Cookie Policy

This Cookie Policy explains how FitTrainr uses cookies and similar technologies on our website (https://app.fittrainr.com) and web application (https://fittrainr.com). It complements our Privacy Notice.

We use cookies for two purposes only: purposes that are strictly necessary to operate the Service, and — on the public marketing website only, and only if you opt in — Meta's advertising cookies (section 2.3). We do not use third-party analytics scripts, cross-site tracking beyond that one opt-in cookie, or social media trackers.

1. What Are Cookies?

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites work, to make them work more efficiently, and to provide reporting information to the site operator. We also treat browser local storage and session storage as "cookie-like" technologies for the purposes of this policy.

2. Cookies We Use

2.1 Strictly necessary

These cookies are required for the Service to function. They cannot be disabled in our systems without breaking sign-in or session management.

• Session cookies — keep you signed in for the duration of your visit and across visits, until you sign out.
• CSRF tokens — protect form submissions and server actions from cross-site request forgery.
• Authentication state — set by our identity provider (Firebase Authentication) to remember which sign-in method you used and to refresh your session safely.

2.2 Functional

• Preferences — remember your timezone, unit system (metric vs. imperial), dismissed in-app prompts, your theme choice, and your cookie-consent choice itself (stored in browser local storage so we do not keep asking).

2.3 Advertising cookies (opt-in only)

These exist only on the public marketing website (https://app.fittrainr.com), are off by default, and are set only after you opt in through the consent banner. They never appear inside the app. If you never opt in, the advertising script is never even downloaded — there is nothing to "not fire"; it simply is not there.

• _fbp — set by the Meta Pixel once you opt in. A random browser identifier that Meta uses to measure our ads and to show FitTrainr ads to people who visited this site. Expires after about 90 days.
• _fbc — set only if you arrive through a Meta ad link and have opted in. Stores the ad-click identifier from that link so the visit can be attributed to the ad. Expires after about 90 days.

The fbclid URL parameter. Links in Meta ads carry an extra URL parameter called fbclid — an ad-click identifier that Meta appends before you ever reach our site. It is not a cookie, and we do nothing with it unless you have opted in: only then does the pixel read it (and store it in _fbc).

You can withdraw consent at any time on Your Privacy Choices — turning it off stops the pixel and deletes these cookies from this site. If your browser sends the Global Privacy Control signal, advertising stays off automatically, regardless of the banner. For exactly what the pixel shares and with whom, see the Advertising section of the Privacy Notice.

2.4 What we do not use

• No analytics cookies, first-party or third-party (no Google Analytics, no Hotjar).
• No social media tracking buttons that phone home before you click.
• No fingerprinting beyond what is required for fraud detection on payments (handled by Stripe within their own consent boundary).
• Nothing advertising-related anywhere unless you have opted in — and never inside the app, opt-in or not.

3. Managing Cookies and Your Consent

You can configure your browser to refuse cookies or to alert you when cookies are being sent. If you reject the strictly necessary cookies above, however, parts of the Service will not work — most notably, you will not be able to sign in.

On the marketing website, a consent banner appears on your first visit and asks whether we may set the advertising cookie described in section 2.3. It is a genuine opt-in: "off" is the default, both answers take one click, and your choice is remembered so the banner does not keep reappearing. You can change your answer at any time on Your Privacy Choices.

The strictly necessary and functional cookies above do not require consent: under the EU ePrivacy Directive and similar laws, consent is not needed for cookies that are strictly necessary to provide a service you explicitly requested.

We also honor Global Privacy Control: if your browser sends the signal, we treat it as a binding "no" for advertising cookies — no banner interaction needed, and it overrides any earlier opt-in.

4. Changes to This Policy

When we introduced the advertising category in v0.4, we did what the previous version of this policy promised: the policy was updated and the opt-in consent mechanism shipped before anything was enabled. We will hold the same line for any future category of cookie. Material changes are tracked in our legal changelog.

5. How to Contact Us

Questions about cookies? Email support@fittrainr.com.