Legal

Cookies

Last updated 1 September 2026

This page lists every cookie reckoner.fit sets, and everything else the site keeps in your browser. Two cookies are always allowed: one keeps you signed in, the other remembers the answer you gave the banner. The site also uses Google Analytics to see how it is used, and that sets cookies of its own, so it runs only if you accept. Reject and none of it loads. All of it is set out below.

The short version

Two necessary cookies. rk_session keeps you signed in and is set only when you sign in. rk_analytics_consent holds one word, your answer to the banner, so you are asked once. Neither needs permission, and neither is used to follow you.
Google Analytics, to see how the site is used. It sets its own cookies (_ga and one per property), so it runs only if you accept in the banner. Reject and it never loads.
No advertising cookies, and no advertising of any kind. Nothing here is sold to or shared with an ad network, and the analytics cannot follow you to other sites.
The analytics receives no name, no email address and nothing you type. That is enforced in the code rather than promised: see what the analytics can and cannot see.
You can change or withdraw your choice at any time, below. A Do Not Track or Global Privacy Control signal is treated as a reject, and you are never asked.
The site also uses localStorage, which is not a cookie and is never sent to the server. It holds your theme. It is listed in full below.
The Garmin watch app uses no cookies at all.

Who is asking

reckoner.fit is operated by Inner Skill Set, registered in the Netherlands with the Kamer van Koophandel under number 75619563. Anything on this page, including a complaint about it, reaches a person at hello@reckoner.fit. The wider picture of what is held about you, where, and for how long, is the privacy policy.

What a cookie is here

A cookie is a small piece of text a site asks your browser to keep and send back on the next request. That round trip is what lets a website recognize you across page loads. It is also what makes cookies useful for following people around the internet, which is why the law treats them carefully and why most sites greet you with a consent wall. Reckoner uses the first property and not the second.

The cookies

Name	What it does	Set when	Lasts
`rk_session`	Holds your session token, which is how the server knows which account a request belongs to. Without it, every page would ask you to sign in again. Strictly necessary, so it needs no consent.	You complete a sign-in with an emailed code. Never before that.	90 days, or until you sign out, whichever comes first. The same is true whether or not the account holds admin access.
`rk_analytics_consent`	Holds one word, `granted` or `denied`, which is your answer to the analytics banner. It is what stops the banner asking again on every page. It holds no identifier of any kind and nothing is derived from it. Strictly necessary in the sense that matters here: without it your choice could not be honoured, so it needs no separate consent of its own.	The moment you press Accept or Reject. Never before you answer.	12 months, or until you clear your browser data
`_ga`	Set by Google Analytics to tell one browser from another, so a return visit is not counted as a new person. First-party, readable only on reckoner.fit.	Only after you accept analytics. Never if you reject or say nothing.	2 years, or until you withdraw consent
`_ga_9N6C29TDFS`, `_ga_J8P5YTRN3V`	The companion Google Analytics cookies, holding session state. There is one per analytics property and the suffix is the property id: the public pages and the signed-in app are measured separately, and are kept apart deliberately, so a browser that has used both is holding both.	Only after you accept analytics.	2 years, or until you withdraw consent

The session cookie is first-party, and there is one place that sets it: the app at app.reckoner.fit, which is where signing in happens. The public site at reckoner.fit never sets a session cookie of its own, and it reads the one the app set the moment you have signed in, so a page there, the board among them, can act on your behalf too rather than only show you your own name. It carries HttpOnly, so no script on the page can read it, SameSite=Lax, so another site cannot make your browser send it, and Secure, so it travels over HTTPS only. What it holds is a random token, and the server keeps only a SHA-256 hash of that token, so the cookie is a key rather than a record about you. It carries no name, no email address and no training data. Signing out deletes it on the spot, at both ends.

The session cookie carries the same domain the consent cookie does, .reckoner.fit, so your browser sends it to the app and to the public site alike, and to nothing else. The consent cookie has always been scoped that way, deliberately, so the answer you give on the public site is honoured on the app at app.reckoner.fit as well and you are not asked the same question twice; it is safe to share that widely because it holds one word and no identifier. The session cookie shares the scope for a different reason: everything the public site serves is already public, so nothing there gains a new way to read or spend the cookie that the app did not already have.

Your analytics choice used to be kept in localStorage rather than in a cookie, under the key reckoner-analytics-consent-2. Browser storage is tied to one address, so a choice made on the public site could not be read by the app. Moving it to a cookie fixed that and retired every answer given under the old key, which is why you were asked once more. The old key is deleted from your browser on your next visit.

That is the complete list. If you find a cookie on reckoner.fit that is not on it, that is a bug and we want to hear about it: hello@reckoner.fit.

Your analytics choice

The session cookie is strictly necessary, so under the EU ePrivacy rules it is exempt from consent: it is explained here rather than asked about. The analytics cookies are different. They are not necessary, so they need your consent, and you get a real choice. A banner offers Accept and Reject as equal options. Nothing analytics-related loads until you accept. If you reject, or simply close the page without choosing, none of it ever runs and none of its cookies are set.

You can change your mind whenever you like, and withdrawing is as easy as giving: rejecting after you accepted stops the analytics and clears its cookies on the spot.

A Do Not Track or Global Privacy Control signal from your browser is treated as a standing reject, and the banner does not appear at all.

Legal bases: the session cookie is performance of a contract, Art. 6(1)(b) GDPR; the analytics is your consent, Art. 6(1)(a) and the ePrivacy rules on storage. Both are set out alongside everything else in the privacy policy.

Not cookies, but still your browser

The site stores a few things in localStorage, and one in sessionStorage, which is the same idea for the length of one browser session rather than kept indefinitely. Neither is a cookie: it never travels to the server, it is not attached to requests, and it is readable only by pages on reckoner.fit. The rules that cover cookies cover this too, so here is every key:

Key	What it holds
`reckoner-theme`	Auto, light or dark, so the site does not flash the wrong colors on the next page
`rk_unit`	Kilograms or pounds, chosen on the calculators at /tools, so the plates are still in your own units the next time you open one. It holds one of two words and nothing else
`reckoner-day`	Today's training day and the plan it comes out of, so the app still shows you what to lift when you have no signal. It is kept for the day it was saved on and no longer: on any later day it is ignored rather than shown to you. Signing out deletes it
`reckoner-outbox`	A session you logged with no signal, held on this device until it reaches Reckoner. It is deleted the moment it is saved, and signing out deletes it
`reckoner-install`	How many times you have opened Reckoner, and whether you have been offered the one-time note about adding it to your home screen, so you are not asked twice
`reckoner-watch-nudge-hidden`	Whether you have already dismissed the note about pairing a watch, so it does not reappear on every page for the rest of this browser session. Kept in `sessionStorage` rather than `localStorage`, so it clears itself when you close the tab or the browser rather than sitting on the device: how many times you have actually dismissed it lives on your account instead, so the note still counts up correctly the next time you open Reckoner
`reckoner-analytics-consent-2`	Where your answer to the analytics banner used to be kept. Nothing writes it now: the answer is the `rk_analytics_consent` cookie described above. It is named here because a browser that visited before the change was still holding one, and it is deleted on the next visit
`reckoner-diet`, `reckoner-veg`, `reckoner-allergens`, `reckoner-meal-picks`, `reckoner-meal-pins`, `reckoner-custom-dishes`, `reckoner-sex`, `reckoner-bw`, `reckoner-goal`, `reckoner-bodyweight_kg`, `reckoner-height_cm`, `reckoner-age`	Diet and allergen filters, meal picks and pins, dishes you built yourself, and a local copy of a few profile values. Earlier versions of the Fuel and Where you stand pages kept all of these in your browser. Nothing writes any of them now. They are named here because a browser that visited one of those pages is still holding them
`reckoner-view-grant`	On the operator console only: a short-lived pass, issued by Reckoner and good for fifteen minutes, that lets an operator open an athlete's app in a new tab to answer a support question. It holds no name and no address, it is worthless without the operator's own signed-in admin account, and it is kept in `sessionStorage` so it belongs to that one tab and clears itself when the tab closes
`reckoner-admin-col-order`	On the operator console only: which order its accounts table's columns are in, chosen by dragging a header
`reckoner-admin-page-size`	On the operator console only: how many rows of the accounts table to show at once

None of it identifies you to anyone else, and clearing your browser data removes all of it.

Two more things live in your browser and neither is a key in that table. Reckoner installs a service worker, which keeps a copy of the pages, stylesheets and scripts the app is built from so it still opens in a gym with no signal. It holds the files anyone gets, never your training and never anything about you. And if you turned notifications on, your browser holds a push subscription: an address it minted for itself so a notice can reach it, and the keys that notice is encrypted to. Signing out drops it, turning notifications off in the browser revokes it, and the privacy policy sets out what we keep against it and what the push service can see, which is that a sealed message arrived and not what is in it. Clearing your browser data removes both.

Analytics

If you accept, Reckoner uses Google Analytics 4 to see which features people actually use, so what gets built next follows behavior instead of opinion. It sets the _ga cookies listed above and loads Google's tag from googletagmanager.com. It runs only after you accept, and never on this page, the privacy policy, the terms or the admin console.

It is configured to stay narrow. Google Signals and advertising personalization are both turned off, so the data cannot be joined to an advertising profile and cannot follow you from reckoner.fit to any other site. Your IP address is truncated before it is stored, and Google uses it only to derive an approximate location, which it does not pass on to us.

There are two separate analytics properties, one for the public pages and one for the signed-in app. That split is the point rather than an accident: data retention, deletion and every sharing setting are decided per property, so keeping the two apart is what makes the limits below checkable rather than merely stated.

What the analytics can and cannot see

Never sent, and it is the code that stops it, not a policy somebody remembers. Every event goes through one function, and that function drops any parameter that is not on a fixed list for that event and rejects any value that is not a number, a true or false, or a member of a fixed set of words. There is no second route to Google. That single rule is what makes it structurally impossible for a name, an email address or anything you typed to leave the page.

No account id. No user id of any kind is sent, on either property: not a hashed email, not a session token, not a number standing in for you. An earlier version of this site did send your numeric account id, and that stopped when this page was last updated.
No training data. No loads, reps, RPE, one-rep-max estimates or tonnage. No body weight, body fat, height, age or sex. That a feature was used is counted; what you put into it never is.
No free text. Anything you write, in a note, a report or a form, reaches no event.
No page titles from the app, because a title could carry a display name. The app sends a plain word for the screen instead, like today or history.
No addresses carrying anything about you. Query strings are stripped whole, not filtered, and any address with a person in it is rewritten before it is sent.
Numbers are grouped before they leave, even harmless ones. A session with five lifts in it is counted as "4 to 6", never as five.

What that leaves is which page or screen you opened, that a feature was used, your browser and device type, and the approximate location Google derives from an IP address it truncates. If you find something we count that is not described here, that is a bug and we want to hear about it: hello@reckoner.fit.

Reject, and none of this happens: no cookies, no tag, no request to Google. There is no cookieless fallback standing in for it and no "legitimate interest" version of it running quietly underneath. The same is true if your browser sends a Do Not Track or Global Privacy Control signal.

Other people's cookies

One, and only if you accept: Google Analytics, described above, sets its _ga cookies once you opt in. Reject and there are none. No ad network, no social widget, no embedded video, no comment system, no consent-management platform. Nothing else on reckoner.fit sets a cookie except Reckoner's own two addresses, reckoner.fit and app.reckoner.fit, which are one service on one server.

One thing can be loaded from outside reckoner.fit. Once you accept analytics, the Google tag is fetched from googletagmanager.com on every page except these three policy pages, the admin console and the specimen pages we build designs against, so it never loads here at all. The icon font the app draws its menu glyphs with used to come from a public CDN. It is served from reckoner.fit itself now, the same as every other file on the site, so it is not a second address and there is nothing further to disclose about it. Your browser's IP address is visible to Google when the tag fetches, and to nobody else.

The watch app

The Connect IQ app has no browser and no cookie jar. When you pair a watch it receives its own long-lived token, which lives in the watch app's own storage and is sent as an ordinary authorization header. You can revoke it at any time on the Devices page, which kills it immediately. It is not a cookie and nothing on this page applies to it.

Controlling cookies yourself

Every browser lets you see the cookies a site has set, delete them, and block them ahead of time. It is usually under Settings, then Privacy, and you can normally get there fastest from the padlock in the address bar while you are on the site. Some browsers block third-party cookies by default, which changes nothing here, because there are none to block.

Deleting rk_session, or blocking cookies for reckoner.fit, signs you out. Nothing else breaks, and nothing is lost: your training history lives on the server, so signing back in brings it all with you. Deleting rk_analytics_consent forgets your answer, so the banner asks again, and until you answer, nothing analytics-related runs. Blocking localStorage as well costs you the theme choice, which is the only thing the site keeps there.

Changes

If Reckoner ever sets another cookie, it will be on this page before it is in your browser, and the date at the top will change with it. Anything that needs your consent will ask for it properly rather than assume it. The current version is always at https://reckoner.fit/cookies.