What cookies and browser storage are
Cookies are small text files a website stores in your browser so it can recognise you on your next request — for example to keep you signed in. Browsers offer similar storage without cookies (local storage and session storage); this policy covers both, and treats them the same way the law does.
We split everything into two groups: things that are strictly necessary for a service you asked for, which need no consent, and analytics, which only run after you say yes.
Where this policy applies
- kosoku.app — this website. It sets no cookies and uses no browser storage or analytics. Nothing to accept here.
- coach.kosoku.app — the coach web app. Sections 03 to 05 describe exactly what it stores.
- Kosoku athlete apps (iOS and Android) — no cookies. The app keeps your sign-in token and preferences on the device, and analytics only run after you consent inside the app. Details are in the Privacy Policy.
Strictly necessary cookies
These make signing in and staying signed in possible. Without them the coach web app cannot work, so they are set without asking (Art. 6(1)(b) GDPR, § 25(2) TDDDG). All of them are first-party cookies on coach.kosoku.app; on HTTPS the sign-in cookies carry the __Secure- prefix.
| Name | Purpose | Duration |
|---|---|---|
kosoku.session_token | Keeps you signed in. | 7 days, renewed while you use Kosoku |
kosoku.session_data | A signed copy of your session so pages don't have to query the database on every request. | 60 seconds |
kosoku.state, kosoku.pkce_code_verifier, kosoku.nonce | Protect the Google / Apple sign-in handshake against forgery. | Deleted when sign-in completes (minutes) |
kosoku_consent | Remembers your cookie choice so the banner doesn't come back. | 12 months |
Preference cookies
These only store choices you made yourself, so the app looks the same on your next visit. They contain no identifier and are not shared with anyone; we treat them as necessary for the features you used.
| Name | Purpose | Duration |
|---|---|---|
kosoku_tz | Your time zone, so “today” and “this week” match your calendar. | 12 months |
sidebar_state | Whether the sidebar is collapsed. | 7 days |
theme (local storage) | Light or dark mode. | Until you clear browser data |
Analytics — only with your consent
To understand how coaches use Kosoku and to find bugs, we use PostHog, hosted on PostHog's EU cloud in Frankfurt, Germany. Nothing below is loaded, stored or sent until you click Accept analytics in the banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you choose Essential only, the PostHog script is never started.
| Name | Purpose | Duration |
|---|---|---|
ph_<project token>_posthog (cookie and local storage) | A random visitor id, the current session id and a few technical properties (browser, device, referrer) so page views belong to one session. | 12 months |
__ph_opt_in_out_<project token> (local storage) | Written only when you withdraw consent, so PostHog stays off even if it were started by mistake. | Until you clear browser data |
ph_<project token>_window_id, ph_<project token>_primary_window_exists (session storage) | Tell tabs of the same session apart. | Until the tab is closed |
With analytics on, PostHog receives:
- page views, clicks and form submissions (which control, not what you typed);
- browser, operating system, screen size, language and the approximate location PostHog derives from your IP address;
- session replays — a recording of how the interface changed while you used it. All text on the screen and everything you type is masked before it leaves your browser, so athlete names, health values and messages are not part of the recording;
- JavaScript errors, with the page they happened on;
- once you are signed in: your user id, email address, name and role, and the organization you are working in, so we can answer your support requests.
PostHog deletes session replays after 30 days and event data after 12 months at the latest. Analytics cookies are never used for advertising and are not shared with anyone else.
Managing your choice
The banner appears on your first visit to coach.kosoku.app. Both buttons are one click; neither is preselected. You can change your mind at any time:
- Cookie settings in the footer of every public page of the coach web app;
- Settings → Preferences → Privacy & analytics when you are signed in.
Withdrawing consent stops analytics immediately and deletes the PostHog cookie and storage entries from your browser. Data already sent to PostHog is kept only for the periods above.
You can also block or delete cookies in your browser settings. If you block the strictly necessary cookies you will not be able to sign in.
Do Not Track and Global Privacy Control
If your browser sends a Do Not Track or Global Privacy Controlsignal, we treat it as “essential only”: analytics stay off and the banner is not shown at all. You can still turn analytics on yourself under Cookie settings — an explicit choice you make always wins over the browser signal.
Third parties
PostHog, Inc.
2261 Market Street #4008, San Francisco, CA 94114, USA. We use the EU cloud, hosted in Frankfurt (AWS eu-central-1), under a data processing agreement. Analytics data stays in the EU. posthog.com/privacy
Vercel, which hosts our sites, sets no cookies on kosoku.app or coach.kosoku.app.
Coaches can embed exercise videos from YouTube or Vimeo. When such a video is played, the provider may set its own cookies under its own policy (Google, Vimeo). Nothing is loaded from them until the video is opened.
Changes to this policy
We update this page whenever the cookies or storage we use change. If a change needs your consent again — for example a new analytics purpose — the banner will ask you again, even if you had already decided.
Contact
Damon Basler
Kampstraße 20
20357 Hamburg
Germany
Email: kosoku@damonbasler.de
How we handle personal data in general — including what analytics means for signed-in users — is described in the Privacy Policy.