Cookie Policy.

A cookie is a small text file that a website stores in the user's browser when visited. Cookies allow the device to be recognized on subsequent visits, remember preferences and provide essential functionality. Under the term "cookies" we also include equivalent technologies such as localStorage, sessionStorage, HTTP header identifiers or any other mechanism that allows information to be stored or retrieved on the user's device.

For the purposes of this Policy, we distinguish cookies according to the categories established by the Spanish Data Protection Agency (AEPD):

By ownership

First-party (managed directly by Zoku Athletics) or third-party (managed by providers external to the Owner).

By purpose

Technical (strictly necessary), preference or personalization, analytics or measurement, and advertising or behavioral advertising.

By duration

Session (deleted when the browser closes) or persistent (remain on the device for the declared term).

Listed below, with details of provider, purpose, category and duration, are all cookies and similar technologies that may be installed when browsing the Website. This table is kept up to date according to the actual technical implementation of the product.

Strictly necessary cookies (no consent)

__Host-zoku_session

HttpOnly cookie containing the signed session token issued by Supabase Auth after a successful login. It is essential to maintain the authenticated session in protected areas (/cuenta, /admin). It is issued with the attributes HttpOnly, Secure and SameSite=Lax, and with the __Host- prefix, which the browser only accepts if this website sets the cookie over HTTPS. First-party · It lasts as long as the session token has left (around one hour) and is renewed while the session stays open; deleted when you log out. It used to be called zoku_session and lasted 7 days at most.

__Host-zoku_refresh

HttpOnly cookie with the Supabase Auth refresh token, which keeps you signed in without asking for your password again. Same attributes as __Host-zoku_session. First-party · Persistent · 30 days maximum; deleted when you log out. It used to be called zoku_refresh.

__Host-zoku_2fa_pending

Temporary HttpOnly cookie that holds the two-step verification challenge while you enter the code. First-party · 5 minutes. It used to be called zoku_2fa_pending.

zoku_lang

Cookie and localStorage value that remember the language you choose (es / en). First-party · Persistent · 1 year.

zoku_cookie_consent_v1

localStorage value that stores your cookie preferences so the banner is not shown again. First-party · Persistent: for at most 24 months from your choice, after which we ask you again; earlier if you clear your browser data or change your choice.

zoku_2fa_sentTo · zoku_signup_email

sessionStorage values that remember, only during sign-up or sign-in, which email address we sent the verification code to. First-party · Deleted when you close the tab.

Cloudflare Turnstile

Anti-bot security check from Cloudflare, Inc. on the sign-up, login, password-recovery, contact and newsletter forms, to prevent abuse, spam and automated access. It only loads on pages that contain one of these forms. During the check it may use technical storage or identifiers on your device. It is strictly necessary for the security of the service you request and is exempt from consent (Art. 22.2 LSSI). Third-party · Session or short duration. No advertising purpose and no profiling.

Performance measurement (consent required)

Vercel Speed Insights

Aggregated and anonymous web performance metrics (Core Web Vitals: LCP, INP, CLS) collected by the hosting provider Vercel Inc. No identity is associated with the visitor. Not a cookie: it does not store cookies or identifiers on your device (it only reads from the browser the performance metrics of the page you are viewing), and it is served from this same domain. It only loads if you accept the "Analytics" category in the cookie banner and stops loading if you withdraw that consent. Its purpose is knowing whether the site performs well, not counting visits. More information: Vercel privacy policy.

Analytics cookies (consent required)

Vercel Analytics

Aggregated page-view counting without persistent identifiers or traditional cookies. Third-party · Non-persistent. Activates only after consent in the cookie banner.

Google Analytics 4 (_ga, _ga_<ID>)

Google's web analytics service. It sets two cookies in your browser: _ga, which tells visitors apart, and _ga_<ID>, which keeps the session state (<ID> is the identifier of our Analytics property). We use them to measure which public pages are visited and which actions are completed (contact form submission and newsletter sign-up), in order to improve the Website. Cookies on this site's domain set by a Google service (third party) · Persistent · 13 months from your last visit (Google sets them to 2 years by default; on this Website we limit them to 13 months). They are only set after you consent to the "Analytics" category and are deleted when you withdraw it. More information in the Google Analytics section.

Zoku's own usage analytics

It does not use cookies: it stores in your browser a queue of events (localStorage, up to 7 days) and a random session identifier (sessionStorage, deleted when you close the tab). It records the section you visit and the previous Zoku section you navigate from (without knowing which external site you come from; Google Analytics, if you accept it, does receive the referring page), how long the tab is visible and the type of technical error, with no content, full addresses or personal data. We send it to our own servers, with no third parties. It is only switched on after your consent and is stopped and deleted when you withdraw it.

Stripe payment pages

When you subscribe or manage a subscription, the Website takes you to the payment page (Stripe Checkout) or to the Stripe customer portal, which are served on Stripe domains (checkout.stripe.com and billing.stripe.com). Those pages use their own cookies, necessary for payment and fraud prevention, under Stripe's responsibility and in accordance with its cookie policy. Zoku Athletics does not set Stripe cookies on zokuathletics.com.

With your consent to the "Analytics" category, the Website uses Google Analytics 4 to measure the use of its public pages and improve them. This is the specific information about that processing:

Purpose and legal basis

To measure the use of the Website's public pages in order to improve it. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE), which you can withdraw at any time without affecting the lawfulness of the processing carried out before withdrawal.

Data processed

A pseudonymous browser identifier, stored in the _ga cookie (a cookie on this site's domain, set by a Google service). Events the Website sends: the visit to each public page (page_view, with its path without URL parameters and its title) and, only on those pages, contacto_enviado (contact form submission) and newsletter_alta (newsletter sign-up), with no additional data. Data Google Analytics collects by itself even with enhanced measurement switched off: the page you came from (referrer), a session identifier with its timestamp, engagement time on the page, automatic events such as first visit and session start (first_visit, session_start), screen resolution, language, device, browser and system type, and approximate country and city. According to the information published by Google, Google Analytics collects IP addresses to infer location but does not log or store them. No account content or data that directly identifies you is ever sent, and we do not use user identifiers.

Where it is measured and where it is not

Only on the Website's public pages (home, legal texts, the account-deletion page, “About” and the guides). It is not measured in the private area: sign-in, account reactivation, your account, the administration panel or athlete profiles. No data is sent to Google Analytics from those pages. When you move from a public page to a private one, measurement stops and the Google Analytics cookies may be deleted; they are created again if you return to a public page with consent still active.

What we do not do

We do not use Google Analytics for advertising, nor to build audiences or commercial profiles. Advertising storage, sending user data to Google for advertising and ad personalization always remain denied, and Google signals are switched off. Sharing data with Google for its own purposes (products and services, technical support, benchmarking and account specialists) is switched off on our property.

Provider

Google. According to the Google Analytics terms of service, the contracting party is Google Ireland Limited and, according to Google's documentation, Google LLC (United States) acts as processor. Google may process data in any country where it has facilities.

Retention

Event and user data associated with cookies are kept in Google Analytics for 2 months from collection, which is the shortest period the tool offers. The aggregated reports Google Analytics generates from them, which do not identify anyone, are not affected by that period. The _ga and _ga_<ID> cookies expire 13 months after your last visit.

Ownership of the Analytics account

The Google Analytics account is managed directly by the Owner.

Withdrawing consent

From "Cookie preferences", in the footer, switch off the "Analytics" category and save. Measurement stops immediately, without reloading the page, and the _ga and _ga_<ID> cookies of this site are deleted.

• Strictly necessary cookies: exception under Article 22.2 LSSI-CE (cookies essential for the provision of the service expressly requested). No prior consent required.
• Analytics and similar cookies: express consent provided through the cookie banner on the first visit, under Article 6.1.a GDPR. Withdrawal is as straightforward as granting it, via the preferences center permanently accessible from the footer.

You can accept, reject or customize the use of non-essential cookies from the preferences panel of the banner that appears the first time you enter the Website. You can revoke your consent or change your choices at any time via the Cookie preferences link in the footer. When you withdraw the "Analytics" category, measurement stops and the Google Analytics cookies are deleted.

Additionally, all browsers allow you to block or delete cookies from their settings. Note that rejecting strictly necessary cookies will prevent the Website from functioning correctly (for example, you will not be able to maintain the authenticated session). Official links:

• Google Chrome
• Mozilla Firefox
• Safari (macOS)
• Microsoft Edge

Some providers that supply the technical services associated with cookies (in particular Vercel Inc. and Cloudflare, Inc.) may perform occasional processing outside the European Economic Area. In such cases, transfers are covered by the standard contractual clauses approved by the European Commission (Decision 2021/914) and, where applicable, by additional measures agreed with the provider. In the case of Google Analytics, Google may process data in the United States; according to the information published by Google, Google LLC adheres to the EU-U.S. Data Privacy Framework and Google uses standard contractual clauses where a transfer is not covered by an adequacy decision. For more information see our Privacy Policy, section International transfers.

You may exercise at any time the rights recognized by the GDPR (access, rectification, erasure, objection, restriction, portability and withdrawal of consent) by contacting privacidad@zokuathletics.com. In case of disagreement, you may file a complaint with the Spanish Data Protection Agency (www.aepd.es).

This Cookie Policy is reviewed periodically to reflect the actual technical implementation of the Website and regulatory changes. When substantial modifications are introduced, consent will be requested again in the cookie banner. The current version is always available at this URL with the last-updated date indicated at the top of the document.