Cookie Policy

Last updated: 27 September 2026

This policy lists the cookies and browser storage OnloZap uses, and why. We only use what is needed for sign-in, security and your preferences.

OnloZap is a trading name of Aerdox Group Pty Ltd (ABN 23 695 032 109). ACN 695 032 109. In this document, “we”, “us” and “our” mean Aerdox Group Pty Ltd.

1. Summary

OnloZap uses only the cookies and browser storage needed to sign you in, keep your account secure and remember your preferences. We do not use advertising, analytics or cross-site tracking cookies, so there is nothing to opt in to. This policy forms part of our Privacy Policy.

2. Cookies we use

Cookies set by OnloZap
Name	Purpose	Type	Duration
`sb-…-auth-token`	Keeps you signed in (authentication session)	Essential	Session / until sign-out
`__Host-onlozap-workspace-session`	Binds your session to the active workspace and role	Essential	Session
`oz_context`	Remembers which workspace or portal you are using	Essential	Session
`csrf-token`	Protects forms and actions against cross-site request forgery	Essential	Session
`oz_oauth_next`	Returns you to the right page after Google sign-in	Essential	Minutes
`oz_portal_invite_token`	Completes a client portal invitation	Essential	Minutes
`crm_session_active, portal_session_active`	Shows whether a workspace or portal session is open	Essential	Session

Name
sb-…-auth-token
Purpose
Keeps you signed in (authentication session)
Type
Essential
Duration
Session / until sign-out
Name
__Host-onlozap-workspace-session
Purpose
Binds your session to the active workspace and role
Type
Essential
Duration
Session
Name
oz_context
Purpose
Remembers which workspace or portal you are using
Type
Essential
Duration
Session
Name
csrf-token
Purpose
Protects forms and actions against cross-site request forgery
Type
Essential
Duration
Session
Name
oz_oauth_next
Purpose
Returns you to the right page after Google sign-in
Type
Essential
Duration
Minutes
Name
oz_portal_invite_token
Purpose
Completes a client portal invitation
Type
Essential
Duration
Minutes
Name
crm_session_active, portal_session_active
Purpose
Shows whether a workspace or portal session is open
Type
Essential
Duration
Session

All of these cookies are first-party and set by onlozap.com. They are marked secure and, where possible, HTTP-only, so scripts on the page cannot read them.

3. Browser storage

Browser storage used by OnloZap
Item	Purpose	Duration
`theme`	Your light or dark theme choice	Until you clear site data
`onlozap-sidebar-widths-v1`	Your preferred navigation panel widths	Until you clear site data
`zapling-research-mode`	Your Zapling research-mode setting	Until you clear site data

Item
theme
Purpose
Your light or dark theme choice
Duration
Until you clear site data
Item
onlozap-sidebar-widths-v1
Purpose
Your preferred navigation panel widths
Duration
Until you clear site data
Item
zapling-research-mode
Purpose
Your Zapling research-mode setting
Duration
Until you clear site data

4. Third-party cookies

When you pay an invoice or subscription, Stripe's payment form may set its own cookies for fraud prevention. If you choose Google sign-in, Google sets cookies on its own site. Those are governed by Stripe's and Google's privacy policies.

5. Your choices

You can block or delete cookies in your browser settings. Because the cookies we use are essential, blocking them will stop sign-in, the workspace and the client portal from working. Clearing site data will sign you out and reset your preferences.

6. Contact

Questions about this policy? Email privacy@onlozap.com.