Cookie Policy

Cookies are small text files stored on your device (computer, smartphone, tablet) when you access a website. They allow the site to recognize your device and store information about your preferences and actions.

In addition to cookies, we use similar technologies:

• Local Storage / Session Storage: browser storage for session data and preferences;
• Tracking pixels: invisible images that record email opens and page visits;
• App SDKs: libraries embedded in mobile applications for analytics and functionality.

In this Policy, the term "cookies" refers to all these technologies, unless otherwise indicated.

We use cookies for the following purposes:

• Essential operation: maintaining your session, remembering language preferences, ensuring security;
• Performance and analytics: understanding how visitors use the Platform to improve the experience;
• Functionality: remembering your choices (language, region, display settings);
• Marketing: displaying relevant content and measuring campaign effectiveness.

By Duration

• Session cookies: temporary, deleted when you close the browser;
• Persistent cookies: remain on the device until they expire or are manually deleted.

By Origin

• First-party cookies: set by the fitney.com.br domain;
• Third-party cookies: set by external services integrated into the Platform.

By Purpose

• Essential: indispensable for basic operation;
• Functional: improve the experience but are not mandatory;
• Analytics: collect usage information (usually anonymized);
• Marketing: used for tracking and personalized advertising.

Cookie	Type	Purpose	Duration	Provider
_session	Essential	Maintain authenticated user session	Session	Fitney
locale	Functional	Remember language preference	1 year	Fitney
cookie_consent	Essential	Store your cookie preferences	1 year	Fitney
_ga	Analytics	Distinguish users in Google Analytics 4	2 years	Google
_ga_*	Analytics	Maintain GA4 session state	2 years	Google
_gid	Analytics	Distinguish users (short term)	24 hours	Google
_gcl_au	Marketing	Google Ads conversion attribution	90 days	Google
__stripe_mid	Essential	Payment fraud prevention	1 year	Stripe
__stripe_sid	Essential	Payment session	30 min	Stripe
_clck	Analytics	Microsoft Clarity session identifier	1 year	Microsoft
_clsk	Analytics	Connect Clarity interactions within session	1 day	Microsoft
CLID	Analytics	Unique Clarity identifier	1 year	Microsoft
_fbp	Marketing	Meta Pixel browser identifier	90 days	Meta (Facebook)

Technologies in the Mobile App

In the Fitney app for iOS and Android, we use the following local storage technologies (which are not cookies but function analogously):

Technology	Type	Purpose	Duration
SharedPreferences	Essential	Authentication tokens, user preferences, notification settings	Until logout or uninstall
Hive Cache	Functional	API response cache for offline functionality	Up to 3 days
Offline Queue	Essential	Pending operations (exercises, check-ins, runs) when offline	Until synchronization
Firebase Analytics SDK	Analytics	Usage events, device identifiers, user properties	Per Firebase policy
Firebase Crashlytics SDK	Essential	Crash reports and app stability	Per Firebase policy
Firebase Cloud Messaging	Essential	Push notification token for sending reminders	Until revocation or uninstall

This list is updated periodically. For real-time information, refer to the cookie banner on the Platform.

We use third-party services that may set their own cookies:

Google Analytics 4

We use GA4 for traffic and usage behavior analysis. We have implemented:

• IP anonymization;
• GA4 Consent Mode v2 (analytics cookies are only activated after consent);
• Advertising signals disabled.

More information: Google Privacy Policy

Stripe

Payment processor that uses essential cookies for fraud prevention and transaction security.

More information: Stripe Privacy Policy

Google Tag Manager

Used for tag and script management. GTM itself does not collect personal data, but manages tags that may (such as GA4, Clarity, and Meta Pixel).

Microsoft Clarity

Behavioral analytics tool that records heatmaps and session recordings to understand how visitors interact with the Platform. Data is anonymized and does not include form fields.

More information: Microsoft Privacy Statement

Meta Pixel (Facebook)

Tracking pixel used to measure advertising campaign effectiveness and create custom audiences. Activated only after user consent for marketing cookies.

More information: Meta Privacy Policy

Firebase (Google)

Suite of tools used in the mobile app for usage analytics (Firebase Analytics), stability reports (Firebase Crashlytics), and push notification delivery (Firebase Cloud Messaging).

More information: Firebase Privacy and Security

Cookie usage is based on the following legal grounds:

Brazil (LGPD)

• Essential cookies: legitimate interest (Art. 7, IX) — necessary for service operation;
• Analytics and marketing cookies: consent (Art. 7, I) — activated only after opt-in.

European Union (GDPR + ePrivacy Directive)

• Essential cookies: exempt from consent under Art. 5(3) of the ePrivacy Directive (strictly necessary);
• Other cookies: prior, informed, and specific consent (Art. 6(1)(a) GDPR + Art. 5(3) ePrivacy Directive).

USA

• CCPA/CPRA (California): disclosure of data collection and opt-out of sale/sharing;
• State laws: compliance with privacy laws in Colorado, Connecticut, Virginia, and other states with applicable legislation.

You can control cookies in several ways:

Cookie Banner

When you first access the Platform, a banner allows you to accept or refuse non-essential cookies. You can change your preferences at any time.

Browser Settings

All modern browsers allow you to manage cookies:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions

Analytics Opt-out

• Google Analytics: install the Google Analytics opt-out browser add-on

Note: disabling essential cookies may affect Platform functionality. Session and authentication cookies are required for account access.

Fitney respects the following browser privacy signals:

• Global Privacy Control (GPC): we recognize the GPC signal as a valid opt-out request for data sale/sharing, as required by the CCPA/CPRA;
• Do Not Track (DNT): there is currently no universally accepted standard for DNT. However, when we detect the DNT signal, we disable marketing cookies.

We may update this Cookie Policy periodically to reflect changes in the technologies used, applicable laws, or Platform practices.

Significant changes will be communicated by:

• Displaying a new cookie banner;
• Notification on the Platform;
• Updating the "Last updated" date on this page.

We recommend reviewing this Policy periodically.

For questions about this Cookie Policy or the tracking technologies we use:

• Email: dpo@fitneyapp.com
• Legal: legal@fitneyapp.com
• Address: Fitney Tecnologia Ltda., CNPJ 44.638.274/0001-86, R. Cascavel, 2760 — Curitiba, PR, Brazil