Cookie Policy

Effective date: November 12, 2026. This policy lists the cookies this website actually uses. It does not describe an analytics or advertising program, because none is installed. It is not a claim of legal certification.

What a cookie is

A cookie is a small piece of text a website asks your browser to hold and send back on later requests. Cookies can remember a login, measure advertising, or keep a security token tied to a form. Similar storage exists in browsers, such as local storage, but this site’s scripts do not write local storage, session storage, or indexed databases.

Cookies are either first-party, set by the site you are visiting, or third-party, set by someone else’s domain. This site sets only a first-party cookie, and only in one situation.

The cookie that is used

Name: inquiry_session. It is set when the contact form requests a security token from the server, and when the form is submitted. Those requests start a PHP session. The contact page is a static HTML file, so merely receiving that file does not set the cookie. Other pages, including the homepage and the lesson guides, do not start a session and should not set this cookie.

Purpose: the cookie holds a random session identifier. The server stores, against that identifier, a security token that must match when the form is submitted and the time that token was issued. The token exists so a different site cannot silently post the form on your behalf. A stored inquiry is confirmed on its own page. If the form is rejected, the form handler shows the errors in its response. Those messages are not written into the cookie.

Category: strictly necessary for the inquiry form. It is not an analytics cookie and not an advertising cookie.

Duration: the cookie itself is a session cookie. It does not include a long “expires” date. Browsers generally remove it when the browser session ends. Some browsers restore session cookies after a restart. If that happens, the cookie may reappear until the server session is gone. The server is configured to treat inactive session files as eligible for cleanup after about 30 minutes. Cleanup depends on the server actually running its session garbage collection, which ordinary PHP hosting does on its own schedule.

Flags: HttpOnly is set, so JavaScript on the page cannot read the value. SameSite is Lax, which limits when the browser will attach the cookie to a request started from another site. The Secure flag is set when the page was served over HTTPS, so the cookie is not sent with a plain HTTP request in that case. On a local HTTP test, Secure cannot be set or the browser would refuse to store the cookie. Production should be HTTPS, which is also when the Secure flag is on.

Contents: you will not see your name or message inside the cookie. Those sit in the server session and, if you submit a valid form, in the private inquiry file described in the privacy policy. The cookie is only the key.

What is not a cookie

The form includes a hidden field that spam software sometimes fills. That field is HTML, not a cookie. Rate limiting is a file on the server keyed by a hash of the network address. Your browser does not store that file. Fonts and photographs are ordinary files downloaded like any image. They do not set cookies, because they are hosted here rather than pulled from a font or image service at view time.

There is no consent-preference cookie, because there is no optional tracker to accept or reject. A banner that asked you to “accept analytics” would be describing software that is not on the site. The banner is intentionally absent.

Technologies that are not installed

• Google Analytics, Google Tag Manager, and similar measurement scripts.
• Meta, TikTok, or other advertising pixels.
• Embedded YouTube or Vimeo players, which would set their own cookies.
• Chat widgets, heatmaps, and A/B testing tools.
• Social like buttons.
• Remote font requests to a third-party font host.

If one of these is added later, it should not load before this policy is updated. Optional tools should stay off until a real need exists and, where consent is required, until consent is stored. Adding them only to make this page longer would be the wrong trade.

How to control cookies in the browser

You can block or delete cookies in every major browser. The control is usually under privacy or site settings. Blocking all cookies, or blocking cookies for this site, will not break reading the lesson pages. It will break the inquiry form’s security check. The server will treat the submission as expired, the inquiry will not be stored, and the contact page will ask you to refresh and try again. That is the consequence of refusing the necessary cookie: the form cannot prove that the submission belongs to the page you opened.

Deleting the cookie after a successful submission does not delete the stored inquiry. The inquiry is a server record. Use the privacy-request process to ask for deletion of that record.

Private browsing windows usually discard the session cookie when the window closes. That is compatible with how this cookie is meant to work.

Browser vendors move their menus. This policy does not repeat screenshots that would go stale. Look for “cookies” in the browser’s settings search. Chrome, Firefox, Safari, and Edge all provide a way to see cookies for a single site and remove them. Browser extensions that block cookies will have the same effect on the form as the built-in setting.

Do not track and global privacy control

Some browsers send a Do Not Track or Global Privacy Control signal. This site does not run optional tracking, so there is no tracker to switch off in response. The necessary session cookie is still set when the contact form requests its security token, because the form does not work without it. The signal is not ignored out of indifference to a marketing choice. There is no marketing cookie to honor.

Consent

Strictly necessary cookies that make a service you asked for — here, a form you chose to use — are generally distinguished from cookies used for analytics or ads. This site relies on that distinction and does not present a fake choice. If you do not want the session cookie, do not request the form token or submit the form, or block cookies and accept that the form will not submit. Reading the other pages does not require the cookie.

Submitting the form is a separate consent, recorded by the checkbox, to store the inquiry as described in the privacy policy. That checkbox is not a cookie consent. It is consent for the message itself.

Changes

If the cookie name, lifetime, or purpose changes, or if any non-essential cookie is introduced, this page and the effective date will be updated first. The date at the top is November 12, 2026. A change to wording that does not change the cookie should still be dated so you can see that the page was reviewed.

Contact

Questions about this policy can be sent through the contact form. The site is https://zaasna.com/. Requesting that form’s security token sets the session cookie described above. You can also call +1 (614) 655-3901.

More about inquiry records, retention, and deletion is in the privacy policy. The terms explain what a stored inquiry does and does not promise.