The short version. Glyco uses a small number of cookies and browser storage entries. Most are there to keep you signed in and to remember interface preferences. One product-analytics provider sets a cookie to count visits and understand which features get used. We do not use advertising cookies, retargeting pixels, or cross-site trackers, and we never sell what these tools collect.
1. What This Policy Covers
This Cookie Policy explains how Glyco uses cookies and similar technologies — including browser local storage and, in the mobile apps, the operating system's preference store — on glyco.co.za and in the Glyco applications (the "Service").
It forms part of, and must be read with, our Privacy Policy and Terms of Service. Where this policy describes information that identifies you, the Privacy Policy governs how we handle it.
2. What Cookies and Local Storage Are
A cookie is a small text file a site asks your browser to store and send back on later visits. Local storage does a similar job but stays in your browser and is not sent with every request. In the iOS and Android apps there are no browser cookies; the equivalent data is kept in the operating system's own secure preference store on your device.
A first-party entry is set by glyco.co.za itself. A third-party entry is set by another company whose code runs on our pages. A session entry disappears when you close the browser; a persistent one lasts until it expires or you clear it.
3. Strictly Necessary — Cannot Be Switched Off
These make the Service work. Without them you cannot sign in or stay signed in, so we do not ask consent for them — they are necessary to deliver the service you asked for. Blocking them in your browser will break the Service.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| sb-*-auth-token | Glyco (Supabase), first party. Local storage on web; secure device storage in the apps | Holds your signed-in session and refresh token so you are not asked to log in on every page | Until you sign out or the session expires |
| Supabase security and rate-limit tokens | Supabase, first party | Protects the sign-in and password-reset flows against abuse | Session |
4. Functional — Remembering Your Preferences
These remember choices you have made so the interface behaves the way you left it. They hold no health data and are not shared with anyone.
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| sidebar:state | First-party cookie | Remembers whether you left the sidebar open or collapsed | 7 days |
| glyco:prefer-desktop | Local storage | Remembers that you chose the desktop layout on a small screen | Until cleared |
| glyco:first_touch | Local storage | Remembers the campaign tags on the link of your first visit (for example a race video), so we can tell which of our posts and ads bring people in. Stays on your device until you sign up, then sits with your account in our own database | 30 days |
| glyco:meta_click | Local storage | If you arrived through one of our paid ads on Facebook or Instagram, remembers which ad, so we can tell which ads bring athletes who stay. Not shared with Meta or anyone else | 7 days |
| glyco:planner_draft | Local storage | The race plan you are building before you have an account, so a refresh or signing up does not lose it. Moves to your account when you save it, and is then removed from your device, leaving a note of which saved plan it became (glyco:planner_draft_saved, 30 minutes) | 14 days, or until saved |
| glyco:planner_visit | Session storage | A random number for one visit to the race planner before you sign up, so we can count how far visits get (opened, set up, first fuel, asked to save, signed up). It is not linked to your name, email or account | Session (until you close the tab) |
| Interface preferences (theme, units, dismissed prompts) | Local storage | Keeps display settings and stops us re-showing a tip you have dismissed | Until cleared |
5. Analytics — Optional
We use PostHog to understand how the Service is used: which features people reach, where they get stuck, and whether a change made things better. PostHog is configured on European infrastructure.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| ph_*_posthog | PostHog, third party (cookie plus local storage) | Assigns a pseudonymous identifier so repeat visits count as one person, and records which pages and features you used | 12 months |
What analytics records. Pages and screens viewed, features used, buttons clicked, errors encountered, approximate location from your IP address, device and browser type, and — once you sign in — your Glyco account identifier, so we can see how a single user's experience unfolds across sessions.
What analytics never records. The contents of your food diary, your body weight or measurements, your injuries, your medication, your health data, your meal photographs, your voice recordings, or anything read from Apple Health, Strava, Garmin, or FatSecret. We do not send health information to an analytics provider.
We do not use analytics data for advertising, and we do not sell or share it with a data broker.
6. Advertising — No Ad Tracking
We may advertise Glyco on other sites, such as Facebook and Instagram. When you click one of those ads, the only thing we keep is which ad it was (see glyco:meta_click above), in your own browser and then in our own database. We do not send anything about you back to the ad network.
Glyco sets no advertising cookies. We run no retargeting pixels, no ad-network tags, no social media tracking pixels, and no cross-site tracking. We do not read your device's advertising identifier. If that ever changes, we will update this policy and ask for your consent before setting anything.
7. Content and Services Loaded From Third Parties
Some pages load resources from other companies to work — for example maps and elevation data from Mapbox, or a payment page hosted by PayFast. Those companies may set their own cookies when their content loads, under their own policies, which we do not control:
- Mapbox — map rendering and elevation lookups on route pages;
- PayFast — the checkout page where you enter card details;
- Strava, Garmin, Google, Apple, FatSecret — only when you go through their sign-in or authorisation screens to connect an account.
8. How to Refuse or Remove Them
Analytics. Switch on "Do Not Track" in your browser and we will not load analytics at all — we check that signal before initialising it. You can also block the PostHog domain in your browser or an extension, or email privacy@glyco.co.za and we will exclude your account. Opting out costs you no features.
In your browser. Every major browser lets you block or delete cookies and clear site data, usually under Settings → Privacy. Blocking all cookies and storage will sign you out and stop the Service from working.
In the apps. Delete the app's data, or uninstall it, to clear stored preferences and your session.
Clearing cookies and storage does not delete your Glyco account or any data held on our servers. To do that, delete your account in the app or email privacy@glyco.co.za.
9. Your Consent
Strictly necessary and functional entries are set on the basis that they are needed to deliver the Service you asked for.
Analytics is set on the basis of our legitimate interest in understanding and improving the Service, disclosed to you here as section 71 of the Electronic Communications and Transactions Act requires, and honouring your browser's Do Not Track signal. We do not currently show a cookie consent banner. If you are in a country whose law requires your prior consent before an analytics cookie is set — the European Union and the United Kingdom, in particular — tell us and we will exclude your account, and use Do Not Track in the meantime.
You are entitled to know what we store on your device and why. That is what this page is for. If anything here is unclear, ask us.
10. Changes and Contact
We will update this page whenever we add or remove a cookie, a storage entry, or a provider, and update the "Last updated" date. Questions go to privacy@glyco.co.za.