Legal
Cookie policy
Three kinds of cookie, and two of them need your permission. This page lists all of them by name.
A cookie is a small piece of text a website asks your browser to keep and send back on your next request. Some are needed for the site to work at all — without one, signing in would not survive a click. Others are not, and under UK law those cannot be stored on your device until you say yes.
Cookies we set without asking
These are the ones the site cannot do its job without, so the law does not require consent for them. They are all set by us, on gymist.co.uk, and none of them is shared with anyone.
| Name | What it does | How long it lasts |
|---|---|---|
| gymist_consent | Remembers your answer to the cookie banner, so we do not ask again on every page and so we know what may be stored. | 6 months |
| sb-<project>-auth-token | Keeps you signed in. Set when you sign in, refreshed as you browse, removed when you sign out. Large sessions are split across numbered cookies (…-auth-token.0, .1). | Up to 400 days, or until you sign out |
| sb-<project>-auth-token-flow-<id>-code-verifier | Written while you are completing a sign-in link, and used to prove the link was opened by the browser that asked for it. Removed once you are signed in. | Minutes — the length of one sign-in |
| sb-<project>-auth-token-flows-code-verifier | Keeps track of which sign-in attempts are still in progress, so opening a link in a second tab does not break the first. | Minutes — the length of one sign-in |
The two beginning sb- come from Supabase, the database and sign-in service Gymist runs on. They only exist once you have an account and are signing in — browse without signing in and the only cookie you will ever have from us is the one recording your answer to the banner. <project> in those names is the identifier of our Supabase project, which is why they look different in your browser to how they read here.
Analytics — only if you agree
Google Analytics tells us which pages people use, which searches find nothing, and where people give up — the things we would otherwise be guessing at.
| Name | What it does | How long it lasts |
|---|---|---|
| _ga | Google Analytics. Gives your browser an identifier, so repeat visits count as one person rather than several. | 2 years |
| _ga_<property> | Google Analytics. Holds the state of your current visit — when it started, and which pages it has covered. | 2 years |
Advertising — only if you agree
We advertise Gymist on Google. If you agree to this, Google Ads can tell that somebody who clicked one of our adverts later did something on the site, which is how we know whether advertising is worth doing.
| Name | What it does | How long it lasts |
|---|---|---|
| _gcl_* (_gcl_au and relatives) | Google Ads. Records that you arrived from one of our adverts, so we can tell which ones bring people here. | 90 days |
| _gac_<property> | Google Ads. Links an advert click to what happened afterwards in Google Analytics. | 90 days |
We do not sell your data, we do not share it with advertising networks for their own purposes, and nothing you write on Gymist is used to target adverts at you.
What happens if you say no
Google’s tag still loads, and it is told that nothing may be stored. That is a real instruction and not a courtesy: no _ga, no _gcl_*, nothing written to your device, and no identifier that could connect this visit to your last one. Google still receives the fact that a page was viewed, with no cookie attached — enough for us to see that people are arriving, not enough to know who.
We would rather explain that than quietly count you anyway. If you would rather Google received nothing at all, blocking googletagmanager.com in your browser or an extension does exactly that, and the site works fine without it.
Changing your mind
Choose Cookie choicesin the footer of any page. It reopens the same banner, with the two permissions separate, and turning one off deletes that one’s cookies from your browser there and then. Withdrawing is meant to be exactly as easy as agreeing was, and it takes the same single tap.
We will ask again after six months, because permission you gave once is not permission for ever.
What we do not do
There are no third-party embeds on our pages — no video players, no maps, no share widgets — so no other company gets to set a cookie through us. Our typefaces are served from our own servers rather than from Google Fonts, so simply reading a page contacts nobody but us and Google’s tag. We sell nothing, so there is no shopping or payment cookie.
Your browser can do this too
Every modern browser lets you block or delete cookies, and it will also show you exactly what is stored right now — if you find something in there we have not listed on this page, please tell us. Blocking ours will not stop you reading the site, though signing in will not work, because the cookie that keeps you signed in is the one being blocked. aboutcookies.org has instructions for each browser.
Changes, and getting in touch
If we add a cookie, this page changes before it appears, and if the new one needs consent we will ask you again rather than treating your last answer as covering it.
What we do with the information behind these cookies is in our privacy policy. Anything else, email privacy@gymist.co.uk or use the contact form.