Language Notice / Język Polski
This policy is also available in Polish: Polityka plików cookie. Where Polish law requires it, the Polish version prevails.
Overview
This website sets two cookies, and both of them are strictly necessary. Both of them run sign-in (from the site header or from FoQus). The first one is set the moment you click sign in, even if you do not finish signing in. There is no advertising cookie, no third-party tracker, and no cross-site profiling anywhere on this site. If you never click sign in, nothing here sets a cookie on your device at all. Our forms also load a bot check from Cloudflare; it is described below.
Everything else stored on your device is browser storage (localStorage) that the FoQus web application uses to keep your own progress on your own machine. It is never sent to us. Both lists are below, in full.
There is still no cookie banner, and that is not an oversight. Under ePrivacy rules a cookie that is strictly necessary to deliver something you asked for — here, signing you in — does not require consent, and we set no other kind. We removed the old banner along with Google Analytics in favour of self-hosted analytics that measures visits without cookies and without identifying anyone. If you used that banner, the two entries it left in your browser are deleted automatically the next time you visit.
Cookies
These are real cookies: we set them, your browser returns them to us with each request, and each has an expiry we set. Both exist to deliver something you asked for — signing in. None is used for analytics, advertising or profiling, and none is readable by scripts in your browser. Clear your site data and all of them are gone.
| Name | Provider | Purpose | Type | Retention |
|---|---|---|---|---|
| sustematiq_login_state | SustematiQ | Set the moment you click sign in, before you have authenticated. Carries a one-time anti-forgery value and the page to return you to, so the sign-in that comes back is the one you started. | Strictly Necessary Cookie | 10 minutes; deleted as soon as the sign-in round trip ends |
| sustematiq_session | SustematiQ | Set only after a successful sign-in. Holds your subject ID, the WorkOS session token and ID, and the session expiry, encrypted so your browser cannot read them. It is what keeps you signed in. | Strictly Necessary Cookie | Expires with the WorkOS session; cleared when you sign out |
Storage Items
Every item below is browser localStorage, not a cookie. It is written by your browser, stays on your device, is never sent to us, and has no expiry date — it remains until you clear it.
| Name | Provider | Purpose | Type | Retention |
|---|---|---|---|---|
| foqus_terms_accepted | SustematiQ (Local) | Remembers that you have reviewed and agreed to the recreational, non-medical nature of FoQus. | Necessary LocalStorage | Persistent until cleared by user |
| foqus_user | SustematiQ (Local) | Holds your Local Profile — the nickname you chose, whether you are in guest or local mode, and that you agreed to the terms. | Necessary LocalStorage | Persistent until cleared by user |
| foqus_sessions | SustematiQ (Local) | Keeps the record of each breathing session you complete, including any reflection notes you type. | Necessary LocalStorage | Persistent until cleared by user |
| foqus_stats | SustematiQ (Local) | Counts your sessions, mindful minutes, streaks and badges so the app can show your progress. | Necessary LocalStorage | Persistent until cleared by user |
| foqus_seen_tour | SustematiQ (Local) | Remembers that you have already seen the short introduction tour, so it is not shown again. | Necessary LocalStorage | Persistent until cleared by user |
Bot Check on Our Forms
When you open a page with one of our forms (the contact form, the Mate and FoQus alpha access request forms, and the FoQus online profile form), the page loads Cloudflare Turnstile, a check that tells people from automated spam. The check runs in a frame that Cloudflare serves from its own domain. We set no cookie and no storage item for it.
To run the check, Cloudflare receives your IP address, details about your browser and its connection (for example the browser's user-agent string and a fingerprint of the encrypted connection), and the address of our page. Cloudflare acts as our processor for the check, and as a separate controller when it uses these signals to improve its bot detection. What Cloudflare collects and keeps is described in the Cloudflare Turnstile privacy notice.
We use the check because it is necessary to protect the form you chose to send against spam and abuse (Article 6(1)(f) GDPR). For the same reason, it needs no consent under ePrivacy rules. You can object to this processing, see the Privacy Policy; if the check cannot run, the form cannot be sent, and you can email us instead.
Browser LocalStorage Disclosure
Under ePrivacy rules, access to or storage of information on your device requires prior consent unless it is strictly necessary to deliver a service you requested.
The FoQus web application relies on browser localStorage to enable essential user features:
- Local Profile: Stores your nickname, your session records (including any reflection notes), statistics and badges locally. This allows you to close and return to the application without losing your progress.
- Optional Feedback: Any reflection or breathing session notes you type are saved exclusively in your browser storage.
SustematiQ does not transmit this local storage data to its servers; it remains 100% on your device. You can clear all of this data at any time in your web browser settings (Clear Site Data). The reset button in the FoQus app settings deletes your local profile, sessions and statistics (foqus_user, foqus_sessions, foqus_stats); it keeps foqus_terms_accepted and foqus_seen_tour.
Cookieless Analytics
To understand how many people visit the site and which pages are useful to them, we run Umami — open-source analytics software that we host ourselves. It replaced Google Analytics, which is no longer present on this website in any form.
Concretely, this means:
- No cookies and no browser storage. Umami writes nothing to your device — not a cookie, not a
localStorageentry. It does not read the cookies we set either. Nothing about it persists after you close the tab. It only reads one browser-storage key,umami.disabled: if you or we set it in your browser, Umami sends nothing. Umami never writes this key itself. - No identifiers, and no stored IP address. As with any web page, your browser's request reaches our server with your IP address, and our server log records it (see “Server Logs” in our Privacy Policy). Umami uses the IP address only to look up an approximate location and does not store it. There is no advertising identifier, no cross-site tracking, and no profile of you anywhere.
- Aggregate counts only. What we can see is the shape of the audience: page addresses, referring site, browser, operating system, device type, screen size, language, and approximate location (country, region and city). We use it to count visits and read trends, never to single out an individual.
- Self-hosted in Poland (European Union). The analytics software and its database run on our own server in Poland, operated by us. No third-party analytics provider receives your data, and none of it is transferred outside the EEA.
- FoQus on this site. On the FoQus pages, Umami counts page views only, as on any other page. It does not see what you do inside the app, and it receives nothing from your FoQus progress, statistics or reflections.
Aggregate measurement of this kind is carried out under our legitimate interest in understanding and improving our own website (Article 6(1)(f) GDPR). Because it stores nothing on your device — no cookie, no browser-storage entry, nothing that outlives the tab — we ask for no consent under ePrivacy rules — which is one half of why this site shows no cookie banner; the other half is that every cookie we do set is strictly necessary to deliver something you explicitly asked for, which here is signing in. Analytics records are kept for 24 months. You can object to this processing, or ask any question about it, using the contact details in our Privacy Policy. Tracker blockers, and blocking our analytics domain outright, work as you would expect; nothing on this site attempts to circumvent them.
See also our Privacy Policy, Terms of Use and Legal Information.