Cookie Overview
Last checked against the app’s code on
This page lists every cookie and every other item the app stores in your browser. There are only a few, and all of them are needed for the app to work.
Why There Is No Cookie Banner
We only use cookies and storage that are strictly necessary to provide the app you asked for: keeping you logged in, remembering the theme you picked, and letting the app be installed, send reminders and work offline.
Under the EU ePrivacy rules (Article 5(3) of the ePrivacy Directive) and the Dutch Telecommunications Act (Telecommunicatiewet, article 11.7a), cookies and storage that are strictly necessary for a service you explicitly requested do not need your consent. That is why the app does not show a cookie banner.
You can still block or delete them in your browser settings. If you block the session cookie you cannot log in, and without the theme cookie your theme choice is not remembered.
Cookies and Storage Used by the App
| Name | Purpose | Set by | Duration | Type | Strictly necessary |
|---|---|---|---|---|---|
__Host-session (Called “session” in local development) | Keeps you logged in. Contains a random code; the server stores only a hash of it. Scripts cannot read it (HttpOnly), it is only sent over HTTPS (Secure) and not sent with requests from other sites (SameSite=Lax). | This app (first party) | Up to 90 days. Your login ends earlier after 30 days without use, and the cookie is removed when you log out. | Cookie | Yes |
theme | Remembers whether you chose a light, dark or system theme, so pages load in the right colours. Only set when you change the theme yourself. Contains only “light”, “dark” or “system”. | This app (first party) | 1 year | Cookie | Yes |
pwa-intro-dismissed | Remembers that you closed the “Add the App to Your Home Screen” explanation on the login page, so it does not open every time. Contains only the value “1”. | This app (first party) | Until you clear this site’s data in your browser | Local storage | Yes |
steps-offline-v1 | A copy of the offline page (/offline.html, its stylesheet and the app icon), shown when you open the app without an internet connection. Pages with your data and API responses are never cached. Contains no personal data. | This app’s service worker (first party) | Until the app switches to a newer version of this cache, or you clear this site’s data | Cache Storage | Yes |
| Cloudflare Turnstile (Names chosen by Cloudflare) | Bot protection (the “Security check”). Cloudflare may store data in cookies or local storage inside its own security-check frame to complete the check. This app does not read it. Cloudflare states that Turnstile is not used for advertising or tracking across websites. Only loaded on the sign-up and forgot-password forms, and on the login form after several failed attempts. | Cloudflare (challenges.cloudflare.com, third party) | Set and removed by Cloudflare; short-lived | Cookie or local storage | Yes |
Other Browser Storage
Installing the app and turning on notifications also makes your browser store the items below. They are not cookies, but we list them for completeness.
| Name | Purpose | Set by | Duration | Type | Strictly necessary |
|---|---|---|---|---|---|
| Service worker (/sw.js) | A small script your browser keeps for this site, so the app can be installed on your Home Screen, receive notifications and show an offline page. Contains no personal data. | This app (first party) | Until you uninstall the app or clear this site’s data | Browser storage | Yes |
| Push subscription | Lets your browser’s push service (Apple, Google, Mozilla or Microsoft, depending on your browser) deliver reminders to this device. Only created when you turn on notifications. The push address and its keys are also stored on our server; see the Privacy Notice. | Your browser and its push service | Until you turn off notifications, log out on this device, remove the device in Settings, or the browser ends it | Browser storage | Yes |
What We Do Not Use
- No analytics or statistics tools.
- No advertising and no tracking pixels.
- No social media buttons, logins or embedded content.
- No third-party fonts: the app uses your device’s own fonts.
- No third-party scripts, apart from the Cloudflare security check on the forms listed above.
How to Remove Them
Logging out removes the session cookie. To remove everything, clear this site’s data in your browser settings, or uninstall the app from your Home Screen.
Keeping This List Up to Date
This list is kept in sync with the app’s code and checked whenever something that stores data in your browser changes.
If we ever want to add a cookie or storage item that is not strictly necessary, for example for statistics, it would only be loaded after you agree to it in a consent banner, and this page would be updated first.
For how we handle your personal data, see the Privacy Notice.