Cookie Policy

MuffinBiter sets one cookie. It keeps you logged in. That's the entire cookie policy, but here are the details.

The cookie we set

Name	Purpose	Type	Lifetime
`zsid`	Keeps you signed in. Contains an opaque random token — no name, no email, nothing readable.	Strictly necessary, first-party	Until you log out or it expires

It's set with HttpOnly (JavaScript can't read it), Secure (HTTPS only) and SameSite=Lax (not sent from other sites' requests). The matching value in our database is stored as a hash, so even we can't reverse a stolen cookie into a session.

What we don't set

No advertising or retargeting cookies.
No analytics cookies — no Google Analytics, no Meta pixel, no anything.
No third-party cookies of any kind. No external scripts run on this site.
Map images are the one thing loaded from another server. Pages with a map fetch their background squares from OpenStreetMap, which sets no cookie and runs no script — it's an image, like any other image on any other website. It does mean OpenStreetMap sees your IP address, which is why it's named in the Privacy Policy's service-provider list.
No cross-site tracking, no fingerprinting, no session recording.

This is why you're not being interrupted by a consent banner. Under both the ePrivacy rules and California law, strictly-necessary cookies don't require consent — and we don't set any other kind.

Local storage

The app uses your browser's sessionStorage to remember small interface state — for example, that you dismissed the “confirm your email” banner for this session. It never leaves your device and is cleared when you close the tab.

Controlling cookies

You can block or clear cookies in your browser settings. Blocking ours means you won't be able to stay logged in — the public pages (this one, the park directory, the guides) work perfectly well without it.

Changes

If we ever add a cookie, this page changes first and we'll say what and why. If we ever added a non-essential one, we'd ask you before setting it — but the plan is to not have that conversation.

Questions: privacy@muffinbiter.com.

Plain-language note. These documents are written to be readable rather than impressive. If anything here is unclear, email hello@muffinbiter.com and we'll explain it — and probably rewrite it.

Other policies: Terms · Privacy · Cookies · Your privacy choices · Community guidelines · Accessibility