense.
Local storage. localStorage and similar APIs let the site read and write a small amount of text in the browser, sometimes with a longer life than a session cookie. We use this approach to remember the consent record you have chosen so that a repeat visit is less disruptive, until you change your mind or your browser data is cleared. That record is not a replacement for a server-side contract; it is a convenience layer that mirrors a choice in your browser only.
Why the distinction matters. Browsers and regulators have moved to give you more visibility into third-party and cross-site tracking, while still allowing core delivery of pages. Our consent panel asks for separate choices when the law in your place of connection calls for that separation between necessary tools and the rest.
Our categories, what they do, and when they load
Strictly necessary
These tools support routing, response integrity, session continuity that is part of the basic response, and storing your own consent string so we do not ask you the same way on every sub-page. They are not used to build a marketing profile on their own and are not offered as a toggle you can turn off in our own prompt, because turning them off may leave the service unavailable or insecure.
Analytics, when enabled
If you allow analytics, we may work with a vendor to count visits, see scroll depth or exit pages in aggregate, and group traffic by very broad segments such as device class or state-level region, depending on the tool’s configuration. We try to use settings that limit persistent identifiers, but some vendors still rely on a cookie or similar token. That token may be personal data in some countries.
Marketing, when enabled
Marketing or advertising-related technology may be used to measure ad delivery, build frequency caps, and sometimes retarget a browser or device, depending on the provider. Some U.S. state laws may treat a transfer to a partner as a “sale” or “share” of personal data if money or credit changes hands, or a partnership shares identifiers for ad purposes. We describe opt-out and consent paths in the Privacy policy.
Embeds you actively open
Where a page offers an embed from another service and you start playback or interaction, the provider of that embed may set its own cookies. That processing is also described in the provider’s public notice. We do not use hidden audio or video that starts without an intentional click where we control the markup.
Your consent record. When you click Accept, Reject, or Save in the settings panel, a minimal JSON-like structure may be written to localStorage in this site’s origin, including a timestamp in ISO-8601 form and the flags you picked. That record is not a payment receipt; it is only there so the first-run banner can be suppressed until you use “Cookie settings” to reopen the panel, or you clear your browser’s storage. If you use private browsing, the same choices may be cleared when the session ends.
Lawful bases, consent, and the interaction with the GDPR
Where the General Data Protection Regulation applies, we take the view that first-party, strictly necessary operations often rest on a combination of your implicit request to receive a page, our legitimate interest in a stable and secure service, and where needed, a narrow consent path for a specific storage write that is not otherwise exempt. For analytics, marketing, and similar add-ons, we treat consent as the appropriate basis unless a narrow override applies under local law for fully anonymous statistics, which in practice is difficult to meet with common hosted scripts.
Where the ePrivacy rules require a consent signal before non-essential storage or access, we aim to show the banner before or at the time those scripts are allowed to run. We also avoid loading optional categories in a way that pre-selects a “yes” for EEA, UK, or similar visitors when that is not permitted. If you are using an automated content blocker, it may still prevent some tags; that external choice is not the same as a formal withdrawal on our own panel, and we may not always detect it.
Withdrawing or changing your mind. You can reopen the panel from a link in the pre-footer of many pages. A withdrawal applies forward from the moment your browser records the new value; it does not retroactively erase the fact that a vendor may have already received a signal, which is one reason we speak about “aggregate” or “pseudonymous” use in the analytics section, not perfect anonymity, unless the vendor is configured in a very strict and inspectable way.
Retention in time: logs, partners, and your device
Server-side access logs, when kept by our host or a security monitor, are typically rotated on a period measured in months, with exceptions for a security investigation or a legal hold. A typical pattern for routine HTTP logs in a well-run environment is a rolling period that does not exceed one year, but we are bound by a vendor’s actual configuration and a regulator’s order if a longer period is required.
When an analytics or marketing platform holds event data, we use contract terms, region settings, and account controls to request shorter retention, where they exist, and to avoid using fine-grained location where we can still learn enough in aggregate. Some vendors, however, keep derived models longer than the raw log window; we mention this so you are not surprised if you later see a privacy statement from a partner with a long model horizon.
Your local copy of a consent value lasts until you change it, clear site data, or use a new profile, device, or browser. The server does not have to be involved to forget that; conversely, you should not expect an instant mirror on every back-end if you only change your browser, because a partner may not know your prior identity the same way we do in email communications.
How this ties to your data rights in the Privacy policy
Your rights to access, correct, delete, restrict, object, port, or not be subject to an automated significant decision, as well as your rights to file a complaint with a supervisory authority, are set out in the Privacy policy, which is the right place to read about identity verification and timing. The Cookie policy is intentionally narrow, so you can read about tracking tools without the full discussion of all categories of data we may process in every channel, such as a written letter or a phone call.
If you opt out in a U.S. state with a “Do not sell or share my personal information” or “opt out of targeted advertising” right, the technical implementation may involve a first-party string and a list of downstream partners, which in turn may be reflected in a browser header or a partner-side flag. The Privacy policy and any future “Your privacy choices” page will describe the route we have chosen, because those routes evolve as regulations and browsers develop.
International transfers, safeguards, and vendor locations
Some infrastructure that handles technical logs or that serves optional scripts is located in the United States or in other countries. For transfers of personal data that originate in the EEA, UK, or Switzerland, we use Standard Contractual Clauses or a successor mechanism, plus supplementary technical or organizational measures where a transfer impact review suggests a gap, as described in the Privacy policy, not in full detail in this addendum.
When a vendor is certified under an adequacy program or a framework between regions, that relationship may reduce the need for a bespoke set of terms between you and us, but you still have the rights the law provides against the controller, which remains Zlexironflox for the site experience we operate directly.
How we will tell you if this document changes
We will adjust the “material” part of the policy when a category is added, an important vendor is replaced, a retention window moves by an order of magnitude, or a legal requirement forces a different presentation. A brief notice may appear in the pre-footer, on a site-wide ribbon, or in an email to people who have an active, consent-based list subscription, as applicable. A significant change in non-essential practices may, under ePrivacy, require a fresh request through the banner if we cannot rely on a previous consent string that still matches the new use.
Contact for questions about this policy only. For focused questions, email contact@zlexironflox.world with “Cookie question” in the subject line, or call +1 212-289-3846 during published business hours. We may move broad privacy requests to a structured portal if volume grows, but the address above remains valid as a first step.
Related documents: Privacy policy, Terms of use, and the home page for context on what the site is about. You can reopen Cookie settings at any time.