Cookie Policy

Last updated: 7 November 2026

This policy explains cookies and similar storage used by the FitItIn website and mobile app. Cookies are small browser records; local storage, secure device storage and SDK identifiers are different technologies that can serve similar purposes. See our Privacy Policy for how personal information is used and shared.

1. Website sessions and security

• Session cookie: the website uses a session cookie, currently named fititin-session, to maintain a session and support sign-in and forms. The configured idle session lifetime is 120 minutes; activity can renew it, and “remember me” can maintain sign-in for longer. Browser closure behaviour depends on the session configuration.
• Request security: XSRF-TOKEN, where issued, supports protection against forged form requests and normally follows the session cookie lifetime. Session information can also hold temporary Google sign-in or calendar-connection security state.
• Remember me: when you select this option, a persistent authentication cookie with a name beginning remember_web_ may be used. Its actual expiry is shown in your browser’s cookie information; signing out or clearing cookies can end remembered sign-in.

Session and request-security storage is used to provide the sign-in, security and form functions you request. You can block or remove these cookies through your browser, but doing so may prevent those functions from working. “Essential” does not mean you have no control over your browser.

The restricted administration portal uses the same website session and request-security cookies to authenticate authorised administrators. It does not introduce a separate advertising or analytics cookie.

2. Website appearance preferences

The website uses local storage named meetsync-dark-mode and meetsync-sidebar-collapsed to remember the appearance and sidebar choices you make. The legacy “meetsync” names are internal identifiers for FitItIn, not a separate service. These values stay in that browser until changed or cleared; local storage does not have an automatic cookie-style expiry.

The website does not include a third-party analytics or advertising-tracking script. First-party product analytics are derived from server-side account and group actions without introducing a separate analytics cookie, device identifier or local-storage key. See the Privacy Policy for the purpose, retention and account opt-out. This is distinct from advertising in the mobile app. If website technologies change, this policy and any required consent choices must be updated.

3. Mobile app storage

The app is not signed in using the website’s session cookie. It keeps an API sign-in token in platform secure storage, which can persist until sign-out or removal through platform controls. Device preferences also remember your light/dark/system appearance, biometric-unlock choice and whether you have completed or skipped individual page tours.

For Apple sign-in sessions on iOS, secure storage also keeps an Apple account identifier named apple_sign_in_user so the app can check that Apple authorisation is still valid before restoring access. It is used for authentication, not advertising or product analytics, and is removed when the app clears or replaces that sign-in session.

A local preference named pending_group_invitation stores a group invitation token so an invitation can resume after login, registration or an app restart. It can remain until the invitation is handled, replaced or cleared through app-data controls; expiry or revocation on the server prevents using an invalid invitation even if a local copy remains. It is not an analytics identifier. Shared links and authentication identifiers are sensitive; avoid sharing device backups or app data with people you do not trust.

Server-side chat encryption takes place on FitItIn’s backend. It does not introduce additional cookies, device tracking or encryption-key storage in your browser or mobile app.

Complimentary beta ULTRA grant dates, expiry and reminder records are also managed on the server. They do not introduce new cookies, SDKs or browser/device storage identifiers.

A local preference named contacts_permission_requested records whether the app has asked for contact access so it can offer the appropriate prompt or device-settings shortcut. This preference contains no contact names, phone numbers or SMS verification codes, and does not grant or revoke contact permission. Your operating system manages that permission. Your phone-discoverability choice is stored against your account on the server and applies across devices.

Copying an invitation link places the link on your device clipboard so you can paste and send it yourself. Clipboard access, persistence and sharing across devices depend on your operating system and settings. This is separate from browser cookies.

These local preferences are generally retained until changed or the relevant app data is cleared. Uninstalling does not guarantee that every platform-backed or restored item is removed. Biometric templates remain managed by your device, not stored by FitItIn. Push-notification and advertising services also use identifiers and their own storage as described below and in the Privacy Policy.

4. Advertising SDKs and consent

The mobile app uses Google AdMob and Google’s User Messaging Platform. Their SDKs can store or access consent choices, advertising or device identifiers and related information for ad delivery, measurement, diagnostics and fraud prevention. Advertising is not a strictly necessary calendar or chat function.

Where consent is required, the app uses the provider’s consent flow before requesting ads as permitted by that flow. When available, Settings → Advertising privacy choices lets you revisit your choices. Device privacy settings may offer additional controls. Storage lifetimes vary by identifier and provider; see Google’s cookie and similar-technology information and advertising information.

Agreement to the Terms of Use is not consent to optional advertising tracking. Turning off personalised ads does not necessarily disable every permitted ad request or remove all ads. A browser cookie setting alone does not control a native mobile SDK.

5. Your choices and questions

Use your browser settings to inspect cookie names and expiry dates, clear site cookies and local storage, or block storage. Clearing website preferences resets the appearance choices on that browser. Use the app’s settings, operating-system controls and advertising privacy choices for mobile storage and permissions. Signing out or clearing local data is not the same as deleting your server account or cancelling a store subscription.

We use consent or an applicable legal exception for storage and access, as required by law; not every preference or SDK identifier is treated as essential. For questions, contact support@fititin.today.