Cookie and Browser Storage Policy

Cookies and local or session storage are browser mechanisms; server application data is separate. Browser state does not become ownership, billing, plan, workout-history or privacy-request authority.

Gymanai uses Supabase authentication with a cookie-backed browser session for secure sign-in, verification, recovery and server rendering. A locale cookie keeps server and browser language aligned. These mechanisms are required for requested account and language behavior and are not advertising identifiers.

Reviewed interface preferences such as sidebar_state may be stored locally. A short-lived opaque checkout idempotency key may be stored in session storage so an interrupted attempt can safely resume. It contains no payment details, checkout token, portal token or entitlement authority.

A narrow, owner-scoped local reliability envelope may contain bounded workout input and outbox state, current exercise position and an absolute rest deadline. It expires, is cleared on account transitions and never replaces completed server history.

Vercel Analytics for site/product usage measurement and Vercel Speed Insights for web-performance measurement run behind a production-only environment boundary. Local tests do not establish whether the final provider and deployment configuration sets cookies. This evidence does not decide whether the production measurement layer requires consent or preference controls and does not authorize advertising pixels.

Browser controls can delete or block storage, but essential features may then fail. Gymanai does not present a fake cookie-preference center before the required legal and provider decisions are verified. Provider disclosure remains [PRE-LAUNCH TODO: legally reviewed provider/subprocessor and transfer disclosure]. Contact gymanai.team@gmail.com and review the Privacy Policy.