Legal

Cookie Policy

Last updated: 23 June 2026

The short version. Bookr only uses cookies that are strictly necessary for the service to work — keeping you logged in, protecting against fraud, remembering what's in your booking. We do not use advertising cookies, third-party analytics trackers, or anything that follows you around the web. Because only strictly-necessary cookies are used, there's nothing to consent to or opt out of — the small cookie notice you may see is just there to let you know cookies are in use.

What cookies are

Cookies are small bits of data that websites store on your device to remember you between visits. Some are essential ("you're logged in"), others are optional ("show this person ads about trainers"). UK law (the Privacy and Electronic Communications Regulations, "PECR") requires consent for the optional ones — but allows the essential ones without prompting.

Cookies we use

Name	What it does	Set by	Expiry
`sb-access-token`	Keeps you logged into your Bookr account.	Bookr (via Supabase)	1 hour, refreshed automatically
`sb-refresh-token`	Lets us refresh your login without making you sign in again.	Bookr (via Supabase)	Session — expires when you log out or after 7 days of inactivity
`__csrf` (or equivalent)	Cross-site request forgery (CSRF) protection — validates that form submissions come from the Bookr site and not a third-party page. Contains no personal data.	Bookr	Session
`bookr_demo_bookings`	Stores guest bookings locally so you can find them again before creating an account. (Technically localStorage, not a cookie — same idea.)	Bookr	Until you clear browser storage
`__stripe_mid`, `__stripe_sid`	Set by Stripe's fraud-prevention script (Stripe.js), which loads on the Bookr booking page. They are stored in the first-party `mybookr.app` context and used by Stripe to detect and prevent payment fraud. Bookr does not read or control these cookies; they are governed by Stripe's privacy policy.	Stripe (set in the first-party `mybookr.app` context)	Up to 1 year (`__stripe_mid`); session (`__stripe_sid`)

Cookies we don't use

No advertising cookies. No Facebook Pixel, no Google Ads tracking, no LinkedIn Insight.
No third-party analytics. No Google Analytics, no Mixpanel, no Segment.
No "do not sell my data" toggle needed — we don't sell your data and we don't have anything to toggle.

If that ever changes (e.g. we add lightweight first-party analytics) we'll update this page and put a banner up before setting anything new.

Third-party services that set cookies

When you reach the payment step, Stripe's payment library (Stripe.js) loads directly on the Bookr booking page rather than redirecting you elsewhere. Stripe sets its own cookies — __stripe_mid and __stripe_sid — in the first-party mybookr.app context to help detect and prevent fraud. These cookies are governed by Stripe's privacy policy; Bookr doesn't read or control them.

How to control cookies

You can block or delete cookies in your browser settings. Be aware that blocking the essential ones will sign you out of Bookr and break the login flow. Useful links:

Changes to this policy

If we change what cookies Bookr uses, this page will move and we'll surface notice in the app for material changes.

Contact

Questions? Email support@mybookr.app.