Cookies Policy

1. What cookies and similar technologies are

A cookie is a small text file a website stores in your browser and receives back on later requests. Similar technologies include local storage and IndexedDB in your browser, and the equivalent storage inside a mobile app. They let a service remember that you are signed in, keep your preferences, and work reliably.

We group what Fitora uses into two kinds: strictly necessary items, without which a service you asked for cannot work, and preferences, which remember choices you made so you do not have to make them again.

2. Cookies Fitora sets

When you sign in to Fitora in a web browser, our server sets two strictly necessary cookies for the fitora.mk domain. Both are HttpOnly (scripts on the page cannot read them), sent only over secure connections, and restricted to requests from Fitora itself (SameSite=Strict).

• token — proves you are signed in on each request and on the live connection used for messages. Expires after 2 hours and is renewed while you use Fitora.
• refreshToken — lets Fitora renew your sign-in without asking for your password again. Sent only to the sign-in renewal address. Expires after 30 days.

Both cookies are deleted when you sign out, or when a coach removes a client's access. The Fitora client app for iPhone and Android does not use these cookies; it keeps its sign-in on the device instead (section 3).

3. Local storage and similar technologies

On this website (fitora.mk):

• fitora-locale — preference. The language you chose in the header, so fitora.mk opens in that language next time. Stored only when you pick a language, and kept until you clear it.

In the coach dashboard (app.fitora.mk):

• fitora.theme — preference. Light, dark, or system appearance.
• fitora.desktop-sidebar-collapsed — preference. Whether the side menu is collapsed.
• fitora.exercise-library.view — preference. Grid or list view in the exercise library.
• emoji-mart.frequently, emoji-mart.last, emoji-mart.skin — preference. Your recently used emoji and skin tone in the emoji picker.
• Browser notifications — strictly necessary, and only if you turn notifications on. Fitora registers a service worker, and Google Firebase Cloud Messaging stores a notification token and installation identifier in your browser's IndexedDB so that Fitora can deliver notifications to this browser.

These preferences stay in your browser until you clear them.

In the client app for iPhone and Android:

• Sign-in — strictly necessary. Your sign-in and renewal tokens, kept on the device until you sign out.
• Push notifications — strictly necessary for notifications. The device's notification token, so Fitora can send notifications you allowed and stop sending them when you sign out.
• Workout in progress — strictly necessary. A snapshot of an unfinished workout, so it can be resumed if the app closes. Removed when the workout ends.
• Personal records and the meal plan you last opened — preferences, kept so the app loads them quickly.
• Health data sync — only if you connect Apple Health or Health Connect. A random identifier for this app installation and the last day synced, so data is not sent twice.

In the client app, items tied to a person are removed or ignored when a different person signs in on the same device, and all of it is removed when you delete the app.

4. Measuring visits without cookies

We count visits to fitora.mk with Cloudflare Web Analytics and Umami. Both are cookieless: they set no cookies, store nothing on your device, and do not follow you across other websites. They tell us which pages are visited, where visitors come from, and which of our buttons are used, in aggregate. The coach dashboard and the client app use no analytics tools.

5. Third-party content and services

Some features load content from other companies. They may set their own cookies or similar technologies under their own policies, which Fitora does not control:

• YouTube — when a coach adds an exercise video from YouTube, it plays in an embedded YouTube player, and YouTube may set cookies when that video loads.
• GIPHY — GIFs in chats and community posts are searched and loaded from GIPHY.
• Cloudflare Turnstile — the spam check on our contact form, which may process technical information about your browser to tell people from bots.
• Google Fonts — the coach dashboard loads its fonts from Google, which receives your IP address but sets no cookies. This website hosts its own fonts.
• Google Firebase — delivers push notifications, as described in section 3.

6. Consent

Strictly necessary cookies and storage are used because the service you asked for, such as staying signed in or receiving notifications, cannot work without them. Preferences only remember choices you made. Because Fitora uses no advertising or analytics cookies, we do not show a cookie banner. If we ever introduce non-essential cookies, we will ask for your consent first, where the law requires it.

7. How to control cookies and storage

• Signing out removes the sign-in cookies, or the sign-in tokens in the client app.
• Your browser's settings let you view, block, and delete cookies and site data for fitora.mk. Blocking the sign-in cookies means you will not be able to stay signed in to the coach dashboard.
• You can turn notifications off in your browser or in your phone's settings at any time.
• You can disconnect Apple Health or Health Connect in your phone's settings.
• Deleting the client app removes everything it stored on your device.

8. Changes to this policy

We will update this policy when the cookies or storage Fitora uses change, and change the date at the top of the page when we do.

9. Contact

Questions about this policy can be sent to support@fitora.mk.