Cookie Policy

1. Scope

This policy covers cookies and other technologies which store information on, or read it from, your device when you use NexusFit, including browser local storage, session storage, IndexedDB and service-worker caches. Personal information linked to these technologies is also covered by the Privacy Policy. Our legal operator is Craig Perry Clifton, trading as NexusFit; contact fitness@nexusfit.co.uk.

The law applies to storage/access technologies, not only files called cookies. NexusFit must assess each actual purpose, not label all technologies “essential” merely because they are convenient.

2. Current application inventory

Sign-in/session storage: the browser stores the account session so requested signed-in features work. Session duration and renewal depend on the account provider; a verified production inventory must identify exact names and expiry rules. Purpose: authentication and session security.

Theme preference (“nexusfit-theme”): local storage for your chosen colour theme. Website language/currency (“nexusfit-website-region”): local storage for a manual language/currency choice. These records have no application-set expiry in the reviewed code and can remain until removed. Purpose: user-selected appearance/function preferences; assess the appearance exception and provide a simple, free objection mechanism.

Sidebar state (“sidebar_state”): a reusable UI component writes a seven-day cookie when its open/closed setting is changed. Deployment must confirm whether that component is active on the production page; its presence in the source is not proof the cookie is always set.

Gym Log offline storage: account-scoped IndexedDB stores cached sessions, queued revisions, recovery information and equipment photos awaiting sync. Session recovery may also use session storage. This can include health-related information and is not merely an anonymous performance cookie. Sign-out includes local cleanup, but an interrupted or failed sign-out can leave data on a device.

Service-worker cache: requested installable/offline app features cache page shells and versioned application assets. The reviewed configuration avoids caching API responses as app assets. Installation and browser cache expiry are device-dependent; cached files do not automatically disappear when a subscription ends.

Notification permission and routing: optional web push uses browser permission, a service worker and a saved subscription endpoint. Browser vendors may store their own delivery information. Permission refusal does not authorise sending push notifications by another route.

3. Consent and exemptions

Technologies strictly necessary for a requested communication or service may be used without consent where the relevant PECR exception applies. Security and sign-in purposes are assessed separately from analytics, advertising or preference purposes.

UK rules also include specific statistical-purpose and appearance exceptions. They apply only where every condition is met, including clear information and a simple, free way to object where required. A daily account visit record used for member operations is not automatically exempt statistical tracking, and health-linked analysis is not automatically covered by an appearance exception.

Advertising pixels, cross-site tracking and other non-exempt purposes require valid consent before storage/access. Where consent is needed, accepting and rejecting must be comparably easy, choices must be granular and withdrawal must be available. Continuing to browse is not consent. A banner is not proof of compliance if prohibited technologies run before a choice.

No application-owned advertising pixel or dedicated cookie-consent interface was identified in the source review. That does not establish that hosting telemetry, embeds, sign-in or payment pages set no other technologies; the production website and every third-party flow need separate checking.

4. Your choices and third parties

Use NexusFit’s language/currency reset and theme settings for the available preference controls. Use Account notification controls and browser permissions to disable push delivery. Signing out removes the account session and invokes Gym Log local cleanup. Before deleting browser storage, sync offline Gym Log entries you want to keep.

You can remove or block site storage in your browser, but this may sign you out, erase unsynced records and prevent requested functions from working. Browser settings alone do not replace any simple in-service objection or consent-withdrawal control we are legally required to provide.

Stripe checkout/billing, Google sign-in and hosted media may use technologies on their own pages or within their relevant integrations. Their notices apply to their separate services. We must identify any such technology embedded on NexusFit rather than assume all activity takes place elsewhere.

This inventory must be reviewed when new analytics, embeds, providers, app caches or marketing tools are introduced. Approved changes will be dated and new consent sought for changed purposes where required.