Cookies
Cookie Policy
Every cookie and storage technology we use, what it does, and how to change your mind — written plainly, with nothing left out.
The short version: we use a handful of cookies to keep you signed in, and Google Analytics only if you say yes. There is no advertising, no retargeting, and no cross-site tracking on Gymcierge. Section 7 tells you how to change your choice at any time.
2. The two categories we use
We only use two categories, because we only have two kinds of technology to describe.
- Strictly necessary — required for Gymcierge to work at all. These cannot be switched off, and consent is not required for them by law.
- Analytics — optional, and off unless you turn it on.
We have deliberately not created marketing or advertising categories, because we do not use any such technology.
3. Strictly necessary
These keep you signed in, keep your account secure, and remember the choices you make about cookies. Blocking them will break sign-in and checkout.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
sb-<project>-auth-token (may be split into.0, .1 parts) | Supabase (first-party cookie) | Keeps you signed in between visits and pages. | Up to 400 days |
sb-<project>-auth-token-code-verifier | Supabase (first-party cookie) | Completes secure sign-in. Removed once sign-in finishes. | Session |
gymcierge_support_session | Gymcierge (first-party cookie, HTTP-only) | Time-limited support access for our staff, created only when a gym explicitly grants it. | 8 hours |
stcm.gymcierge-v1.* | Gymcierge (local storage) | Remembers your cookie choices so we do not ask again. | Until you clear it |
The <project>part of the Supabase cookie names is an identifier for our database, so the full name is fixed for our service but not worth memorising. You can see the exact names in your browser’s storage inspector.
4. Analytics — optional, off by default
We use Google Analytics 4 to understand how Gymcierge is used so we can improve it — which pages people visit, and where they run into trouble.
Google Analytics is not loaded at all unless you accept analytics cookies. If you decline, or simply have not chosen yet, no request is made to Google, no script from Google runs, and none of the cookies below are created. We also set Google Consent Mode to “denied” before any tag is able to run.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics 4 (first-party cookie) | Tells returning visitors apart, without identifying you by name. | 2 years |
_ga_<measurement id> | Google Analytics 4 (first-party cookie) | Keeps track of the current visit. | 2 years |
Analytics data is processed by Google Ireland Limited and Google LLC. If you turn analytics off after having turned it on, we ask Google to stop, delete these cookies, and refresh the page so that analytics stops immediately rather than at your next visit.
5. Local and session storage
These are not cookies. They stay on your device, are never sent to us as identifiers, and exist only so the interface remembers how you left it. They are strictly necessary to the features they serve and do not require consent.
ui_theme— your light or dark preference in the dashboard.preferredCurrency— the currency you chose to see prices in.gymcierge.active-member-gym— which gym you are currently viewing, if you belong to more than one.coach-schedule-scope-v1,schedule-filters-<gym>,schedule-manager-tip-<gym>— schedule view, filters, and a dismissed tip.coach_recent_exercises,recentExerciseSearches,pendingExercise— recently used exercises and searches, and an exercise carried between two pages while you build a workout.aiInsightsExpanded,programme-<id>-collapsed-weeks— which panels you left open or collapsed.gym-validate-kiosk-<gym>— whether an entry scanner is in kiosk mode.
Clearing your browser’s site data removes all of these.
6. Third parties
Payments
Payments are taken on Stripe’s own hosted checkout and billing pages. Stripe’s JavaScript does not run on Gymcierge pages, and Stripe sets no cookies on our site. Any cookies Stripe sets while you are on its pages — used for fraud prevention and to complete your payment — are governed by Stripe’s policy, not this one.
File uploads
When a signed-in user uploads a photo or video, we load an upload tool from Cloudinary. It loads only at the moment you choose to upload something, never on public pages.
Fonts on gym and coach pages
Some public gym and coach pages load their fonts from Google’s font service so each business can use its own typeface. This sets no cookies, but it does mean Google receives your IP address when the font is requested. We are reviewing hosting these fonts ourselves.
What we do not use
No advertising or conversion pixels, no social media trackers, no session replay or heatmapping, no A/B testing tools, no chat or support widget, and no third-party error-tracking service that stores an identifier on your device.
7. Changing your mind
You can change your choice whenever you like, and withdrawing consent is as easy as giving it. Use this control, or the Cookie preferences link in the footer of any page:
Turning analytics off refreshes the page so that analytics stops straight away, and deletes the analytics cookies described above.
You can also block or delete cookies in your browser settings. Bear in mind that blocking strictly necessary cookies will stop you from signing in.
8. Changes to this policy
If we add a technology, or change what an existing one is used for, we will update this page. Where the change materially affects what you agreed to, we will ask you to make a fresh choice rather than relying on your previous one.
This is version 1 of our cookie choices, last updated 23 August 2026.
9. Contact
Questions about cookies or anything else in this policy: contact@gymcierge.com. Your wider data rights, and how to exercise them, are set out in our Privacy Policy.