What sits in your browser.

This is the complete list. It is set by HormoTize.com itself, not by anyone else.

• Name: hormotize.locale
• Contents: 'nl' or 'en', nothing else.
• Purpose: remembering which language you are reading, so a later visit to hormotize.com opens in the same one instead of guessing again.
• Lifetime: one year from your last visit, renewed when you switch language.
• Settings: valid across the whole site, SameSite=Lax, so it is not sent along with requests started from other websites.

The cookie holds no identifier, no account number and nothing that says anything about you. If it is not there, nothing breaks: the language is then chosen from the languages your browser asks for, and failing that from the country the request comes from, and otherwise English.

When you sign in on the website, one entry is written to local storage under the name hormotize.session. It holds the sign-in token your browser needs to prove to our own server that it is you, together with the name and email address of your account so the page can greet you without asking the server again.

• It is only written once you actually sign in; a visitor who only reads the site never gets it.
• It stays until you sign out or clear this site's data, whichever comes first.
• It goes to our own API and nowhere else. No third party can read it, because the storage belongs to hormotize.com alone.
• Unlike a cookie it does not travel along with every request by itself; the page reads it and sends it on only when it calls our API.

Without it, signing in would last exactly one page view. That is why it is there, and why it is needed for the parts of the site that only exist for signed-in visitors, such as the checkout.

Explicitly, so you know what is not there:

• No analytics or measurement. No Google Analytics, no Plausible, no Matomo, no self-built counter. We do not know how many of you there are or which pages you read.
• No advertising or retargeting pixels, and no tracking from social networks.
• No profiling, no A/B tests and no personalisation of the website based on your behaviour.
• No cookies from other parties on our own pages. Everything in the two sections above comes from hormotize.com itself.
• No fonts fetched at the moment you visit. The two typefaces are built into the site and served from our own domain, so opening a page does not quietly make a request to Google.

Consent is needed for storage that serves someone other than you: measuring, profiling, advertising. Storage that is strictly necessary to deliver the page you asked for, and storage that only records a preference you set yourself, is exempt under Article 11.7a(3) of the Telecommunications Act.

Both of ours fall inside that exemption, and we have nothing outside it. So there is nothing to ask you, and a banner would only be a click without a choice behind it. If we ever want to place something that does need consent, we will ask you before it is placed, and this page will say what it is first.

No one else stores anything in your browser through us, but some pages do load something from elsewhere. Any request reveals your IP address to whoever receives it, so here is the full list:

• OpenStreetMap, on the page with the draw locations. The map background is loaded as tiles from tile.openstreetmap.org. Your IP address and the tiles you look at reach them; nothing else, and nothing about your account.
• PDOK, when you type an address at checkout or search the map. PDOK is the Dutch government's public location service. The postcode and house number you type travel to it to get back a street and town. Nothing else is sent with it.
• Stripe, when you pay. You leave hormotize.com at that point and the payment runs on Stripe's own page. Whatever Stripe stores in your browser there is theirs, under their own cookie statement, and your card details never reach us.

None of these three place a cookie on hormotize.com. They are requests the page makes, not trackers watching you.

You are in charge of both, from your browser, without us in the middle.

• Deleting: in your browser's settings, under privacy, choose to clear site data and pick hormotize.com. The cookie and the local storage entry go together.
• Refusing in advance: in the same settings you can block cookies and site data for this site. The pages keep working; you will be asked for your language again each visit and you will not stay signed in.
• Checking: open your browser's developer tools and look under Application or Storage. Everything described on this page is visible there, and you will find nothing beside it.

The HormoTize app is not a browser and sets no cookies. It keeps your sign-in in the secure storage your phone provides for it (the Keychain on iOS, the Keystore on Android), together with your settings and the data already synced, so the app opens without a wait and works without a connection. If you switch on notifications there is also a device token, which is what lets a message reach your phone.

What we do with that data, and for how long, is in the privacy statement. Removing the app takes the copy on your phone with it; deleting your account removes the data on our servers.

If we add anything that stores or reads something on your device, this page changes before the thing itself goes live, and the date at the top changes with it. Anything that requires consent will be asked for, not assumed.

If something here is unclear, or you think your browser holds something this page does not mention, email [contact address] and we will look into it. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague, autoriteitpersoonsgegevens.nl.