Cookies

1. What a cookie is

A small file a website stores in your browser so it can remember you on the next request. Without it the application would sign you out after every click.

Alongside cookies, websites also use browser localStorage. It is the same kind of storage in your browser, only without an expiry date: whatever goes in stays until you clear the site data.

2. Two addresses, two different rules

www.jouhealth.com is the public website with information about the project. We measure traffic here, because we need to know which texts help people and which do not. Measurement runs only with your consent.

app.jouhealth.com is the application itself, where your health data lives. No analytics and no advertising tool runs there. Measurement scripts do not belong in an environment holding health data, so there are none, and no cookie bar appears there.

3. What the public website measures once you agree

None of this starts before you click Agree in the bar. If you click Only what is necessary, nothing from the following list is loaded at all.

Google Analytics 4, provided by Google Ireland Limited. It counts visits, pages read and where people arrived from. According to Google, GA4 does not store the IP address: it uses it only to derive an approximate location and then discards it. Cookies: _ga and _ga_QM0BGGB00E, both with a 2 year lifetime.

Microsoft Clarity, provided by Microsoft Ireland Operations Limited. It shows an anonymised replay of movement across the page and click maps, meaning where people get stuck. Cookies: _clck with a 1 year lifetime and _clsk with a 1 day lifetime. Microsoft may also set its own cookies on the clarity.ms and c.clarity.ms domains, for example MUID, CLID or ANONCHK; it maintains the current list in its documentation.

Both providers belong to US groups and may process data outside the European Union. We base the transfer on standard contractual clauses and on the providers' listing under the EU-US Data Privacy Framework.

No advertising tool runs at present. Consent also covers advertising measurement, so if one is ever added it will start only under the same consent and not before. Health data cannot reach measurement, because the public website has no access to it.

4. What the public website stores even without consent

jouhealth.consent in localStorage: your decision about measurement. Without it the bar would ask on every page load. It is stored whether you agree or refuse.

jh_lang: the website language preference, 1 year lifetime. It is set only at the moment you click a language, never on its own. Without it the server would use your browser settings to send you back to the language you had just left.

Fonts load from our own server, not from Google Fonts, so ordinary reading of a page sends nothing to Google until you agree to measurement yourself.

5. Search engine tools

The website is registered in webmaster tools: Google Search Console, Bing Webmaster Tools and Seznam Webmaster. They exist so the site can be found, and so we can see which queries it appears for in the results.

These tools do not work with your browser. No script is loaded for them, they set no cookies, and we send them no visitor data. Domain ownership is verified with a DNS record for Google and with a verification file on the server for Bing and Seznam. The numbers we read there are collected by the search engine on its own side and reach us in aggregate, with no link to an individual person.

After a new version of the site is deployed we also use the IndexNow service to announce the addresses of our own pages that changed, so search engines learn about them sooner. Only a list of our addresses is sent, nothing about visitors.

6. The cookies the application uses

In the application we use four cookies, all first party:

jouhealth_session: a necessary cookie for sign-in and session security. Lifetime at most 7 days. It is httpOnly, Secure and SameSite=Lax.

jouhealth_2fa: a necessary temporary cookie used to complete the two-factor sign-in you initiated. Lifetime 5 minutes.

jouhealth_active_profile: a requested preference. It stores the profile you explicitly selected in the switcher for 30 days; the server rechecks authorisation whenever it is used.

jouhealth_lang: a language preference. It stores the interface language you chose for 1 year.

In the application we use no advertising, analytics or cross-site tracking cookies.

In browser localStorage we store these keys: jou-theme (appearance choice, light or dark mode), jou-sidebar (sidebar state) and jou-preferences (display preferences such as units and date format). The items have no expiry and remain stored until you delete them by clearing site data in your browser settings. These items do not leave the browser merely because they are stored in localStorage; the exception is the display preferences (jou-preferences), which are synchronised with your account after sign-in.

7. What we use nowhere

We have no advertising pixels, no remarketing and no profiling across other websites. We do not sell data, not even anonymised.

In the application holding health data there is no Google Analytics, no Clarity and no other measurement or advertising tool.

The jouhealth_session and jouhealth_2fa cookies are necessary for the service you request and do not require consent under the law. The jouhealth_active_profile, jouhealth_lang and jh_lang cookies store only a choice you made yourself. Everything else, meaning measurement on the public website, runs only with your consent. If another technology that needs consent is added, we will ask you before setting it.

8. How to withdraw consent and how to refuse cookies

You can change your decision about measurement at any time through the Cookie settings link in the public website footer. The bar reappears and you can choose the opposite. Withdrawal applies from the next page load; a script already running in an open page ends when you close it.

You can block or delete cookies and localStorage items in your browser settings. For the necessary ones this means you will not be able to sign in, because the application will not remember you between requests.

Signing out deletes the session cookie immediately.

Cookies set on the website by Google or Microsoft can be deleted in your browser just like ours. You can also opt out of measurement directly with them; Google publishes a browser add-on for this.