Cookie policy
Last updated 23 July 2026 · Policy version 1.0
We currently set no tracking cookies at all. Every cookie listed below is strictly necessary to make the site work — keeping you signed in, remembering this very choice, and stopping forged form submissions. There is no analytics, no advertising pixel, and no third-party tracker on this site.
Your current choice
You haven't made a choice yet.
Until you do, nothing optional is set — no choice means no consent, and we treat it that way.
What a cookie actually is
A cookie is a small text file a website asks your browser to store and send back on later visits. It is how a site remembers anything between page loads — that you are signed in, or that you already answered a question like this one. Cookies can also be used to follow people between sites and build a profile of them. We do not do that.
Every cookie we can set
This is the complete list. The staff dashboard cookies only ever appear on the private admin site, and only after a staff member logs in — a visitor to this website never receives them.
| Cookie | Category | What it does | Lasts | Where |
|---|---|---|---|---|
cp_consent | Strictly necessary | Remembers your cookie choices so we do not ask again on every page, and so optional cookies stay off unless you allowed them. | 12 months | Public website |
XSRF-TOKEN | Strictly necessary | A random token that proves a form submission genuinely came from our site, blocking cross-site request forgery. | Until the browser is closed | Staff dashboard |
gymadmin_at | Strictly necessary | Keeps a signed-in staff member signed in. Set only after a successful login, and unreadable by JavaScript. | 15 minutes | Staff dashboard |
gymadmin_rt | Strictly necessary | Lets a signed-in staff session renew itself without logging in again. Unreadable by JavaScript and sent only to the login endpoints. | 14 days | Staff dashboard |
The categories, and what consent means for each
Strictly necessary — no consent needed
These make the site function. Without them you could not stay signed in and forms could not be protected from forgery. The law does not require consent for cookies that are strictly necessary to deliver a service you asked for, so we do not pretend to ask: you cannot switch them off, and we say so plainly rather than showing a toggle that does nothing.
Analytics — off unless you say yes
Would tell us which pages are read and where people give up, so we can improve the site. We do not currently use any. The control exists so that if we ever add one, it stays off until you allow it.
Marketing — off unless you say yes
Would measure adverts and let us show offers elsewhere. We do not currently use any, and the same rule applies: nothing loads before consent.
How we handle your consent
- Nothing optional loads first. Optional cookies are not set while the banner is open, or if you ignore it. The default is off.
- Refusing is as easy as accepting. "Reject optional" and "Accept all" are the same size, in the same place, with the same prominence.
- Each purpose is separate. You can allow analytics without allowing marketing. Consent is never bundled.
- Withdrawal is one click, forever. The "Cookie settings" link in the footer of every page reopens these controls.
- We keep proof. Each decision is recorded with a random id, the categories you chose, the policy version and the date — no name, no email, no IP address. We can show a decision was made without being able to work out who made it.
- We ask again after 12 months, and immediately if this policy changes in a way that affects what your consent covered. Consent given for one purpose is not consent for a different one.
- Declining costs you nothing. The whole site works exactly the same either way.
Controlling cookies in your browser
You can also block or delete cookies in your browser settings, independently of anything here. Blocking strictly necessary cookies will stop parts of the site working — staff would be unable to stay logged in, and this site would ask about cookies on every page because it could no longer remember your answer.
More information
Cookies that identify you are personal data, so our privacy notice applies to them too, and you can exercise your rights over them — including asking for the consent record we hold — via the request form.