Privacy

What Zafiro collects

• Your email address, to create and sign in to your account.
• The visualizations and datasets you create or upload.
• Server logs: request method, path, status, and duration. No cookies or tokens are written to logs.

There are no analytics, advertising, or third-party tracking on this site or in the editor.

Where it lives

Your email address and sign-in credentials are held by Supabase. Your visualizations and datasets are stored in a private per-account database and file directory on a server in the United States. No other account can read them.

Published embeds are public

When you publish a visualization it becomes a file on embed.zafiro.studio that anyone with the URL can open. The URL is difficult to guess, but it is not access-controlled. Do not publish anything you need to keep private.

Cookies

One session cookie on app.zafiro.studio is set when you sign in so that the app knows who you are. It is HttpOnly and same-site. The embed host never receives cookies.

Email

Sign-in and account emails are delivered by Resend.