Cookies
One key stores your answer to the banner. Page views are counted without cookies. Everything else waits until you say yes.
This page lists every cookie and browser-storage entry getsixpack.app uses, what sets it, and what turns it on. The site is operated by Data Sauna LLC, a Wyoming limited liability company. Read it alongside the Privacy Policy.
The short version: one first-party key remembers what you chose, two page counters run for everyone and store nothing on your device, and the two tools that do store something are not on the page at all until you choose them. There is no advertising here, no ad network, no ad slot and no social pixel — and none is planned. Nothing on this site is funded by selling attention or data. The one caveat is in section 4: accepting Microsoft Clarity sets a Microsoft cookie that Microsoft uses for advertising elsewhere in its own network. That is Microsoft's, not ours, and it is one more reason Clarity waits for your yes.
1. What counts as a cookie here
A cookie is a small file a site stores in your browser. The same rules
cover similar technologies — localStorage,
sessionStorage, pixels and SDKs — and this page treats them
all the same way, because from your side of the screen they are the same
thing: something written to your device.
Under the EU ePrivacy Directive, the UK's PECR and equivalent laws, storing or reading information on your device needs either your prior consent or the “strictly necessary” exemption. That distinction is what the sections below are organised by.
2. Strictly necessary — no consent needed
One entry, first-party, set by this site. It contains no identifier, no address and nothing about you.
| Name | Type | What it is for | Lifetime |
|---|---|---|---|
gsp-consent | localStorage | Remembers what you chose on the banner, so your answer is honoured on later pages and you are not asked again. Its entire contents are your two answers, the date you gave them, and the version of this page they were given against — no identifier and nothing about you. | Until you clear your browser data |
Legal basis: strictly necessary to provide a service you explicitly requested — recording a consent choice is the one thing that cannot itself require consent (Article 5(3) ePrivacy exemption).
3. Cookieless measurement — runs for everyone
Two tools count page views without touching your device, and both run
from the first page you open. Neither sets a cookie, writes to
localStorage, or fingerprints your browser.
- Vercel Analytics. Our host counts a visit by hashing your IP address and your browser together on its own server. That hash is thrown away and rebuilt every day, so it cannot be joined to yesterday's and it cannot follow you to another site.
- Cloudflare Web Analytics. The same job by a different route: a visit is derived from the request itself and the derivation is discarded. Cloudflare does not build a profile from it and has no advertising business to feed it into.
Both are still a request to somebody else's server, and a request carries your IP address, the page you are on and your browser's user agent — that is true of any request to any server. What they do not do is leave anything behind on your device, which is what the consent rule is about.
Google Analytics used to be in this section and is not any more. It ran for everyone in a cookieless mode. It now waits for your yes, alongside Clarity, because a cookieless ping still sends your IP address and the page you are on to Google — and the European regulator's current position is that a transmission carrying information from your own device can require consent whether or not a cookie is involved. That question is not settled. We would rather ask you than argue about it.
Legal basis: our legitimate interest in knowing whether anyone is reading the site (Article 6(1)(f) GDPR). You have the right to object to processing on that basis — email and we will tell you what can be switched off for one reader and what cannot.
4. Optional analytics — only after you accept
These are two separate choices and the banner asks them separately, because counting page views and recording one person's visit are not the same thing. Tick either, both or neither. Neither tool is on the page — no script, no request, nothing — until you say so.
| Provider | What it does | What it stores | Policy |
|---|---|---|---|
| Google Analytics 4 Google LLC / Google Ireland | Aggregate audience measurement — which pages get read, where readers arrive from, roughly where they are, what device they are on. |
First-party cookies on getsixpack.app:
_ga and _ga_XXXXXXX, up to 2 years.
Set only after you accept.
| Google privacy |
| Microsoft Clarity Microsoft Corporation | Heatmaps and session replay. Clarity reconstructs your visit as a playable recording — mouse movement, clicks, scrolls, the pages you moved through and how far down each one you got — so we can see where a layout is losing readers. Typed text and input values are hidden by Clarity's default masking. Microsoft is not acting on our instructions here: it is a controller of this data in its own right and uses it to improve its own services. |
On clarity.ms and Microsoft's own domains:
_clck (1 year), _clsk (1 day),
CLID (1 year), ANONCHK (10 minutes),
MUID, MR (7 days) and SM.
MUID is Microsoft's own browser identifier
and Microsoft uses it for advertising elsewhere in its
network. We do not advertise and we never see it, but
accepting Clarity is what sets it, and you should know that
before you press the button. None of these is loaded unless you
accept.
| Microsoft privacy |
Legal basis: your consent (Article 6(1)(a) GDPR and the Article 5(3) ePrivacy consent rule). It is optional, nothing on this site is gated behind it, and you can withdraw it at any time — see section 7.
Session replay is the one tool on this list that records a person rather than counting a page, which is why it has its own box on the banner. A recording exists only of visits where you ticked it first. If you reject, ignore the banner, or send Global Privacy Control, there is no recording of you.
Two limitations, stated rather than implied. Withdrawing consent stops Google Analytics reading or writing its cookies from that moment, and we delete the ones we set on this domain — but a Clarity script that has already loaded on the page you are looking at keeps running until you navigate, and the cookies Clarity set on Microsoft's own domains are not ours to delete. Clearing your browser data removes both, and section 7 links the instructions for every browser.
5. Third parties on this domain
Apart from the two tools in section 4, nothing third-party sets a cookie on this domain. The fonts are self-hosted from this server, the images are local, and there are no embeds — no YouTube player, no Instagram post, no social widget.
A page you load before answering the banner makes no request to Google or to Microsoft at all. Neither script is on the page. That was not true of an earlier version of this site, which loaded Google Analytics for everyone in a cookieless mode — the request itself still went to Google, carrying an IP address and a page, and this page said otherwise. Both now wait.
The two counters in section 3 are contacted, and they are the
only ones. Vercel is our host and is serving you the page
anyway; Cloudflare's beacon loads from
static.cloudflareinsights.com. Neither leaves anything on
your device, which is why they are not behind the banner — but they are
requests to another server and this page is not going to describe them
as though they were not.
Our host (Vercel) keeps standard server request logs — IP address, user agent, the URL requested — as a property of hosting anything on the internet. Those are logs, not cookies, and they are not readable from this site. See Vercel's privacy policy.
6. The app, which has no cookies but does store things
A mobile app has no cookies — cookies are a browser mechanism, and the GETSIXPACK app is not a browser. It does store things on your device, and the same principle applies to them, so they are listed here rather than left out on a technicality:
- Your training data and a sign-in token, held locally so the app works with no signal and you are not asked to sign in every session. Strictly necessary — this is what the app is.
- Your settings: units, rest sound, whether the screen stays awake, and the rest of what you have chosen.
- A pseudonymous analytics identifier for your install, used by PostHog and Google Analytics so a run of screens reads as one session. It is not an advertising identifier, it is not Apple's IDFA, and it does not follow you into any other company's app or website.
What those analytics tools receive is behaviour, not your training. Screens opened, actions taken, app version, device model, OS version, crashes. Never a load, a rep count, an effort rating, your bodyweight or your heart rate. The Privacy Policy sets out that split in full and is the page to read for the app.
One thing in the app can set a cookie, and only if you press it. Some exercises carry a demonstration video hosted on YouTube, in a card that stays closed until you open it. Opening it fetches the clip's still image from Google and sets no cookie; only pressing play loads the player, and it is loaded from youtube-nocookie.com. Whatever it stores is held in memory and discarded when you leave the screen — it is never written into the app's own storage and it does not survive to the next session. Press play and your device is talking to Google under Google's privacy policy; leave the card shut, and nothing is requested at all.
Apple also collects its own diagnostics from every app on the device and shares an aggregate view with developers, but only where the device owner has left Share With App Developers switched on in Settings › Privacy & Security › Analytics & Improvements. That is Apple's collection under Apple's policy, and switching it off there stops it.
7. Changing your mind
Use — here, or in the footer of any page — to reopen the banner and change your answer. Withdrawing is one press, exactly like giving consent was.
Your answer is recorded on your own device with the date you gave it and the version of this page it was given against. If either of the optional tools changes what it does, the version moves and the banner asks again rather than carrying an old yes forward. A yes also lapses after a year. A no is kept as long as a yes, and longer if you never come back — being asked again because you declined is the nagging pattern, not diligence.
You can also clear cookies and localStorage in your browser
at any time, which removes gsp-consent and brings the banner
back on your next visit:
Chrome,
Safari,
Firefox,
Edge.
8. Global Privacy Control
If your browser sends the Global Privacy Control signal, we treat it as an opt-out and it overrides everything else — including an Accept previously stored on that device. With GPC on, the optional tools never load, on every page, and you are not shown the banner at all, because we are not going to ask a question we have already decided to answer your way. Open it from Cookie settings and it says exactly that, and offers you Reject rather than an Accept button that could not do anything.
Vercel Analytics still counts the page, because there is nothing on your device for it to stop doing — see section 3.
9. Changes
If the tools on this site change, this page changes in the same release and the “Updated” date moves. There is no version of this that gets edited later.
10. Contact
Data Sauna LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, USA. Questions about cookies or tracking: .