Cookie Policy
Last updated: 2026-08-31
Cookies are small files stored on your device. We use strictly necessary cookies, and — only with your consent — functional, analytics, and marketing cookies.
Note: some items marked as "localStorage" below are stored in the browser's localStorage mechanism, not as HTTP cookies. They are not transmitted in requests and are not regulated by the ePrivacy Directive, but are included here for full transparency.
Detailed cookie list
The following table lists every cookie and storage item set by this platform, as required by CJUE C-673/17 (Planet49) and Romanian Law 506/2004.
| Name | Category | Set by | Duration | Purpose | Legal basis |
|---|---|---|---|---|---|
| better-auth.session_token | Necessary | fitnes.ro (first-party) | Session (expires at logout or 7 days) | Authentication session token. Identifies the logged-in user across requests. | Art. 6(1)(b) GDPR — contract performance; exempt from consent (ePrivacy Art. 5(3)) |
| fitnes_cookie_consent | Necessary | fitnes.ro (localStorage, not HTTP cookie) | 12 months (re-consent on version change or expiry) | Stores your cookie consent preferences (accepted categories + consent version). Stored in localStorage — not transmitted in HTTP requests, not accessible cross-domain. | Strictly necessary for consent management; exempt from consent requirement |
| fitnes_cc | Necessary | fitnes.ro (first-party HTTP cookie) | 12 months | HTTP mirror of consent preferences (Secure; SameSite=Lax). Enables server-side rendering and middleware to read your consent choices without JavaScript. Contains only a compact summary (no personal data): consent version + accepted categories (0/1 per category). Set simultaneously with the localStorage entry. | Strictly necessary for consent management; exempt from consent requirement |
| cart_token | Necessary | fitnes.ro (first-party) | 30 days | Guest shopping cart identifier. Associates cart items with an anonymous browser session before login. Deleted or merged into the user account on login. | Art. 6(1)(b) GDPR — contract performance; exempt from consent (ePrivacy Art. 5(3)) |
| __Host-next-auth.csrf-token / __Secure-next-auth.callback-url | Necessary | fitnes.ro (first-party) | Session | CSRF protection and OAuth callback URL state for authentication flows. | Security — strictly necessary; exempt from consent |
| cf_clearance (Cloudflare Turnstile, if set) | Necessary | Cloudflare, Inc. (third-party, USA) | Up to 30 minutes (Cloudflare-managed) | Anti-bot/anti-fraud verification on the registration, password reset, newsletter, and support forms (no visual CAPTCHA). Runs in "managed" mode: most visitors see no challenge. Loaded regardless of your cookie consent choice because it is treated as strictly necessary for abuse prevention on forms you actively submit (ePrivacy Art. 5(3) exemption, Art. 6(1)(f) GDPR legitimate interest) — analogous to a traditional CAPTCHA. See our Privacy Policy for Cloudflare as a sub-processor (Data Privacy Framework). | Art. 6(1)(f) GDPR — legitimate interest (fraud/abuse prevention); exempt from consent |
| NEXT_LOCALE | Functional | fitnes.ro (first-party) | 12 months | Remembers your preferred language (ro/en). | Art. 6(1)(a) GDPR — consent (functional cookies category) |
| fitnes_theme | Functional | fitnes.ro (localStorage) | 12 months | Remembers your preferred color theme (light/dark/system). | Art. 6(1)(a) GDPR — consent (functional cookies category) |
| _umami_id / _umami_cache | Analytics | fitnes.ro (self-hosted Umami, first-party) | 12 months / session | Anonymous usage analytics (page views, navigation, events). No personal data is stored; IP is not recorded. Umami is self-hosted on our own infrastructure — no data leaves our servers. | Art. 6(1)(a) GDPR — consent (analytics category) |
| (no marketing cookies currently active) | Marketing | — | — | We do not currently use any marketing or advertising cookies. If this changes, this policy will be updated before activation. | Art. 6(1)(a) GDPR — consent required before activation |
Managing your preferences
You can accept or reject non-essential cookies at any time. Strictly necessary cookies cannot be disabled as they are required for the platform to function.
Your consent preferences are stored in localStorage for 12 months. After expiry, or when we update this policy, you will be asked to re-consent.