Cookie Policy
Table of Contents
1. What this policy covers
This policy covers everything HAVYT stores on, or reads from, your device:
- the HAVYT app, the web app at app.havyt.app and the iOS app (which embeds the same web app), and
- the HAVYT website, the marketing/landing pages at havyt.app and www.havyt.app.
The two behave differently, so they are described separately below. For what happens to data after it leaves your device, see the HAVYT Privacy Policy.
2. Cookies, local storage and similar technologies
- Cookies are small text files a website stores in your browser.
- localStorage stores key–value data persistently in your browser (no expiry; removed when you clear site data or we remove it).
- IndexedDB stores structured data for offline use.
- Service worker caches store app files (HTML/CSS/JS/images) so the app loads fast and works offline.
Under Spanish law (Art. 22.2 LSSI-CE) and the GDPR, storage that is strictly necessary to provide a service you asked for needs no consent; everything else does.
3. The HAVYT app (app.havyt.app / iOS)
The app uses no advertising cookies, no third-party tracking cookies, and no third-party analytics SDKs. Everything below is functional and strictly necessary for features you actively use.
3.1 Storage inventory (app)
| Purpose | Provider | Duration | Type | Consent needed |
|---|---|---|---|---|
| Authentication session token, keeps you signed in | Supabase (our infrastructure) | Until sign-out | Essential | No |
| Your language choice (en/de/es/pl) | HAVYT | Persistent | Preference (functional) | No |
| Metric / imperial units | HAVYT | Persistent | Preference (functional) | No |
| Dark / light theme | HAVYT | Persistent | Preference (functional) | No |
| Your in-progress workout session, so it survives a reload or crash | HAVYT | Until the session is finished or discarded | Essential | No |
| AS Mode toggle state | HAVYT | Persistent | Preference (functional) | No |
| Consent flags, remembers which consents and legal versions you have accepted, so we don't re-ask | HAVYT | Persistent | Essential (consent proof) | No |
| Other functional flags (e.g. one-time UI states such as "intro seen") | HAVYT | Persistent | Preference (functional) | No |
The exact technical key names may change between app versions; the categories and purposes above stay accurate, and no entry is ever used for advertising or cross-site tracking.
3.2 IndexedDB and service worker
The app uses IndexedDB and a service worker cache for offline functionality (PWA). These store app data and static assets locally; they contain no third-party trackers, are controlled by HAVYT, and are cleared when you clear site data or delete your account.
3.3 Native iOS app
The iOS app wraps the same web app; the storage above lives inside the app's container and is removed when you delete the app. The iOS app additionally holds a push notification token if you enable notifications (see Privacy Policy, Section 4.15).
4. The HAVYT website (havyt.app / www.havyt.app)
The website uses HAVYT's own consent manager. It replaced Cookiebot, so no third-party consent platform runs on the site and no consent-platform cookie is set by an outside provider.
Current state: no analytics or advertising script is loaded before you choose. There is no Meta Pixel, no TikTok pixel, no Microsoft or Bing tag, and no Google Tag Manager container anywhere on the site. Google Analytics 4 is available but is not requested from Google at all until you grant the Analytics category, which means no Google script, no Google cookie and no request to a Google measurement domain happens first. Google Ads measurement behaves the same way and is only ever contacted if the Marketing category is granted.
Your choice is stored on your own device (browser local storage, key havyt.website.consent), not in a cookie, and not on our servers. Withdrawing consent deletes the Google cookies listed below immediately.
4.1 Storage inventory (website)
| Name | Provider | Purpose | Duration | Type | Consent needed |
|---|---|---|---|---|---|
havyt.website.consent (local storage) |
HAVYT | Stores your cookie choices so the banner is not shown again | Until you clear site data or withdraw consent | Essential | No (it records consent) |
havyt.website.locale (local storage) |
HAVYT | Remembers your language (English, German, Spanish, Polish) | Until you clear site data | Functional, strictly necessary to honour your own setting | No |
havyt.website.attribution (session storage) |
HAVYT | Remembers which campaign link brought you to the site (utm_source and similar), so a signup can be credited to it. Cleared when you close the tab. Only read if you grant Analytics. | Session | Functional | Only used with Analytics consent |
_ga, _ga_<id> |
Google Analytics 4 (Google Ireland Ltd) | Distinguishes visitors and sessions so we can see which pages are read | Up to 2 years (set by Google) | Analytics | Yes, set only after you grant Analytics |
_gcl_au |
Google Ads (Google Ireland Ltd) | Measures whether an ad click led to a signup | Up to 90 days (set by Google) | Marketing | Yes, set only after you grant Marketing |
Google Consent Mode is used, so even after a Google tag loads it is told exactly which of analytics_storage, ad_storage, ad_user_data and ad_personalization you allowed. All four start denied.
No health data is ever sent to Google. Pain scores, symptoms, BASDAI values, medication, flare state and anything you write in the HAVYT app stay inside the app and are never shared with Google Analytics or Google Ads. The website measures page views and marketing actions such as newsletter and waitlist signups only.
4.2 Newsletter form
Subscribing to the newsletter stores no tracking cookies; your email is processed as described in the Privacy Policy (double opt-in via a confirmation email).
5. Third-party content and fonts
- Google Fonts: the app and website currently load fonts from Google's servers, which transmits your IP address to Google when a page loads. We are moving fonts to self-hosting to eliminate this transmission.
- Exercise media (GIFs/thumbnails) load from our CDN at media.havyt.app (Bunny.net, EU), your IP is technically transmitted to deliver the file; no cookies are set.
- Map tiles (GPS routes in the app) load from a map tile provider; your IP and the requested tile area are transmitted; no cookies are set.
6. How to change or withdraw your choices
Website: the Cookie settings link in the footer of every page reopens the preference manager. You can switch individual categories on or off, or withdraw consent entirely, with immediate effect: withdrawing stops the Google tag, deletes the Google cookies it set, and brings the banner back. Withdrawing is exactly as easy as accepting.
App: because the app sets only strictly necessary and functional storage, there is nothing to consent to, but you can remove everything:
- Chrome: Settings → Privacy and security → Third-party cookies / Site settings → search "havyt" → delete.
- Safari (iOS): Settings → Safari → Advanced → Website Data → search "havyt" → delete. Safari (macOS): Safari → Settings → Privacy → Manage Website Data.
- Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data → search "havyt".
- iOS app: deleting the app removes all local storage.
Note: clearing storage signs you out and removes offline data; your account data on our servers is unaffected (delete it via account deletion, see Privacy Policy, Section 14, and Data Deletion).
7. Legal basis
Strictly necessary storage relies on Art. 22.2 LSSI-CE (exempt from consent) with the underlying processing based on Art. 6(1)(b) GDPR. Functional preference storage serves only features you actively configure. Analytics and marketing storage on the website relies on your prior consent (Art. 22.2 LSSI-CE, Art. 6(1)(a) GDPR), collected through HAVYT's own consent manager before any Google script is requested.
8. Changes to this policy
We will update this policy before any new storage technology, analytics tool or marketing tag is introduced. The "Last Updated" date and version number reflect the current state. Version 2.2 replaces Version 1.0 (March 6, 2026), which referenced German law (TTDSG); Spanish law (LSSI-CE) now applies.
9. Contact
Questions about this policy: support@havyt.app.
Related documents: Privacy Policy · Aviso Legal / Legal Notice · Terms of Service · Data Processing