Cookie overview
Last checked against the app’s code on
This page lists every cookie and every other item the app stores in your browser. There are only a few, and all of them are needed for the app to work.
Why there is no cookie banner
We only use cookies and storage that are strictly necessary to provide the app you asked for: keeping you logged in, remembering the theme you picked, and letting the app be installed, send reminders and work offline.
Under the EU ePrivacy rules (Article 5(3) of the ePrivacy Directive) and the Dutch Telecommunications Act (Telecommunicatiewet, article 11.7a), cookies and storage that are strictly necessary for a service you explicitly requested do not need your consent. That is why the app does not show a cookie banner.
You can still block or delete them in your browser settings. If you block the session cookie you cannot log in, and without the theme cookie your theme choice is not remembered.
Cookies and storage used by the app
| Name | Purpose | Set by | Duration | Type | Strictly necessary |
|---|---|---|---|---|---|
__Host-session (Called “session” in local development) | Keeps you logged in. Contains a random code; the server stores only a hash of it. Scripts cannot read it (HttpOnly), it is only sent over HTTPS (Secure) and not sent with requests from other sites (SameSite=Lax). | This app (first party) | Up to 90 days. Your login ends earlier after 30 days without use, and the cookie is removed when you log out. | Cookie | Yes |
theme | Remembers whether you chose a light or dark theme, so pages load in the right colours. Only set when you change the theme yourself. Contains only “light” or “dark”. | This app (first party) | 1 year | Cookie | Yes |
pwa-intro-dismissed | Remembers that you closed the “Add the app to your home screen” explanation on the login page, so it does not open every time. Contains only the value “1”. | This app (first party) | Until you clear this site’s data in your browser | Local storage | Yes |
forgot-dismissed:… (One per dismissed day, for example “forgot-dismissed:2026-10-10”) | Remembers that you tapped “Not now” on the “Forgot yesterday?” card for that day, so it is not shown again on this device. Contains only the value “1”. It stays on this device and is never sent to us. | This app (first party) | Until you clear this site’s data in your browser | Local storage | Yes |
gym-draft:… (One per exercise and day, for example “gym-draft:<exercise>:2026-10-10”) | Keeps sets you typed into the gym logging sheet but did not save yet, so closing the sheet by accident loses nothing. It stays on this device and is never sent to us; it is removed when you save. | This app (first party) | Until you save those sets, or clear this site’s data | Local storage | Yes |
gym-outbox:… (One per account on this device, named after your account’s internal number) | Gym changes you made without a connection (sets, deleted sessions, rest days and notes), kept on this device until they can be sent. They are sent as soon as the app is open and online, and removed once they arrive. | This app (first party) | Until the changes are synced, or you clear this site’s data | Local storage | Yes |
health-sync:… (Only in the Sunvia mobile app with step or weight syncing on; one per account on the phone) | Remembers when the app last synced with your phone’s health app and the daily values it sent, so each sync only reads the days since then and only sends days that changed. | This app (first party) | Until you remove the app or its data; values older than the last sync are dropped | Local storage | Yes |
app-push-token (Only in the Sunvia mobile app with notifications on) | The notification address Firebase Cloud Messaging gave this app, so the app knows notifications are on here and can turn them off again. | This app (first party) | Until you turn notifications off on this phone, log out, or remove the app | Local storage | Yes |
sunvia-offline-v3 | A copy of the offline page (/offline.html, its stylesheet and the app icon), shown when you open the app without an internet connection. Pages with your data and API responses are never cached. Contains no personal data. | This app’s service worker (first party) | Until the app switches to a newer version of this cache, or you clear this site’s data | Cache Storage | Yes |
| Cloudflare Turnstile (Names chosen by Cloudflare) | Bot protection (the “Security check”). Cloudflare may store data in cookies or local storage inside its own security-check frame to complete the check. This app does not read it. Cloudflare states that Turnstile is not used for advertising or tracking across websites. Only loaded on the sign-up and forgot-password forms, and on the login form after several failed attempts. | Cloudflare (challenges.cloudflare.com, third party) | Set and removed by Cloudflare; short-lived | Cookie or local storage | Yes |
Other browser storage
Installing the app and turning on notifications also makes your browser store the items below. They are not cookies, but we list them for completeness.
| Name | Purpose | Set by | Duration | Type | Strictly necessary |
|---|---|---|---|---|---|
| Service worker (/sw.js) | A small script your browser keeps for this site, so the app can be installed on your home screen, receive notifications and show an offline page. Contains no personal data. | This app (first party) | Until you uninstall the app or clear this site’s data | Browser storage | Yes |
| Push subscription | Lets your browser’s push service (Apple, Google, Mozilla or Microsoft, depending on your browser) deliver reminders to this device. Only created when you turn on notifications. The push address and its keys are also stored on our server; see the privacy notice. | Your browser and its push service | Until you turn off notifications, log out on this device, remove the device in Settings, or the browser ends it | Browser storage | Yes |
What we do not use
- No analytics or statistics tools.
- No advertising and no tracking pixels.
- No social media buttons, logins or embedded content.
- No third-party fonts: the app uses your device’s own fonts.
- No third-party scripts, apart from the Cloudflare security check on the forms listed above.
How to remove them
Logging out removes the session cookie. To remove everything, clear this site’s data in your browser settings, or uninstall the app from your home screen.
Keeping this list up to date
This list is kept in sync with the app’s code and checked whenever something that stores data in your browser changes.
If we ever want to add a cookie or storage item that is not strictly necessary, for example for statistics, it would only be loaded after you agree to it in a consent banner, and this page would be updated first.
For how we handle your personal data, see the privacy notice.