Cookies and storage on your device
The Ghisa Pro app, for people who train.
Italiano · English · Español · Français · Deutsch · Nederlands · Polski · Português (Brasil) · Português (Portugal) · 日本語
On the website, in the panel and in the browser app there is no banner asking you to accept cookies, and that's not an oversight. There, Ghisa Pro uses no profiling cookies, doesn't track you and doesn't host third-party tools that do. What gets saved on your device only serves to make what you asked for work: that's why the law doesn't require your consent, but does require us to explain it to you. That's what this page does. The only exception is the free plan with ads in the iPhone and Android apps: there, the Google AdMob library uses the phone for ads, and first asks for your consent with its own dialog (point 3b).
The rule is article 122, paragraph 1, of Legislative Decree 196/2003 (the Italian Privacy Code, Codice Privacy), which allows storage “to the extent strictly necessary” to provide the service requested. The guidelines of the Italian Data Protection Authority (Garante per la protezione dei dati personali) of 10 June 2021, no. 231 specify that these technical tools don't require consent (paragraph 5) and that information must still be provided (paragraph 8).
The rule doesn't only talk about “cookies”, but about any information stored on your device: it also covers localStorage, IndexedDB and the app's cache. That's why you'll find all of it below.
1. On the ghisapro.com website
| Name | What it's for | How long it lasts |
|---|---|---|
ghisa.sito.theme | remembers the light or dark theme | until you clear the site data |
ghisa.lang | remembers the chosen language | until you clear the site data |
They're only written if you touch the theme or language selector. The website uses no cookies.
2. In the palestre.ghisapro.com panel
| Name | What it's for | How long it lasts |
|---|---|---|
sb-…-auth-token | the sign-in session: keeps you signed in without logging in again on every page | until you sign out or the session expires |
ghisa.pal.theme, ghisa.pal.lang, ghisa.pal.menu | theme, language and menu expanded or collapsed | until you clear the site data |
ghisa.pal.catalogo | a copy of the exercise catalog, so it isn't downloaded again every time | until the catalog is updated |
ghisa.pal.lettore | whether this computer has the QR code reader for entries | until you clear the site data |
ghisa-pannello (IndexedDB) | the reference to the folder where receipts are saved, if you chose one | until you clear the site data |
ghisa.pal.schedaNuova (sessionStorage) | the program just created in the editor, to remove it if you leave it empty | until the browser tab is closed |
ghisa.pal.esempio, ghisa.pal.demo, ghisa.pal.test | only for the example gym and for automated tests | the length of the test |
3. In the Ghisa Pro app
The app works even offline, so a copy of your data lives on the device. It's not there to recognize you: it's there so you can log a set in a gym with no signal.
| Name | What it's for |
|---|---|
ghisa_acc (cookie) | only for the browser app: tells our server you've already signed in, so it delivers the app to you. It's HttpOnly (the page's scripts can't read it), only valid on app.ghisapro.com and lasts 180 days; it's deleted when you sign out. It only exists when this check is active |
| service worker cache | the copy of the app's files (page, icons, images) that lets you open it offline; it's renewed with every version |
ghisa.v1 | your training data and preferences |
ghisa.v1.uid | the identifier of the account (with the email in shortened form, for example “ma***@domain”) that the data saved on this device belongs to: if another account signs in, the app doesn't mix its data with this |
ghisa.prima (IndexedDB) | the “previous” copies: the last three versions of your data replaced by a sync, so you can recover them (Settings → Backup). If the device doesn't have IndexedDB, the same copy is kept in the ghisa.v1.prima key |
ghisa.media (IndexedDB) | the photos and videos of exercises already downloaded |
sb-…-auth-token, ghisa.accesso | the sign-in session and the mark that you've signed in on this device |
ghisa.catalogo, ghisa.geo.*, ghisa.versione | copies of the exercise catalog and of the lists of countries, regions and cities; the server's last answer about the app version |
ghisa.crono, ghisa.tm, ghisa.gw, ghisa.bilanciere | stopwatch, rest timer, guided workout in progress, last barbell calculation: if the app closes halfway, it picks up from there |
ghisa.notifiche, ghisa.controlli, ghisa.limctrl, ghisa.diag | the bell's messages, the reminders the app shows inside itself and a local technical log. They never leave the device |
ghisa.amici.oggi, ghisa.palestra.oggi, ghisa.pal.* | the minimum needed to draw the opening screen offline: friends, expiry dates, entry pass, bookings and notices from your gym |
ghisa.lang, ghisa.lang.srv | the chosen language, and the last language sent to the server (so it isn't sent again at every launch) |
ghisa.avdef | the mark that the default profile drawing (male or female) has already been sent to the server |
ghisa.pub, ghisa.provafine | only in the store apps, on the plan with ads: how many ads you've seen today, the time of the last one and the actions since then (used for frequency limits), and the mark that you've already seen the end-of-trial dialog. They never leave the device |
ghisa.notif.token, ghisa.notif.chiesto, ghisa.notif.fermo, ghisa.notif.pend | only in the store apps, if you allow notifications: the phone's code for notifications (the same one it sends to our server, so it can be removed when you sign out of the account), the mark that the app has already asked whether you want them, the date of the next “if you don't train” reminder, and your consent to or withdrawal from “News and offers” until the server has received it. Notifications already scheduled (end of rest, reminders, weigh-in, booked classes) are kept by the phone's system; the Firebase Cloud Messaging library saves its installation identifier on the phone. They're only used to send you the notifications you chose |
ghisa.salute | only in the iPhone and Android apps, if you connect Apple Health or Health Connect: the connection status, the time of the last read and the Apple Health weigh-ins you deleted in the app, so they don't come back |
ghisa.carriera, ghisa.gp.coda, ghisa.pub.oggi, ghisa.linkpal, ghisa.segnalate | copies for working offline: career and points, the workouts to declare when the connection comes back, the top-rated programs for the opening page, the gym's personal link not yet used, the programs you've already reported |
ghisa.demo.*, ghisa.pubbliche.demo, ghisa.palestre.demo | only for the demo and for tests; they don't touch your data |
Training data is also synced to the server: how and why is explained in the app privacy notice.
3b. In the iPhone and Android apps: Google ads
This part only applies to the iPhone app (App Store) and the Android app (Google Play), and only on the free plan with ads (after the trial, with no subscription or gift). It doesn't exist in the browser.
To show ads, the app uses the Google AdMob library. To choose and count ads, the library reads and saves information on the phone: the advertising identifier (the IDFA on iPhone, only if you allow tracking; the advertising ID on Android) and other technical information about the device. This isn't strictly necessary for the app to work, so personalized ads and the use of the identifier require your consent (art. 122 of the Italian Privacy Code).
- Consent is requested by Google's dialog, before the first ad, if you're at least 18. Your choices are saved by the library on the phone, in the advertising industry's standard format (keys starting with
IABTCF_), and apply until you change them or they expire. - If you refuse, the app asks Google for non-personalized ads, and the free plan stays the same.
- If you're under 18, or if the app doesn't know your age, the dialog doesn't appear, tracking isn't requested and only non-personalized ads are requested.
- On iPhone the system also asks for tracking permission (ATT), which you can change from Settings → Privacy & Security → Tracking.
- To change your mind about ads: Settings → Your plan → “Ad privacy”.
How Google uses this data is decided by Google, as controller: How Google uses information from sites or apps that use our services. The rest is in the app privacy notice, in paragraph 7b.
For subscriptions, the RevenueCat library only activates when you tap “Choose…” or “Restore purchases” and is used for that purchase, which you asked for.
4. Payment with Stripe
When a gym chooses a plan, the browser goes to Stripe's payment page, which is a Stripe site and not ours. There, Stripe uses its own cookies, including to detect fraud, according to its own policy: stripe.com/it/cookie-settings. No Stripe script is loaded on our pages.
5. YouTube, only if you ask for it
Some exercises in the app have the “Watch video” button. Until you tap it, no Google server is contacted. When you tap it, before the video loads the app warns you that YouTube (Google) will open and that the player may save data on your device. If you confirm, a player from youtube-nocookie.com opens, which reduces tracking but doesn't eliminate it and writes some information to the browser as soon as it starts: from there Google's rules apply (policies.google.com/privacy). It's content you ask for, with two taps: that's why there's no banner.
6. What isn't there
No profiling cookies, no third-party cookies on our pages, no analytics or statistics tools, no social buttons, no pixels. The fonts are hosted on our own servers: opening a page sends no data to third parties. Every key listed in points 1, 2 and 3 can only be read by the site or app that wrote it and isn't used to recognize you elsewhere: that's what the exemption from consent rests on. In the store apps, the only third-party tool that uses the phone for ads is the Google AdMob library, with the rules and consent of point 3b. The Firebase Cloud Messaging library writes its identifier on the phone only if you allow notifications, and only to deliver the ones you chose: it's a service you ask for, like everything else on this page.
7. How to delete it
You can delete everything on this page yourself, from the browser or phone settings.
- Chrome: Settings → Privacy and security → Delete browsing data
- Safari (Mac): Safari → Settings → Privacy → Manage Website Data
- Safari (iPhone, iPad): Settings → Safari → Clear History and Website Data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Edge: Settings → Privacy, search, and services → Clear browsing data
Warning. In the app, clearing the site data also deletes the workouts saved on the device. With an account you'll find them again at the next sign-in, because they're on the server; without an account you lose them. Export a backup first (Settings → Backup).
In the store apps you can change your ad choices from Settings → Your plan → “Ad privacy”; uninstalling the app removes everything the app and its libraries saved on the phone.
To delete data from the server, the browser isn't enough: use “Delete account and data” in the app, or write to the address in the privacy notice.
8. If this page changes
If one day we added a tool that writes to your device for purposes other than these, we would rewrite this page before turning it on, and the consent banner would appear. Today the only consent is the one for ads in the store apps, and it's requested by Google's dialog (point 3b): outside that, there's nothing to ask your consent for.
References: art. 122 of Legislative Decree no. 196 of 30 June 2003; art. 5(3) of Directive 2002/58/EC; Italian Data Protection Authority (Garante per la protezione dei dati personali), Guidelines on cookies and other tracking tools (Linee guida cookie e altri strumenti di tracciamento), 10 June 2021 no. 231, paragraphs 5 and 8.
Version 1.3 — 22 October 2026 (replaces 1.2 of 15 October 2026)