Cookie Policy

1. What this covers

This policy explains what Exersites stores in your browser when you use exersites.fit or a trainer's site hosted by us. It sits alongside our Privacy Policy and Terms of Service.

A cookie is a small piece of text a site asks your browser to keep and send back on later requests. Browsers also offer local storage and IndexedDB, which hold data on your device but are never sent to a server. We use all three, and section 4 covers the last two.

2. The cookies we set

All four are first party, meaning they are set by the site you are actually on and can be read by nobody else. All four are strictly necessary: the Service cannot work without them, so no consent is required for them and there is nothing to turn off.

Name	What it does	Lifetime
gova_session	Keeps a trainer signed in to their Exersites account on exersites.fit, so that moving between pages does not mean signing in again. A signed identifier for the session, not your details.	24 hours
gova_admin_session	The same thing for a trainer signed in to the admin pages on their own site.	24 hours
gova_client_session	The same thing for a client signed in to their trainer's site, so they can see their sessions, programs, and videos.	24 hours
csrf_token	Protects against cross site request forgery, an attack where another site tries to make your browser take an action on this one while you are signed in. Every form and every request that changes something must present this value back, which proves the request came from a page we served.	24 hours

The three session cookies are marked HttpOnly, so no script can read them, including a script an attacker managed to inject. The token cookie is deliberately readable by our own code, because the page has to send the value back; that is how the protection works, and the value is useless to anybody else.

All four are marked SameSite Strict, meaning your browser will not send them on a request that started from another site. In production all four are marked Secure and are sent only over HTTPS.

3. What we do not use

Stated plainly, because an earlier version of this page described the wrong technology and because most sites that say "we value your privacy" mean the opposite.

• No advertising cookies. We run no advertising and have no advertising partners.
• No analytics. No Google Analytics and no analytics product of any kind. We do not measure your visit.
• No third party cookies. Nothing on any page we serve is loaded from another company's domain. Our Content Security Policy blocks it outright, so it cannot happen by accident either.
• No tracking pixels, web beacons, or fingerprinting.
• No cross site tracking. Nothing we set can follow you to another site, and we build no profile of you.
• No social media cookies, because there are no social login or sharing widgets to set them.

Stripe may set its own cookies on Stripe's own checkout and billing pages, which are hosted by Stripe rather than by us. When you are sent there to pay, you are on Stripe's site under Stripe's privacy policy and its cookie practices, not ours.

4. Browser storage that never reaches us

A few conveniences are remembered on your own device, using local storage and IndexedDB. These are not cookies, they are never sent to our servers, and we cannot read them.

• Calendar view. Whether a trainer last looked at month, week, three day, or day view, and which layout, so the calendar opens the way they left it.
• Panel state on the branding page. Which sections a trainer had expanded.
• A video upload in progress. A large upload is held in IndexedDB while it goes up in chunks, so that a dropped connection or a closed tab does not mean starting over. It is removed when the upload finishes.

Clearing your site data removes all of this. Nothing breaks; you just get the default view back and lose any half finished upload.

5. Controlling cookies

Every browser lets you see, block, and delete cookies, usually under privacy or site settings. You can clear ours at any time.

Because all four of ours are strictly necessary, blocking or deleting them has a specific effect: you are signed out, and you will not be able to sign in again until you allow them. There is nothing to lose by clearing them beyond having to sign in once more.

We show no cookie consent banner. That is not an oversight. A banner exists to collect consent for cookies that are not necessary, and we do not set any.

6. Changes to this policy

If we ever add a cookie, this page changes first, and the date at the top changes with it. If we were to add one that is not strictly necessary we would ask for your consent before setting it.

7. Contact us

Questions about anything on this page:

Exersites
204 West 140th Street
New York, NY 10030
United States
[email protected]