Privacy notice

Zurix Bank is a fictional demonstration bank. It holds no real money. This notice describes exactly what the demo stores, in the spirit of the Swiss Federal Act on Data Protection (revFADP) and the GDPR.

What we store

• Your name and e-mail address, which you give us when opening an account.
• A salted, peppered PBKDF2 hash of your password. We never store or see the password itself.
• Your demo accounts, balances and transactions.
• Session records (a hash of your session token and timestamps) for at most 8 hours.

What we do not store

• No IP addresses. Rate limiting uses a one-way hash of the address, kept for a short window.
• No device fingerprints, analytics, advertising IDs or tracking pixels.
• No third-party scripts, fonts or embeds. Your browser talks only to us.

Cookies

One strictly necessary cookie, __Host-zx_session, keeps you signed in. It is HttpOnly, Secure and SameSite=Strict. There are no other cookies, so there is no cookie banner.

Your rights

In e-banking you can download all of your data as a JSON file at any time, or close your account, which permanently erases your profile, accounts and transaction history.

Hosting

The service runs on Cloudflare's network. Data is stored in a Cloudflare D1 database.