Gymscanner Cookie Policy
Version 2.0 | Effective Date: June 15, 2026
This Cookie Policy explains how Gymscanner uses cookies and similar technologies on the website at gymscanner.com (the "Site") and what applies inside the Gymscanner mobile applications (the "Apps"). It supplements our Privacy Policy and Terms of Use.
The data controller responsible for you is determined by the regional table in Section 1 of the Privacy Policy. For all cookie-related matters, you can contact us at [email protected].
1. What Cookies and Similar Technologies Are
- Cookies: Small text files placed on your device by a website. "First-party" cookies are set by
gymscanner.com; "third-party" cookies are set by other companies whose tools we use. - Pixels and Tags: Small code snippets that report events (such as a page view or completed purchase) to a third party.
- Local Storage: Data stored in your browser or app beyond a single session.
- SDKs: Code libraries inside mobile apps that can perform functions similar to cookies. The Gymscanner Apps contain no advertising or analytics SDKs (see Section 6).
2. Cookie Categories We Use
| Category | Purpose | Consent Required |
|---|---|---|
| Strictly Necessary | Sign-In sessions, account security, fraud prevention, payment processing, your cookie choices. | No, these cannot be switched off |
| Functional | Remembering language, currency, and display preferences. | Yes |
| Analytics | Understanding how visitors use the Site so we can improve it. | Yes |
| Marketing | Measuring ad campaigns and showing relevant Gymscanner ads on other platforms. | Yes |
🔒 Privacy Guarantee: We never use cookies or pixels to collect or transmit Health Tool data (cycle, nutrition, calorie, or activity data). Marketing tags fire only on consented sessions and never on Health Tool screens.
3. The Cookies We Set
The table below lists the principal cookies and tags in use. Exact names and durations may vary as providers update their technology; the live consent banner always reflects the current set.
| Cookie / Tag | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
gs_session |
Gymscanner | Strictly necessary | Keeps you Signed In | Session |
gs_csrf |
Gymscanner | Strictly necessary | Security, prevents request forgery | Session |
gs_consent |
Gymscanner | Strictly necessary | Stores your cookie banner choices | 12 months |
__stripe_mid, __stripe_sid |
Stripe | Strictly necessary | Payment fraud prevention | 12 months / 30 min |
gs_prefs |
Gymscanner | Functional | Language, currency, display settings | 12 months |
_ga, _ga_* |
Google Analytics 4 | Analytics | Distinguishes visitors, measures usage | Up to 24 months |
_clck, _clsk |
Microsoft Clarity | Analytics | Session replay and usage analysis | Up to 12 months |
_fbp, _fbc |
Meta (Facebook/Instagram) | Marketing | Ad measurement and audience building | 3 months |
_gcl_au |
Google Ads | Marketing | Conversion measurement | 3 months |
4. How We Ask for Consent
- Initial Visit: On your first visit from the EU/EEA/UK and other regions where prior consent is required, our consent banner loads before any non-essential cookie is set. Functional, analytics, and marketing cookies fire only after you opt in.
- Equal Controls: The banner offers Accept all, Reject all, and per-category controls with equal prominence. Rejecting is as easy as accepting.
- Duration: Your choice is stored for 12 months, after which we will ask again.
- Changing Choices: You can change or withdraw your choices at any time via the Cookie Settings link in the Site footer. Withdrawal stops future setting and reading of the relevant cookies; already-set cookies can be removed via your browser (see Section 7).
- GPC Signals: Where required by law, we honor Global Privacy Control (GPC) browser signals as an opt-out of marketing cookies and of "sale" or "sharing" under US state privacy laws.
5. Legal Bases
- EU / EEA / UK: Non-essential cookies are set only with your consent under ePrivacy rules and GDPR Art. 6(1)(a). Strictly necessary cookies rely on the technical-necessity exemption and, for related data processing, our legitimate interests and contract performance.
- United States: State privacy laws give you opt-out rights for targeted advertising; our banner, the Cookie Settings link, and GPC honor those rights.
- Kuwait and MENA: We apply the same consent banner and disclosures, consistent with CITRA data privacy requirements.
6. Mobile Apps
The Apps contain no third-party advertising or analytics SDKs. They use only:
- Essential Local Storage: For your Sign-In session, security tokens, and settings.
- On-Device Storage: For Health Tool data as described in the Privacy Policy.
- Push Notification Tokens: Used only if you explicitly enable notifications.
The Apps do not show the Apple App Tracking Transparency (ATT) prompt because they do not track you across other companies' apps or websites. If we ever add analytics or advertising SDKs to the Apps, we will update this Policy first and request any consent required, including the ATT prompt on iOS.
7. Managing Cookies in Your Browser
You can block or delete cookies through your browser settings:
- Chrome: Settings $\rightarrow$ Privacy and security $\rightarrow$ Cookies
- Safari: Preferences $\rightarrow$ Privacy
- Firefox: Settings $\rightarrow$ Privacy & Security
- Edge: Settings $\rightarrow$ Cookies and site permissions
⚠️ Note: Blocking strictly necessary cookies will break Sign In and checkout functionality.
Provider-Level Opt-Outs
- Google Analytics Opt-Out Browser Add-on
- Google Ad Settings
- Meta Ad Preferences
- Microsoft Clarity Opt-Out
8. Third Parties
The analytics and marketing providers named in Section 3 act as independent controllers or co-controllers for some of the data their tags collect, under their own privacy policies:
Where EU data is transferred outside the EEA by these providers, transfers rely on adequacy decisions (including the EU-US Data Privacy Framework where the provider is certified) or Standard Contractual Clauses.
9. Changes to This Policy
We may update this Policy as our cookie use changes. Material changes will be notified via the Site banner or by email at least 15 days before taking effect, except for the removal of cookies or providers, which may take effect immediately. The Effective Date above reflects the latest version.
10. Contact
- Email: [email protected]
- Postal Address: The registered address of your regional data controller listed in Section 1 of the Privacy Policy.