Cookie Policy
Version 2026-08-draft · Last updated 2 August 2026 · Effective [TO CONFIRM: effective date — set at launch]
Every cookie and similar technology Open Gym uses, what it does, and how long it lasts. Only the strictly necessary ones are set without asking you first.
1. What cookies are
A cookie is a small text file stored on your device by your browser. We also use comparable technologies — such as values held in your browser's local storage — and everything in this policy applies to those too.
Under Hungarian Act C of 2003 on electronic communications (§155) and the ePrivacy Directive, we may store strictly necessary cookies without consent, but we need your consent before setting any others. Where a cookie also involves processing personal data, the Privacy Policy explains that processing.
2. Strictly necessary cookies
These are required to operate the Platform and are set without consent. You cannot turn them off and still use the site.
| Name | Purpose | Lifetime | Set by |
|---|---|---|---|
og_visitor | A random identifier that lets us keep your shopping cart attached to your browser before and after you sign in. Contains no personal data itself. | 1 year | Open Gym (httpOnly) |
og_ref | Records which member referred you, so referrals are credited correctly if you sign up. Set only if you arrive via a referral link, and only the first time. | 90 days | Open Gym (httpOnly) |
better-auth.session_token | Keeps you signed in across pages and subdomains. | Session / until sign-out | Open Gym (httpOnly) |
PARAGLIDE_LOCALE | Remembers whether you chose English or Hungarian. | 1 year | Open Gym |
Local storage: og_token | Holds your sign-in token for the app on this device, so API requests are authenticated. | Until sign-out | Open Gym |
usprivacy | Stores a privacy-signal string alongside your cookie choice. | 1 year | iubenda (consent manager) |
_iub_cs-* | Records the cookie choice you made, so we do not ask again on every visit. Set once you express a preference — the record of your consent is itself strictly necessary. | 1 year | iubenda (consent manager) |
Stripe sets its own cookies on its hosted checkout page for fraud prevention and payment security. Those are governed by Stripe's privacy policy.
3. Analytics cookies (consent required)
These are set only after you consent, and you can withdraw consent at any time.
| Name | Purpose | Lifetime | Provider |
|---|---|---|---|
ph_* | Product analytics — which pages and features are used, and session replay, so we can find and fix problems. | 1 year | PostHog (EU hosting) |
We do not use advertising or cross-site tracking cookies, and we do not share cookie data with advertising networks.
[TO CONFIRM: Google Analytics is planned for marketing analytics but is not integrated today, so its _ga cookies are deliberately not listed. Add them here (and to the Privacy Policy recipients table) before GA goes live.]
4. Managing your choices
When you first visit we ask whether you accept analytics cookies, through a consent banner provided by iubenda. Declining is as easy as accepting, and declining does not restrict your use of the Platform. You can change your mind at any time by reopening the preferences panel from the banner, and your choice is stored on that device.
[TO CONFIRM: analytics loading is not yet gated on the iubenda consent signal — the PostHog tracker currently initialises on page load regardless of the choice made in the banner (apps/platform/src/routes/+layout.svelte). This section describes the required behaviour; it must be true in production before this policy is published.]
5. Browser controls
Every major browser lets you block or delete cookies in its settings. Blocking strictly necessary cookies will break sign-in and the cart. You can also opt out of Google Analytics across all sites with Google's opt-out browser add-on.
6. Changes
We update this policy whenever we add or remove a cookie. The version and date at the top of the page tell you which version is current.
7. Contact
Questions about cookies: privacy@opengym.in.