Cookie Policy

This page explains what cookies and similar browser storage HealthBlokk (https://healthblokk.app) uses, and the choices you have.

1. Strictly necessary (no consent required)

• hb-cookie-consent (localStorage): remembers your choice on analytics ("accepted" or "rejected") so we do not ask again.
• hb-marketing-consent (localStorage): remembers your separate choice on advertising measurement (section 3). Accepting analytics does not accept advertising, and rejecting one does not reject the other. Each is asked and stored on its own.
• Admin session: used only on the operator console after an administrator signs in.

These are required for the site to function (or for the consent choice itself) and are exempt from consent under the ePrivacy rules, in Austria §165(3) TKG 2021.

2. Tag management and analytics

Google Tag Manager (container GTM-NHFZMTTK, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4) runs on every page of this site. It is a loader, not a measurement tool: it writes nothing to your device and sets no cookies of its own, it only decides which of the tools below are allowed to run. Loading it transmits your IP address and browser user agent to Google. It releases no analytics or advertising tag before you have given the matching consent.

Before you make a choice, we count page usage with PostHog (EU-hosted) in cookieless mode: the visit identifier exists only in your browser tab's memory, nothing is written to your device, and it is gone when you close the tab. Because no information is stored on or read from your device, this needs no consent under the ePrivacy rules.

If, and only if, you accept analytics in the cookie banner, PostHog switches to storing that identifier so return visits can be recognised, and we additionally load Google Analytics (measurement ID G-2H0WZQ2NKX). If you reject, we stop measuring you altogether and nothing is stored either way.

• We do not send your waitlist form contents or on-page AI demo messages to analytics as free-text content.
• Coach conversations and health data live on the coaching product systems described in our Privacy Notice; this marketing site does not display your health dashboard.

3. Advertising measurement (Google Ads and Meta)

We run ads on Google and on Meta (Facebook and Instagram). If, and only if, you accept advertising in the cookie banner, we let those two platforms measure whether an ad actually led anywhere. If you reject, or have not answered yet, no advertising cookie is written and the Meta Pixel is never loaded.

We count one thing: that someone texted the coach and then opened the link the coach sent back, at https://healthblokk.app/welcome. Every call to action on this site opens Messages, so a tap on its own proves nothing. It would count people who opened Messages and never sent anything. The coach's reply link is the first point at which a real conversation has actually started.

Google Ads. We use Google's consent mode, and your advertising choice is what switches Google's ad_storage, ad_user_data and ad_personalization signals on or off. Granted, Google may write _gcl_aw and _gcl_au (up to 90 days), which hold the identifier of the ad click that brought you here so that a later visit to /welcome can be matched back to it. Recipient: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Meta Pixel. Loaded once you accept advertising. Once loaded, it writes two first-party cookies:

• _fbp (up to 90 days): a random identifier for your browser, so the same browser can be recognised across visits.
• _fbc (up to 90 days): written only if you arrived from a Meta ad, and stores the click identifier (fbclid) from that ad's link.

Recipient: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. For the collection of this data in your browser and its transmission to Meta, we and Meta are joint controllers under Art. 26 GDPR; what Meta does with it afterwards, Meta decides alone as controller. Meta transfers data to the United States; we rely on Meta's certification under the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses. See Meta's Privacy Policy.

What is sent: a page view, StartTrial when you tap a button that opens Messages, and Lead on /welcome, plus the technical data the browser sends with any request (IP address, user agent, page address, and the cookie values above). We do not attach your name, email address, phone number, or any health information to these events, and we do not send anything to Meta or Google from our servers (no Conversions API, no offline conversion import).

Legal basis: your consent, Art. 6(1)(a) GDPR and §165(3) TKG 2021. You can withdraw it at any time (section 4), which stops any further loading of the pixel.

Neither platform loads anything at all until you have accepted advertising. Until then, and after a rejection, this site makes no request to Google Ads or to Meta and writes none of the cookies above.

4. Other third parties

If you open a Stripe checkout for a subscription, Stripe may set its own cookies on payment pages for fraud prevention and processing. Apart from Google Ads and Meta as described in section 3, we set no advertising or cross-site tracking cookies, and we sell no data to ad networks or data brokers.

5. Your choices

• Accept or reject analytics and advertising separately in the cookie banner on your first visit. Rejecting takes exactly one tap, the same as accepting, and rejecting is never the harder path.
• Change your mind at any time by clearing this site's browser storage (the banner will ask again), or by blocking cookies for this site in your browser. Withdrawing advertising consent stops the pixel from loading again; to remove data already at Meta, use the Meta Accounts Center or contact us and we will forward your request.
• Questions? Email info@healthblokk.com.

See also our Privacy Notice, Terms of Service, and Imprint.