ZettaGames sets one first-party cookie, na_session, to keep you signed in to your anonymous account. There is no consent banner because there is nothing optional to consent to: no advertising cookies, no analytics cookies, no third-party cookies.

• A 32-byte cryptographically random token generated on the server.
• Flags: HttpOnly (page scripts cannot read it), Secure in production, SameSite=Lax, Path=/.
• No name, no email, no device information, no tracking identifier.

The database stores only the SHA-256 hash of the token. The raw token exists in your browser and in the response that set it, nowhere else. A database leak therefore yields hashes that cannot be replayed as sessions.

Staff sign-in sets a separate cookie, zg_admin_session, with the same protections. It grants no player identity and is never used for gameplay. Clearing it signs you out of the staff console only.

Your browser keeps a few harmless preferences locally — sound, reduced motion, and the last leaderboard filter you used. None of it identifies you to us, and none of it is sent to the server.

Settings has a “Forget this browser” action that clears the session cookie. Clearing site data in your browser does the same thing. Either way your account still exists; you need a recovery code to come back to it.