GymGrid Cookie Policy

Last updated: 2026-05-13 Effective date: 2026-05-13

This Cookie Policy describes the cookies and similar technologies that GymGrid ("we," "us," "our") uses on our public website and the Service. It is incorporated into and governed by the GymGrid Privacy Policy.

1. Scope and relationship to the Privacy Policy

This Cookie Policy is the detailed companion to Section 8 of our Privacy Policy. If anything in this document conflicts with the Privacy Policy, the Privacy Policy controls.

2. The two categories

2.1 Strictly necessary

These are required for the Service to function. They cannot be disabled while using the Service.

2.2 Analytics

Off by default. When you opt in, we may collect aggregated, de-identified usage measurement (e.g., which pages are visited most, where users drop off in onboarding) to improve the Service.

Our analytics provider is PostHog, hosted in the European Union. It loads only if you allow analytics — by choosing "Accept" on the cookie banner or turning analytics on under "Cookie preferences" in the footer. If you decline, or never make a choice, PostHog does not load and nothing is sent. What we measure: which pages get visited and how far new gyms get through the onboarding steps, tied to a random account id — never your name or email. We do not collect message content, member or athlete data, or anything you type into GymGrid. If we change providers or expand what we measure, we will update this page and the Privacy Policy first.

3. What stays on regardless of your choice

We use Sentry to detect and diagnose errors in the Service. Sentry processing happens regardless of your cookie-consent choice. We rely on PIPEDA's legitimate-interest basis for this because error monitoring is necessary for security and reliable operation.

Sentry receives stack traces, the URL where the error occurred, and browser metadata. It does not receive your IP address (we have "Prevent Storing of IP Addresses" enabled at the organization level). Session Replay is disabled. Today Sentry sets no cookies and writes nothing to your browser's local storage.

Forward-note: if we enable Session Replay in the future (e.g., for a one-off investigation), Session Replay moves under the Analytics category and becomes consent-gated. Enabling Session Replay is a coordinated update to this document, the Privacy Policy, and a bump of CURRENT_CONSENT_VERSION so existing consent records are re-prompted.

4. The consent record

When you make a choice in the cookie banner, we store a small JSON record in your browser's local storage under the key gymgrid-cookie-consent. The record contains:

• Schema version (1).
• essential: true (always — required for the Service).
• Your analytics choice (true or false).
• ISO 8601 timestamp of when you made the choice.
• How you made it (Accept all, Reject all, or Save custom).

This is a local record of when you made your choice, sufficient for our current scope because no analytics SDK is flowing yet. Server-side consent logging is a future question that we will address if and when there is actual data to gate.

5. How to change your preferences

You can change your cookie preferences at any time:

1. Click Cookie preferences in the footer of any public page on our website.
2. The banner re-opens in customize mode with your current choices.
3. Adjust the Analytics toggle and click Save preferences.

You can also clear your browser's local storage for this site — the next page load will show the cookie banner again so you can make a fresh choice.

We do not currently respond to Do Not Track browser signals; there is no settled industry standard for them.

6. Third-party services that may set their own technologies

The third-party services listed in Privacy Policy §6.1 support the Service. Of those:

• Supabase — sets the authentication-related storage entries described in Section 2.1.
• Vercel — hosts the application. Does not set first-party tracking cookies in our current configuration.
• Stripe — used for subscription billing. Stripe-set cookies appear only on the checkout page when billing is live (post-Gate-3).
• Resend, Anthropic, Sentry — server-side processors; do not set browser cookies or local storage on your visit.

When we add an analytics provider, this list will be updated and the new vendor's storage items will appear in Section 2.2.

7. Children

The Service is not designed to collect or store information about athletes, including minor athletes. Section 13 of the Privacy Policy covers our commitments around minor data in full.

8. Changes to this policy

We may update this Cookie Policy from time to time. For material changes (new category of technology, new analytics vendor), we will provide at least fifteen (15) days' notice by email and/or in-app notice, consistent with Privacy Policy §14.

9. Contact

For questions about this Cookie Policy, contact our Privacy Officer:

Email: [email protected] Mailing address: 12 Groat Crest Spruce Grove, AB T7X 1Z7 Canada

10. Effective date and versioning