Ordivum
Cookie and Device Storage Policy
Last updated: 23 July 2026
The website uses only authentication, security-flow, timezone, preference, and active-workout storage. It does not use advertising, analytics, session replay, or cross-site tracking.
1. Cookies
| Cookie or family | Purpose | Duration |
|---|---|---|
| sb-…-auth-token | Supabase session data that authenticates requests and refreshes a signed-in session | Session/configured authentication lifetime; it may be split into numbered chunks |
| ordivum_signup_flow / ordivum_recovery_flow | Binds signup or password-recovery email callbacks to the browser that started the flow | Up to 1 hour; removed when used |
| ordivum_recovery_grant | Proves a password change followed a valid recovery callback, rather than an ordinary signed-in session | Up to 15 minutes; one use |
| tz | Stores the device's IANA timezone so diary days roll over at local midnight | Up to 1 year; refreshed if the timezone changes |
Supabase authentication cookie names include the project identifier and may be chunked when a token is long, so the browser may show more than one physical cookie. They contain session material, not your plaintext password. Security-flow and recovery cookies are HttpOnly and are limited to the relevant callback or reset path where possible.
2. Browser local storage
| Category | Examples | Purpose |
|---|---|---|
| Appearance | theme | Keeps the light, dark, or system choice you selected |
| Rest settings | rest-buzz, rest-target-… | Keeps your device's rest durations and vibration choice |
| Active workout continuity | workout-clock:…, workout-activity:…, workout-autopause:… | Restores clock, pause, and idle state after a refresh or sleeping tab |
These values stay in that browser and do not identify you to an advertising or analytics provider. Active-workout keys include a random session identifier but not exercise notes, nutrition entries, photos, email, or password. Withdrawing health consent clears relevant workout-state keys on the device that processes the withdrawal.
3. Why no consent banner appears
UK PECR permits storage or access that is strictly necessary to provide a service the user has requested. Authentication, callback security, recovery proof, the local calendar day, and continuity for an active workout are used only for those requested functions. Appearance and rest preferences are stored only after, or to remember, a choice you make and are described here with a simple way to reset them. None is used to track people across services. On that current implementation, a general cookie-consent banner would not add a real choice.
If Ordivum adds non-essential analytics, advertising, attribution, or similar technology, it will be off until any required consent is obtained and this policy will be updated first.
4. Your controls
You can sign out to end the current authenticated session. Browser settings can remove or block cookies and site data. Blocking authentication or security-flow cookies prevents sign-in, signup confirmation, or password recovery from working correctly. Clearing local storage resets the theme, rest settings, and active-workout timing state; it does not delete the workout records already synchronised to your account. Settings in the app let you change appearance and rest choices without clearing all browser data.
5. iOS local data
The iOS app does not use browser cookies for its native session. It stores authentication state, an offline ledger cache, queued changes, and device settings using iOS-protected storage. The Privacy Notice explains retention and device-removal controls for that cache.