Cookie Policy

A cookie is a small file a site stores in your browser and reads back on later requests. Related technologies — local storage, session storage and service workers — do a similar job with different mechanics. This policy covers all of them, because what matters is what is stored and why, not which browser API is used.

Everything described below is first-party: it is set by PHYSIOATHLETX for PHYSIOATHLETX. Nothing here follows you to other websites.

When you sign in, our authentication provider (Supabase) sets first-party session cookies in your browser. They hold the tokens that prove you are signed in, so that every screen you open loads your account instead of asking you to sign in again.

• Purpose: keeping you signed in and protecting your session.
• Set by: Supabase authentication, as a first-party cookie on this site.
• Contains: session and refresh tokens. No goal, no conditions, no check-ins, no logs — no health information of any kind.
• Lifetime: the session cookie lasts for your signed-in session; the refresh cookie persists until it expires or you sign out.

These cookies are strictly necessary. They cannot be turned off without breaking sign-in: block or delete them and the app will sign you out and return you to the login screen. We do not ask for consent for them, because the service you asked for cannot be delivered without them.

We use PostHog for first-party product analytics. It stores a pseudonymous identifier in your browser using local storage and a cookie, so that a sequence of screens in one visit can be recognized as one session and we can see where people get stuck.

• Purpose: screen-level funnel analytics — which screens are opened, which flows are finished, where people drop off.
• Set by: PostHog, loaded first-party and acting as our processor.
• Contains: a pseudonymous identifier and neutral event names such as "onboarding_completed".
• Lifetime: persists between visits until you clear site data for this site.

Health-adjacent parts of a URL are masked before anything is sent: a path pointing at a specific condition or equipment page is generalized to a placeholder, and query strings are never transmitted. No goal names, condition names, safety-screen answers, check-in scores, weights or calorie targets are ever included in an analytics event. The result is a picture of how the app is used, with no health values in it.

This is analytics, not advertising. The data is not used to build an advertising profile, is not combined with data from other sites, and is not sold or shared for cross-context behavioral advertising — see our Do Not Sell or Share My Personal Information page.

There are no advertising cookies, no retargeting tags, no ad pixels and no third-party cross-site trackers on any authenticated screen in PHYSIOATHLETX. We do not embed social network trackers, and we do not let third parties read our cookies.

Marketing pixels would only ever be possible on public marketing pages, never on screens where your health-adjacent information is shown. None is installed today. If that ever changes, we will update this page and our Privacy Policy before it goes live.

PHYSIOATHLETX is a progressive web app, so two more pieces of browser storage are in play. Neither is a tracker: nothing in them is sent to a third party, and neither can identify you across other websites.

• Local storage — your in-progress workout session (which exercise you are on, sets completed, feedback entered) is saved on your own device while you train, so closing the tab or losing signal does not lose the session. It is cleared when the session is submitted, and you can clear it yourself by clearing site data.
• Service worker — a small script the browser installs so the app can be added to your home screen, show an offline page when you have no connection, and receive the reminder notifications you choose to enable. Reminder payloads are always neutral: a short title, a short body and an in-app link, never conditions or any health value. Push reminders require the push subscription your browser issues; you can turn them off in the app or in your browser or device notification settings at any time.

• Browser settings — every major browser lets you block or delete cookies and site data, for all sites or for this one. Look under Privacy, Cookies, or Site settings.
• Clear site data — clearing site data for PHYSIOATHLETX removes the analytics identifier, the saved in-progress session and the cached offline page in one step. Your account and your history stay in your account; only the browser copy is removed.
• Blocking authentication cookies — this signs you out and prevents sign-in. It is the one category the app genuinely cannot work without.
• Blocking analytics only — most browsers and tracker-blocking extensions can block PostHog without touching sign-in. Doing so does not reduce any feature of the app.
• Notifications — revoke notification permission for this site in your browser or device settings, or turn reminders off in your account.
• Uninstalling the app — removing the installed PWA and clearing site data unregisters the service worker and removes its cache.

Deleting browser storage does not delete your account data. To export or erase that, use Account > Download my data and Account > Danger Zone, as described in the Privacy Policy.

If we add, remove or repurpose anything stored in your browser, we will update this page. Material changes are announced in the app or by email before they take effect.

Questions about anything on this page? Email support@physioathletx.com.

TECHFORWARD SOLUTIONS LIMITED
Unit 2A, 17/F Glenealy Tower
No.1 Glenealy, Central
Hong Kong
Company number 76317223
support@physioathletx.com