Cookie and Device Storage Policy

Supabase authentication cookie names include the project identifier and may be chunked when a token is long, so the browser may show more than one physical cookie. They contain session material, not your plaintext password. Security-flow and recovery cookies are HttpOnly and are limited to the relevant callback or reset path where possible.

These values stay in that browser and do not identify you to an advertising or analytics provider. Active-workout keys include a random session identifier but not exercise notes, nutrition entries, photos, email, or password. Withdrawing health consent clears relevant workout-state keys on the device that processes the withdrawal.

UK PECR permits storage or access that is strictly necessary to provide a service the user has requested. Authentication, callback security, recovery proof, the local calendar day, and continuity for an active workout are used only for those requested functions. Appearance and rest preferences are stored only after, or to remember, a choice you make and are described here with a simple way to reset them. None is used to track people across services. On that current implementation, a general cookie-consent banner would not add a real choice.

If Ordivum adds non-essential analytics, advertising, attribution, or similar technology, it will be off until any required consent is obtained and this policy will be updated first.

You can sign out to end the current authenticated session. Browser settings can remove or block cookies and site data. Blocking authentication or security-flow cookies prevents sign-in, signup confirmation, or password recovery from working correctly. Clearing local storage resets the theme, rest settings, and active-workout timing state; it does not delete the workout records already synchronised to your account. Settings in the app let you change appearance and rest choices without clearing all browser data.

The iOS app does not use browser cookies for its native session. It stores authentication state, an offline ledger cache, queued changes, and device settings using iOS-protected storage. The Privacy Notice explains retention and device-removal controls for that cache.