Cookie Policy

This Cookie Policy explains how FitTrainr uses cookies and similar technologies on our website (https://app.fittrainr.com) and web application (https://fittrainr.com). It complements our Privacy Notice.

We use cookies for three purposes only: purposes that are strictly necessary to operate the Service; Meta's advertising cookies (section 2.3) on the public marketing website and two app sign-up pages, only if you opt in; and first-party ad attribution (section 2.4) — one cookie on the app domain and one local-storage entry on the marketing website — that talks to no one but us and is switched off by Global Privacy Control. We do not use third-party analytics scripts or social media trackers.

1. What Are Cookies?

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work, to make them work more efficiently, and to provide reporting information to the site operator. We also treat browser local storage and session storage as "cookie-like" technologies for the purposes of this policy.

2. Cookies We Use

2.1 Strictly necessary

These cookies are required for the Service to function. They cannot be disabled in our systems without breaking sign-in or session management.

• Session cookies — keep you signed in for the duration of your visit and across visits, until you sign out.
• CSRF tokens — protect form submissions and server actions from cross-site request forgery.
• Authentication state — set by our identity provider (Firebase Authentication) to remember which sign-in method you used and to refresh your session safely.

2.2 Functional

• Preferences — remember your timezone, unit system (metric vs. imperial), dismissed in-app prompts, your theme choice, and your cookie-consent choice itself (stored in browser local storage so we do not keep asking).

2.3 Advertising cookies (opt-in only)

These are off by default and are set only after you opt in. They can exist in exactly two places: on the public marketing website (https://app.fittrainr.com), if you accept the consent banner there; and on two sign-up pages of the app (https://fittrainr.com) — /register and /select-plan — if you accept the app's separate advertising consent. They never appear anywhere else in the app. If you never opt in, the advertising script is never even downloaded — there is nothing to "not fire"; it simply is not there.

• _fbp — set by the Meta Pixel once you opt in. A random browser identifier that Meta uses to measure our ads and to show FitTrainr ads to people who visited us. Expires after about 90 days.
• _fbc — set only if you arrive through a Meta ad link and have opted in. Stores the ad-click identifier from that link so the visit can be attributed to the ad. Expires after about 90 days.

The fbclid URL parameter. Links in Meta ads carry an extra URL parameter called fbclid — an ad-click identifier that Meta appends before you ever reach our site. It is not a cookie, and we do nothing with it unless you have opted in: only then does the pixel read it (and store it in _fbc).

You can withdraw consent at any time — for this website on Your Privacy Choices (turning it off stops the pixel and deletes these cookies from this site), and for the two app pages through the app's own advertising-consent setting. If your browser sends the Global Privacy Control signal, advertising stays off automatically on both, regardless of any banner. For exactly what the pixel shares and with whom, see the Advertising section of the Privacy Notice.

2.4 First-party ad attribution

When you arrive at the app (https://fittrainr.com) from one of our own Google ads, our server sets a single first-party cookie so that, if you go on to sign up as a coach, we can tell Google which ad worked. It is not set by any third-party script, no script can read it, and it is sent only to our own servers — never to Google by your browser.

• gl_ads_click — first-party, set by our server only when the address of the page you land on carries a Google ad-click identifier (gclid, gbraid, or wbraid). Stores that identifier and the campaign (UTM) parameters from the link. httpOnly (invisible to scripts), Secure, SameSite=Lax. Expires after 90 days. Used for one purpose: attributing a coach sign-up or purchase to the ad that brought them — see the Advertising section of the Privacy Notice for the conversion report this feeds and exactly what it does and does not contain.

It is never set when your browser sends the Global Privacy Control signal, and never set on the consumer-facing areas of the app (client join links, public forms, client and lead pages, and the blog). Opting out of "sharing" on Your Privacy Choices deletes the stored ad-click identifiers, after which no conversion is reported.

Our ads usually bring you to the marketing website (https://app.fittrainr.com) first. So that an ad can still be credited if you go on to sign up, the website keeps one entry in your browser's local storage. It is not a cookie, and no third-party script is involved.

• ft-attribution-v1 — first-party, written by our own code only when the address of the page you land on carries campaign (UTM) parameters or a Google ad-click identifier (gclid, gbraid, or wbraid). Stores those values and the date they were first seen. Your browser never sends it anywhere by itself: when you click a link from the website to the app, the stored values are added to that link, which is how the app receives them (and may then set gl_ads_click as described above). Kept for 90 days.

It is never written when your browser sends the Global Privacy Control signal, and it is removed if it is already there. Clearing your browser's site data for https://app.fittrainr.com removes it at any time.

2.5 What we do not use

• No analytics cookies, first-party or third-party (no Google Analytics, no Hotjar).
• No social media tracking buttons that phone home before you click.
• No fingerprinting beyond what is required for fraud detection on payments (handled by Stripe within their own consent boundary).
• No advertising scripts anywhere unless you have opted in — and inside the app, nowhere beyond the two sign-up pages named in section 2.3, opt-in or not. The only things that do not wait for an opt-in are the first-party attribution cookie and local-storage entry in section 2.4 — they talk to no one but us, and Global Privacy Control switches them off.

3. Managing Cookies and Your Consent

You can configure your browser to refuse cookies or to alert you when cookies are being sent. If you reject the strictly necessary cookies above, however, parts of the Service will not work — most notably, you will not be able to sign in.

On the marketing website, a consent banner appears on your first visit and asks whether we may set the advertising cookies described in section 2.3. It is a genuine opt-in: "off" is the default, both answers take one click, and your choice is remembered so the banner does not keep reappearing. You can change your answer at any time on Your Privacy Choices. The app asks its own, separate advertising-consent question before the pixel can run on its two sign-up pages, and that choice is managed in the app.

The strictly necessary and functional cookies above do not require consent: under the EU ePrivacy Directive and similar laws, consent is not needed for cookies that are strictly necessary to provide a service you explicitly requested.

We also honor Global Privacy Control: if your browser sends the signal, we treat it as a binding "no" for the advertising cookies in section 2.3 and the attribution cookie and local-storage entry in section 2.4 alike — no banner interaction needed, and it overrides any earlier opt-in.

4. Changes to This Policy

When we introduced the advertising category in v0.4, we did what the previous version of this policy promised: the policy was updated and the opt-in consent mechanism shipped before anything was enabled. We will hold the same line for any future category of cookie. Material changes are tracked in our legal changelog.

5. How to Contact Us

Questions about cookies? Email support@fittrainr.com.