1. What are cookies?

Cookies are small text files stored in your browser by websites you visit. They allow the service to recognise you across pages and visits. This policy also covers similar local-storage mechanisms.

2. How we use cookies

NutraPlanner uses a minimal set of cookies, strictly for operating the service:

  • Authentication cookie (next-auth.session-token): a secure, HTTP-only session cookie that keeps you signed in. This is a JWT-based token that expires after 24 hours. Without it, you would need to log in on every page.
  • CSRF token (next-auth.csrf-token): prevents cross-site request forgery attacks on authentication forms.
  • Callback URL (next-auth.callback-url): stores the redirect URL during sign-in so you return to the correct page after authentication. HTTP-only, short-lived.
  • OAuth state (next-auth.state): validates the OAuth state parameter to prevent cross-site attacks during Google sign-in. HTTP-only, short-lived.
  • PKCE verifier (next-auth.pkce.code_verifier): part of the PKCE OAuth security flow used during Google sign-in. HTTP-only, expires after 15 minutes.
  • Language preference (lang): stores your chosen language (English or French) so the site loads in the correct language on each visit.
  • Booking hand-off (np_booking_confirm): when you book an appointment, your name and email are held briefly in your browser's sessionStorage so the confirmation screen can show them without putting them in the page address. This is cleared when you close the tab, and it is never sent anywhere other than the booking request you submitted. We use sessionStorage here specifically so these details do not end up in a URL that could be logged or shared.
  • Booking timezone (localStorage): if you pick a timezone on a booking page, we store that choice in your browser so a return visit does not ask again. It is a display preference only and is never sent to us as a tracking identifier.
  • Bot protection (Cloudflare Turnstile): booking pages, sign-up, sign-in and password-reset forms load a bot-detection widget from Cloudflare. Cloudflare receives your IP address and basic device signals in order to tell a person from an automated script; this is strictly necessary to stop our booking pages and account forms from being abused. We use the standard widget without pre-clearance, so it does not place a cookie on your device. Cloudflare acts as our service provider and classifies these signals as strictly necessary security data.
  • Error monitoring (Sentry): Sentry is currently DISABLED and receives nothing from this service. If we enable it, it would store a per-session identifier in your browser to group errors from the same browser session, and record a short trail of recent user-interface interactions (route changes, button clicks — never form values) that immediately precede an error, to help us reproduce and fix bugs. Session replay would not be enabled, and no client health data, passwords, or payment-card details would be transmitted. We describe it here so this page stays accurate about what the software can do, not only what it is doing today.
  • Local storage: we store your sidebar collapse state in browser localStorage (not a cookie), but mention it here for transparency.

3. What we do not use

We do not use:

  • Third-party analytics cookies (no Google Analytics, no Mixpanel, etc.). We do not currently run any analytics on this service at all; if we add one it will be a cookieless tool such as Plausible, and we will update this page first
  • Advertising or tracking cookies
  • Social media tracking pixels

4. Your choices

You can configure your browser to refuse cookies, but the authentication cookies listed above are required for the service to function. If you block them, you will not be able to sign in.

All cookies and local-storage entries described in section 2 are strictly necessary for operating the service (authentication, security, language preference, error monitoring). Under Canadian privacy law (PIPEDA and Quebec Law 25), consent for strictly-necessary cookies is implied by your continued use of the service.

Booking pages embedded on a practitioner's own website (inline or pop-up) set no cookie or storage that requires your consent. They use only the strictly-necessary and preference items described in section 2, so embedding our booking page does not create a consent obligation for the practitioner's site.

5. Users in the European Economic Area, United Kingdom, and Switzerland

Under the EU ePrivacy Directive and equivalent UK / Swiss rules, consent is required for non-essential cookies. NutraPlanner currently uses only strictly-necessary cookies (those listed in section 2), which are exempt from the consent requirement. If we add any non-essential cookie in the future, we will present a consent banner and obtain your opt-in before setting it.

6. Changes to This Policy

If we change the cookies we use, we will update this page and update the effective date above. For material changes (such as adding a new category of cookie or a new third-party recipient), we will notify account holders by email at least 30 days before the change takes effect.

7. Contact Us

If you have any questions about our use of cookies, please contact our Privacy Officer at sam@nutraplanner.com or our general support at hello@nutraplanner.com.