Cookie Policy
Last updated: 24 February 2026
Good news — no cookies, no consent banner needed
The coheart.io website sets no cookies whatsoever. We use Plausible Analytics, which is fully cookieless and collects no personally identifiable information. The Coheart application (app.coheart.io) uses browser localStorage rather than cookies for authentication. Because no cookies are used anywhere, no consent banner is required under UK PECR.
1. What Are Cookies?
Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites work efficiently and to provide information to the site owners.
Cookies can be “session cookies” (deleted when you close your browser) or “persistent cookies” (stored for a set period or until you delete them).
2. Cookies and Local Storage We Use
Because we use Plausible Analytics (cookieless), our cookie footprint is minimal.
Authentication uses localStorage, not cookies. The Coheart application (app.coheart.io) stores your session authentication token in your browser's localStorage under the key coheart_session. Because this is localStorage rather than a cookie, it is never automatically sent to our servers by your browser — it is sent only when the application explicitly includes it in an API request header. This design also eliminates the most common CSRF (Cross-Site Request Forgery) attack vector, since browsers cannot forge localStorage-based requests via third-party sites.
The coheart_session localStorage item contains no personal data — it is an opaque reference to a server-side session record.
Functional localStorage items:
| Key | Purpose | Storage | Type |
|---|---|---|---|
| coheart_session | Keeps you logged in. Opaque reference to a server-side session — contains no personal data. | localStorage (not a cookie) | Strictly necessary |
| coheart_cookie_consent | Stores your cookie consent preferences so we do not ask again. | localStorage (not a cookie) | Strictly necessary |
These localStorage items are strictly necessary for the secure operation of the platform. Because they are not cookies, UK PECR consent requirements do not apply to them. You can clear them at any time via your browser's developer tools or by clearing site data, though doing so will log you out of the application.
3. Analytics — Plausible (Cookieless)
coheart.io uses Plausible Analytics to understand how visitors use the site. Plausible is an open-source, privacy-friendly analytics tool:
- No cookies are set by Plausible.
- No personal data is collected or stored.
- No cross-site or cross-device tracking occurs.
- Aggregate traffic statistics only (page views, referrers, device types).
- Data is processed in the EU and not shared with third parties.
For more information, see Plausible's data policy.
4. Transactional Emails and Mailchimp
Coheart uses Mailchimp Transactional (Mandrill) to deliver service emails such as password reset links, account invitations, and session reminders. When you receive one of these emails, Mailchimp acts as our data processor and handles delivery of the message.
No email tracking. Open tracking (tracking pixels) and click tracking are disabled for all emails sent by Coheart. This means:
- No tracking pixel is embedded in our emails — opening an email does not send any data back to Mailchimp or Coheart.
- Links in our emails are not wrapped through Mailchimp redirect servers — clicking a link takes you directly to the destination.
- No cookies are set on your device as a result of receiving or opening our emails.
For full details on how we use Mailchimp and how your email address is protected, see the Privacy Policy — Section 6.
5. How to Control Cookies
You can control and delete cookies through your browser settings. Note that disabling the strictly necessary cookies listed above may prevent you from logging in to the Coheart application.
Browser cookie controls:
6. Changes to This Policy
We may update this Cookie Policy from time to time. Any changes will be posted on this page with an updated “last updated” date.
Questions? Contact us at privacy@coheart.io.