Cookie Policy
Last updated: 22 October 2026
The short version
Swoleboard only uses strictly necessary cookies — the ones that keep you signed in and keep sign-in secure. No advertising cookies, no analytics or tracking cookies, no third-party cookies. Because they are strictly necessary, we don't need to ask for consent and there is no cookie banner.
The cookies we set
swoleboard.session_token
Keeps you signed in. Secure, HttpOnly (scripts can't read it) and SameSite=Lax.
Kept for: up to 30 days, renewed while you use the app.
swoleboard.state (and similar sign-in cookies)
Protect Google/Facebook sign-in against forgery while you are being redirected.
Kept for: a few minutes.
swoleboard.google_health_oauth
Only while you connect Google Health: protects that step against forgery while you are on Google's screen. HttpOnly, and sent only to our Google Health address.
Kept for: 10 minutes at most; deleted when you come back from Google.
On HTTPS the sign-in cookie names start with "__Secure-", which tells the browser to send them only over HTTPS; the Google Health cookie is also sent only over HTTPS.
Other storage
When you install Swoleboard as an app, your browser may cache the app's files so it opens quickly. This holds no personal information. The rest timer remembers the length you last picked (60, 90, 120 or 180 seconds) in your browser's local storage ("swoleboard.restSeconds"); it stays on that device and is never sent to us.
Your choices
You can delete cookies in your browser settings at any time; you will simply be signed out. To sign out on every device at once, use Sign out everywhere in Settings.
More about how we handle data: Privacy Policy.