Cookie Policy
Last updated: 4 August 2026 · Effective: 4 August 2026
On this page
The one thing worth knowing. TOVELU uses analytics and advertising cookies on this marketing website. It uses none at all inside the app at app.tovelu.store — not on the survey, not on your plan, not on any screen where health information appears. That separation is deliberate and enforced in code, and Section 6 explains it.
1. What this covers
This policy explains the cookies and similar technologies on tovelu.store and, separately, what runs on app.tovelu.store. It sits alongside our Privacy Policy.
“Cookies” here also covers the equivalent browser storage TOVELU relies on: localStorage, sessionStorage, pixels, and the service-worker cache that makes the app installable and usable offline.
2. Your choice, and how to change it
- If you are in the EEA, the UK or Switzerland, nothing beyond the strictly necessary cookies loads until you choose. You will see a banner on your first visit with Accept all, Reject all and per-category choices, given equal prominence. Nothing is pre-ticked.
- Everywhere else, analytics and advertising cookies load when you arrive, which is permitted by local law. You can turn them off at any time using the link below, and we will remember that.
- If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising cookies automatically, without asking you.
Refusing costs you nothing. Your price, your plan and your access are identical either way. There is no cookie wall, no “pay or consent”, and no nagging — if you decline, we do not ask again.
Open cookie settings — withdraw or change your consent at any time. Withdrawing is as easy as giving it.
3. Strictly necessary — always on
These do not require consent, because without them the service you asked for cannot work.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
tovelu-consent | TOVELU | Remembers the cookie choice you made, so we do not ask again and do not load anything you refused. | Until you clear browser data |
sb-*-auth-token | TOVELU (via Supabase) | Keeps you signed in. Without it you would be signed out on every page. | Session, refreshed while active |
tovelu-survey-answers, tovelu-survey-cursor | TOVELU (localStorage) | Saves your survey answers and your place in it, in your own browser, so you can leave and come back. Never sent anywhere until you create an account. | Until you clear browser data |
| Service worker cache | TOVELU | Stores app files so the installed app opens fast and works on a poor connection. | Until the app is uninstalled |
| Security and routing cookies | Vercel (hosting) | Routes your request and protects against abuse and denial-of-service. | Session |
4. Analytics — consent-based
These tell us how people find TOVELU and where they get stuck. We use them to fix confusing pages, not to build a profile of you.
| Technology | Provider | Purpose | Lifetime |
|---|---|---|---|
Google Analytics 4_ga, _ga_* | Which pages are visited, from which source, and where people leave the funnel. We have IP anonymisation on and Google Signals off, so it is not used for cross-device advertising profiles. | Up to 2 years | |
Microsoft Clarity_clck, _clsk, CLID | Microsoft | Aggregated heatmaps and session replays of this marketing site, so we can see which parts of a page confuse people. Clarity masks text input by default, and it does not run on any app or survey screen. | Up to 1 year |
5. Advertising and referrals — consent-based
These measure whether our ads work and make sure the person who referred you gets paid.
| Technology | Provider | Purpose | Lifetime |
|---|---|---|---|
Meta Pixel_fbp, fr | Meta | Measures whether a visit came from a Facebook or Instagram ad and whether it led to a subscription, and lets us build advertising audiences. This is the one that most clearly involves a third party in your visit. | Up to 3 months (_fbp) |
Google Ads_gcl_*, and Google domain cookies | Attributes a subscription to the Google ad that led to it, and supports remarketing. | Up to 90 days | |
Post Affiliate ProPAPVisitorId, PAPAffiliateId | Quality Unit | Records that an affiliate's link sent you here, so that if you subscribe the right affiliate is paid. It identifies a referral, not you: it carries no name, email or health data, and the affiliate never learns who you are. | Up to 12 months |
Under California law, allowing Meta and Google cookies on our site counts as “sharing” personal information for cross-context behavioural advertising, and may be treated as a “sale”. You can opt out at any time using cookie settings or by sending a Global Privacy Control signal — see the Privacy Policy.
If you decline the referral cookie, the only consequence is that the affiliate who referred you is not credited. Nothing about your account or price changes.
6. Where we never place a tag
No analytics, advertising or session-recording technology of any kind runs on app.tovelu.store. That covers the whole survey — including the questions about diabetes, medication, pregnancy and eating — and every screen of your plan, tracker, weight history and profile.
This is not a policy statement we hope somebody remembers. The tracking script carries a hostname check and refuses to execute on the app domain, and no page in the app loads any tag directly. We would rather have less data than send anyone's health information to an advertising network.
7. What we do not use
We do not use: device fingerprinting; TikTok, Pinterest, Snap, LinkedIn, X or other social pixels; data brokers; cross-site tracking beyond the measurement described above; or any tool that uploads customer lists to an ad platform. We never use health information for advertising, targeting, audience building or lookalike modelling, and we never will.
8. Controlling cookies in your browser
Every major browser lets you see, block and delete cookies, and block third-party cookies specifically — look under Settings → Privacy. You can also opt out at the source: Google Analytics offers a browser add-on at tools.google.com/dlpage/gaoptout, and ad-personalisation settings live in your Google and Meta account preferences.
Blocking all cookies and site data will sign you out of TOVELU and erase in-progress survey answers stored on your device, because those are the strictly necessary items in Section 3.
9. Global Privacy Control and Do Not Track
We honour the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as an opt-out of advertising cookies and of the sale or sharing of personal information, automatically and without asking. There is still no agreed standard behind the older “Do Not Track” header, so we do not act on it — use GPC or our cookie settings instead.
10. Changes
If we add, remove or change a technology on this list we update this page and the date at the top, and where consent is required we ask for it again before the new technology loads. Questions: ask@tovelu.store.