CRIVIX Cookie Policy

In short

CRIVIX uses no tracking cookies, no advertising cookies and no cookies from advertisers or social media. We only place what is strictly necessary to let you sign in and to remember your choices, such as your language and display. By law no consent is needed for that, which is why you see no cookie banner with us. This policy explains exactly what we use and why.

1. The rules we follow

Storing or reading information on your device (cookies, but also local storage in your browser) is regulated by Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet). Consent is required, except where the storage is strictly necessary to provide the service you yourself request, or where it only serves to measure the quality or effectiveness of the service and has no or minor consequences for your privacy. Everything CRIVIX uses falls under those exceptions. The GDPR additionally applies to the personal data processed in the process; see our privacy policy.

2. Cookies that CRIVIX places

Sign-in cookies of our sign-in service

• Name: starts with sb- and ends in -auth-token (sometimes split into several parts with a number after them).
• By whom: CRIVIX, via our sign-in service Supabase. They are cookies of our own website (first party).
• Purpose: they contain your sign-in session, so that you stay signed in and we know it is you for every page you request. Without these cookies you cannot use the app.
• How long: they are placed when you sign in and renewed for as long as you stay signed in, with a maximum lifetime of 400 days. They disappear when you sign out.
• Consent: not required; strictly necessary for the service you request.

Language choice

• Name: crivix_locale.
• By whom: CRIVIX (first party).
• Purpose: remembers in which language (Dutch or English) the site and the app appear. We place this cookie when you yourself choose a language on the site or in Settings, and when you sign in: we then set it to the language of your account, so that CRIVIX appears in that language on every device you sign in on. The language of your account is the language you chose in Settings or, if you never did, the language in which you first signed in. As long as this cookie is not there, we follow your browser's language.
• How long: 1 year.
• Consent: not required; strictly necessary for the language choice that belongs to you or your account.

Return after the subscription page

• Name: crivix_after_paywall.
• By whom: CRIVIX (first party). The cookie can only be read by our server, not by scripts in your browser, and is only sent within the app.
• Purpose: if you want to do something in the app that requires CRIVIX Premium, such as starting a session, having your week composed or adding an extra session, while your Premium is not active, this cookie remembers which action that was (the session, your week or the date of the extra session). This lets us send you back to that place as soon as your Premium is active. The action itself is not carried out automatically.
• How long: at most 2 hours. As soon as we have sent you back, we delete it.
• Consent: not required; strictly necessary for the service you request.

We place no other cookies. Our website places no third-party cookies and contains no tracking scripts from social media or advertisers. On the sign-in page, the start and the waiting list a security script from Cloudflare does load (see section 5).

3. Local storage and session storage in your browser

In addition to cookies, the app uses two kinds of storage in your browser: local storage (localStorage), which remains until it is removed, and session storage (sessionStorage), which your browser clears automatically as soon as you close the tab or the browser. What is stored there stays on your device and is not used by us to track you. It is not sent to us, except for the identifier of a benchmark and the steps of a session without a connection (see below).

Local storage

• Display preference (theme): remembers whether you chose the light or dark display. If you choose "System", we remove this value and the app follows your device's setting. Remains until you change the choice or clear your browser data.
• Your intake answers (crivix_intake_v1): keeps the answers you give at "Start", so you can continue where you left off. It contains no e-mail address. Remains for at most 7 days and is removed as soon as your week is saved or you start over.
• Draft of your reflection after a session (crivix:individual-training-reflection:…): temporarily keeps your score and whether your focus worked out, so that you do not lose them if the page reloads. Your note is never kept here, because it can contain health data. Removed as soon as you save the reflection, when you sign out and when you withdraw your consent for health data, and a draft older than 7 days is deleted.
• Cache of your notifications (crivix:notifications:v1): a copy of your notifications in the app, so that they are visible immediately. Refreshed at every visit.
• Your Home layout (crivix:home-layout:v1): remembers on this device which widgets you have on Home and their size, so the loading screen inside the app looks the same. When the page is reloaded, the loading screen briefly shows the default layout. It contains no training or health data. It is updated when you change your layout, and removed when you restore the default, log out, sign in again or clear your browser data.
• Your cue-mode choices (crivix.cue.start, crivix.cue.thr and crivix.cue.sens): remembers on this device whether you start the next repetition with your voice or by tapping and, if you use your voice, the sound threshold your phone determined when setting up the microphone and the sensitivity you chose. These are one choice and two numbers; they contain no sound. Remains until you clear your browser data; you can also remove your choice between voice and tapping via "Change" in cue mode. For the microphone itself, see section 13 of our privacy policy.
• Keep screen on (crivix.screen.on): remembers on this device whether you switched the "Keep screen on" setting on or off. Without a stored choice the setting is on and the app keeps your screen on while a session is running. Remains until you change the setting or clear your browser data.
• Session without a connection (crivix.session.offline.v1:…): a copy of the session you are doing and the steps not yet saved (sets, rest, skipped exercises, an early stop, your score and whether your focus worked out), so that the session carries on if the connection drops. A pain answer is kept here only with valid consent for health data; your note never. As soon as you have a connection again and the page is open, the steps are sent to us. Removed when the session is finished and when you sign out; after 24 hours the app no longer uses the copy and removes it.
• Offer of a session today (crivix.todayOffer.dismissed): remembers the date on which you chose "No, thanks" at "Want to start today?", so that the app does not show you that offer again that day. Remains until you decline the offer another time or clear your browser data.

Storage for a session without a connection

• Page of your session (crivix-session-v1 and the helper script /session-sw.js): during a session your browser keeps a copy of the page, the images and the app's files, and a small helper script (service worker) that opens that page when there is no connection. The copy of the page disappears when you finish the session on this device, and everything in this storage when you sign out. The helper script itself remains until you clear your browser data; it contains no data about you.

Session storage

• Address of your sign-in code (crivix:pending-code-email): remembers in this tab which email address we sent your code to, so the code screen comes back if your phone reloads the page while you read your email. No longer used after 10 minutes, and gone once you sign in or close the tab.
• Signed out (crivix:auth-invalidated): set when you sign out, so that the app does not show a protected page that your browser still holds in its memory when you go back, but first requests it again from our server. It contains only the value "1". Removed as soon as the app has used it or you sign in again.
• Test in progress (p04:…:attempts): keeps your attempts and rest time for the test you are doing now, so that you do not lose them if the page reloads. Your body weight is not kept here. Removed when you save or stop the test, and otherwise when you close the tab.
• Tested today (p04:tested:…): remembers in this tab that you already did a maximal test today. It contains only the value "1". Gone when you close the tab.
• Test you run yourself (self-run-flow:…): keeps where you are in the test, the conditions you stated (such as the surface, your shoes and whether you film or time by hand) and your attempts, so that you do not lose them if the page reloads. For the Yo-Yo a second key (self-run-flow:…:yoyo) remembers when the test began and which rounds failed. It contains no video. Removed when you save the test, and otherwise when you close the tab.
• Benchmark identifier (p04:…:run and self-run:…): a random identifier for the benchmark you are carrying out at that moment. It is included when you save the benchmark, so that a benchmark sent twice because of a faltering connection is stored only once. It says nothing about you. Removed if you abort the benchmark, and otherwise when you close the tab.
• Drafts for matches and team sessions (crivix:match-preparation:…, crivix:match-reflection:… and crivix:team-training-reflection:…): temporarily keep what you have already filled in when preparing for a match and in the reflection on a match or team session, so that you do not lose it if the page reloads. The name contains no account ID but a code that cannot be traced back to your account, so that the drafts of two accounts on the same device stay separate. They contain no answers about exertion or intensity. Removed as soon as you save, and the app no longer uses a draft older than 12 hours.

No consent is needed for this local storage and session storage: it is strictly necessary for functions you use yourself.

4. Usage statistics without cookies

We want to know whether CRIVIX works: whether onboarding is completed, whether sessions are started and finished, and where something goes wrong. For that we may use the service Plausible (Plausible Insights OÜ, established in the EU). At the time of this version that measurement is switched off; we may switch it on later without changing this policy, because its operation is already fully described below.

• No cookies, nothing on your device. The measurement happens from our own server, not in your browser. Nothing is stored on or read from your device. Article 11.7a of the Telecommunications Act therefore does not apply to it.
• What we count: an event from a fixed list (such as "onboarding completed", "session started", "session completed", "composition failed"), with only properties from a fixed list of choices (such as the type of screen or the error category), plus the environment and the version of the app.
• What we never send: your name, e-mail address, account ID, IP address, browser, your Check-in or health data, pain reports or free text. Our server also does not send the actual page you viewed, but one fixed address entry for the app.
• Result: Plausible receives no data from us by which you can be recognised and cannot track your use across visits or websites. The statistics are totals only.

Should we ever want to use a statistics script on the public website itself, or a measurement that does store on your device, we will first amend this policy and, where the law requires it, ask for your consent with an equally clear choice to refuse as to accept.

5. Services of others

• Sign-in security. On the sign-in page, the start and the waiting list, Cloudflare Turnstile checks that the form is not being abused. For that your browser loads a script from Cloudflare, which processes technical data of your browser and your IP address. This is strictly necessary for security and is not used to follow you.
• Subscription. During the pilot you do not need a subscription and you do not visit a page of our payment provider Stripe. If you later choose a paid subscription yourself, it runs through Stripe's page, on Stripe's domain, where Stripe's cookies and cookie policy apply. Stripe places no cookies on our own pages.
• E-mail. Our e-mails contain no tracking pixels and no tracked links.

6. How to manage cookies and local storage

You can always delete or block cookies, local storage and session storage in your browser settings. Bear in mind that you will then need to sign in again and will be asked for your language and display choice again. You can also reset your display choice in Settings → Display (choose "System").

7. Changes and contact

If anything changes in what we use, we amend this policy with a new version number and a new effective date. Questions? E-mail support@crivix.app. This policy belongs to the privacy policy of CRIVIX (in oprichting), Christiaan Deniz. Address and Chamber of Commerce number follow upon registration before the paid period.