Cookie Policy
This policy explains what cookies and similar technologies the Iron & Tonic marketing site (ironandtonic.fitness) and the Iron & Tonic app (app.ironandtonic.fitness) use, why, and how you can control them. For broader information about how we handle personal data see our Privacy Policy.
1. What are cookies?
Cookies are small text files that a website stores in your browser. They allow the site to remember information between page loads or visits. Similar technologies include localStorage and sessionStorage, which store data in your browser locally rather than sending it to the server with every request.
2. The marketing site (ironandtonic.fitness)
The marketing site loads no third-party scripts by default. If you accept
analytics, it loads the PostHog Analytics library and sends
anonymous usage events to PostHog’s EU ingestion endpoint
(eu.i.posthog.com). Nothing non-essential loads before you make
a choice. Session replay and autocapture are disabled; only the one explicit
event — site_cta_clicked — is collected on this site.
Note: analytics are currently inert (the project key is not yet activated), so even with consent accepted, no PostHog request is made. This policy is written for the activated state, which is what visitors will encounter once the key is configured.
3. Storage reference table
The table below lists every item this site and app may store in your browser.
| Name | Type | Origin | Purpose & retention |
|---|---|---|---|
| Strictly necessary | |||
iat_cookie_consent_v1 |
localStorage | ironandtonic.fitness | Stores your analytics-consent choice (‘accepted’ or ‘rejected’). Persists until you clear it or your browser storage is reset. Note: this is localStorage, not a cookie. |
sessionid |
Cookie (7 days) | app.ironandtonic.fitness | Django session cookie. Keeps you logged in to the app. The session is renewed automatically on each visit; the cookie expires 7 days after your last activity. |
csrftoken |
Cookie (1 year) | app.ironandtonic.fitness | Django CSRF protection token. Prevents cross-site request forgery attacks. No personal data is stored in this cookie. Expires after 1 year. |
| Analytics (set only after you accept) | |||
ph_phc_…_posthog |
Cookie (1 year) | ironandtonic.fitness | PostHog Analytics. Contains an anonymous visitor identifier (distinct_id) and session properties. No personal data. The full name includes the PostHog project API key (a phc_… string). Expires after 1 year. Not set until you explicitly accept analytics. |
__ph_opt_in_out_phc_… |
Cookie (1 year) | ironandtonic.fitness | PostHog opt-out flag. Records that you have opted out of analytics so PostHog respects the choice across page loads. The full name includes the project API key. Set only when PostHog has been initialised (i.e. after a prior acceptance) and you subsequently reject analytics. |
iat_app_analytics_consent_v1 |
localStorage | app.ironandtonic.fitness | Stores the app’s analytics-consent choice (‘accepted’ or ‘rejected’). Set by the Iron & Tonic app, not by this marketing site. Persists until cleared by the user in Settings or by clearing browser storage. This is a separate choice from the marketing site’s iat_cookie_consent_v1 entry. |
ph_phc_…_posthog |
Cookie (1 year) | app.ironandtonic.fitness | PostHog Analytics cookie set by the Iron & Tonic app (not the marketing site) after the user accepts analytics in-app. Contains an anonymous visitor identifier (distinct_id) and session properties. No personal data. The full name includes the PostHog project API key (a phc_… string). Not set until the user explicitly accepts analytics inside the app. |
The sessionid and csrftoken cookies are set by
the app (app.ironandtonic.fitness) only — not by this
marketing site. The marketing site and the app are separate origins,
so cookies set by one are not readable by the other.
4. Your consent choice
When you first visit this marketing site, a banner offers you the choice to
accept or reject analytics. Your choice is stored in your browser’s
localStorage under the key iat_cookie_consent_v1. This
is not a cookie — it does not leave your device in an HTTP
header. It persists until you clear your browser storage or use the control below
to change your choice.
Nothing non-essential loads before you accept. If you reject, no analytics cookies are set and no network request is sent to PostHog — on any visit, including this one.
This consent is for the marketing site only. It does not apply to the app at app.ironandtonic.fitness, which is a separate origin.
5. Changing or withdrawing your consent
To change your current analytics choice, use the button below. It clears the stored preference and re-shows the consent banner so you can choose again.
You can also manage or delete the stored value directly in your browser’s
developer tools under Application → Local Storage
(Chrome / Edge) or Storage → Local Storage (Firefox).
Delete the entry for the key iat_cookie_consent_v1 to reset your
choice.
6. Clearing cookies
The PostHog analytics cookies (ph_phc_…_posthog and
__ph_opt_in_out_phc_…, set only if you accepted) can be
deleted in your browser settings:
- Chrome / Edge: Settings → Privacy and security → Clear browsing data → Cookies and other site data.
- Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data.
- Safari: Settings → Privacy → Manage Website Data.
Clearing all cookies will also remove your session on the app (app.ironandtonic.fitness), logging you out.
7. Third-party cookies and analytics
Apart from PostHog Analytics (only after you accept consent), this marketing
site loads no third-party resources and sets no third-party cookies.
Events accepted by PostHog are sent directly to PostHog’s EU ingestion
endpoint at eu.i.posthog.com; there is no first-party proxy.
PostHog is the data processor for analytics on this site; see our
Privacy Policy for full processor details.
The app (app.ironandtonic.fitness) may interact with third-party services
(Stripe, Google OAuth, Garmin, PostHog); those interactions may set their own
cookies governed by each provider’s policy. See the
Privacy Policy for details.
8. The app’s analytics consent (app.ironandtonic.fitness)
The Iron & Tonic app has its own analytics consent
choice, entirely separate from this marketing site’s cookie banner.
On first launch, the app presents a prompt asking whether you consent to
anonymous usage analytics. Your choice is stored in localStorage
under the key iat_app_analytics_consent_v1 (on web) or in
encrypted device storage (on Android/iOS).
If you accepted and later change your mind, open Profile → Settings → Share analytics and toggle the switch off. Revocation takes effect immediately without a restart — the PostHog SDK is disabled and stops transmitting. You do not need to clear cookies or reinstall the app.
If you have never been shown the app prompt (for example, you cleared app storage), you will be prompted again on next launch.
9. Contact
If you have questions about this Cookie Policy, please contact us at:
GitPush L.P.
Agiou Spiridonos 2
14121 Athens, Greece
[email protected]