Cookie Policy
What Alpha CRM stores in your browser, why, and what waits for your permission.
Last updated 2026-10-21
The short version
Alpha CRM embeds no advertising network, no analytics SDK and no third-party tracker. It sets four cookies of its own. Two keep you signed in; the third remembers whether you chose English or Greek; the fourth remembers whether a member of gym staff collapsed one panel on one screen. None of them is used to profile you or follow you to another site.
The one thing that does ask permission is page-speed measurement, which is off until you accept it in the banner. That banner appears on your first visit and is described below.
Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| sb-access-token | Your signed-in session. The token is issued by Supabase Auth and verified on every request. Strictly necessary — without it there is no way to be signed in. | 30 days |
| sb-refresh-token | Renews the session above without making you sign in again. Strictly necessary. | 30 days |
| lang | The language you chose for this site, set when you press the language switch, or when you sign in, from the language saved on your account. It holds only en or el and nothing else. A preference you chose, so it does not need separate consent. | 365 days |
| workouts-recommended | Set only for gym staff, and only when they collapse the “recommended workouts” panel on the staff dashboard. It holds the single value hidden and nothing else; expanding the panel again deletes it. A preference you asked for by clicking, so it does not need separate consent. | 365 days |
All four are first-party (set by this site, on this domain) and are sent only to this site. The two session cookies and the panel cookie are HTTP-only, so no script in the page, ours or anyone else’s, can read them; the language cookie is not, because the page reads it to show the right language before it has finished loading, and it holds nothing but the language. On the live deployment they are marked Secure and SameSite=Lax. Signing out deletes the two session cookies immediately; otherwise their 30 days start again each time your session is renewed while you use the site.
Stored in your browser, but not in a cookie
Two small values are kept in your browser’s local storage rather than in a cookie. Neither is sent to our servers with a request, the way a cookie is.
alpha-crm-theme— whether you chose the light or the dark appearance, so the page does not flash the wrong one while it loads. On the member portal your choice is also saved to your account, so that it follows you to your other devices.alpha-crm-cookie-consent— your answer to the banner, so you are not asked again. This is why answering the banner on one device does not answer it on another, and why clearing your browser data brings it back.
Pages saved for offline use
On the member portal, your browser keeps a copy of each portal page you open, so your program can still be read with no signal. The copy stays on your device and is used only when there is no connection; online you always get the current page. It also keeps the site’s own scripts and styles, which hold nothing about you, until the next update. Signing out deletes every saved page. If your session expires instead, they are deleted the next time the portal sends you to the sign-in page, and an update to the site replaces them the next time you open the portal online. Staff pages are never saved.
Notifications on a device
If you turn on notifications in the member portal, your browser keeps a notification subscription for this site and sends its address to us, so that we can reach that device. We keep it with a label such as “Chrome on Android”, so that you can tell your devices apart. Turning notifications off removes it from your browser and from our records. Signing out unsubscribes that device, and our copy is deleted the next time a notification to it is refused.
What consent actually switches on
Accepting in the banner switches on one thing: page-speed measurement. When a page loads more slowly than our performance budget allows, the browser sends us the address of the page you were on and a timing figure. There is no identifier in that report, and nothing is sent for a page that loaded acceptably. Rejecting, or simply not answering, means it never runs — the default is off.
You can change your mind by clearing this site’s data in your browser, which removes the stored answer and brings the banner back.
One thing that does not wait for consent
If a page crashes in your browser, an error report is sent to us whether or not you have answered the banner. It contains the error message, the internal identifier of the failure and the path of the page — not your name, your account or the contents of any form. We treat this as strictly necessary: an app that cannot find out that it broke cannot be kept secure or working, and we would rather tell you about it here than hide it behind a consent toggle it does not honestly belong behind.
Cookies other people set
Two screens hand you over to Stripe: the checkout page a member is sent to in order to pay, and the account-verification panel a gym owner completes in Settings. The checkout page runs on Stripe’s own domain; the verification panel loads Stripe’s script into the page and runs in Stripe’s own frame. Any cookie set there is Stripe’s, under Stripe’s privacy policy. We do not read them and cannot set anything through them.
Nothing else third-party loads in these pages — no fonts, tags, pixels or maps — with one exception: exercise pictures and clips, which your browser fetches straight from where they are hosted (for the built-in exercise library, GitHub). That site sees your device’s address, as any web server does, but nothing it sets can be read by us.
More about your data
What we collect, why, who processes it and how to get a copy or have it erased is set out in the Privacy Policy.