Cookies Policy

1. Scope

This Cookies Policy explains how Massage Cycle uses cookies and similar technologies when you visit our website. It distinguishes between two situations: visitors browsing without an account, and signed-in therapists or administrators. This policy should be read together with our Privacy Policy.

2. What Are Cookies

Cookies are small text files placed on your device by the websites you visit. They are widely used to make sites work, improve performance, and provide information to site owners. Similar technologies include local storage, web beacons, and pixels. Throughout this policy, "cookies" refers to all of them.

3. Cookies We Use — At a Glance

Massage Cycle uses two categories of cookies:

Strictly Necessary cookies — placed only when you sign in as a therapist or administrator to keep your session active and protect your account. They are essential for the service to function and do not require your consent.

Performance & Analytics cookies — placed by Google Analytics only after you click Accept on our consent banner. They help us understand how visitors use the directory so we can improve it. They are optional and apply to both anonymous visitors and signed-in users.

4. Anonymous Visitors — No Automatic Cookies

When you visit Massage Cycle without signing in, our website does not place any cookies on your device for basic browsing. You can search the directory, view therapist profiles, read our blog, and use the site fully without any cookie being set.

The authentication system (Supabase) is only loaded when you actively sign in, sign up, or request a password reset. Until then, no session cookies are written to your browser.

5. Strictly Necessary Cookies (Signed-in Users Only)

When a therapist or administrator signs in, we place first-party authentication cookies managed by our authentication provider, Supabase (Supabase, Inc.). These cookies are strictly necessary to maintain your session and protect your account.

Cookies placed:

sb-{project-ref}-auth-token (and chunked variants when the token exceeds the browser cookie size limit)

Provider: Supabase, Inc. (data processor)

Purpose: Session management, authentication, CSRF protection, and account security

Type: First-party, HTTP-only, Secure

Lifetime: Session — expires when you sign out or after a period of inactivity

Legal basis: Strictly necessary — these cookies are exempt from the consent requirement under applicable privacy law because the service cannot function without them.

If you block or delete these cookies through your browser settings, you will be signed out and will not be able to access therapist or admin areas until you sign in again.

6. Performance & Analytics Cookies (Google Analytics 4)

To understand how visitors use the Massage Cycle directory and improve the experience, we use Google Analytics 4 (Google LLC). These cookies apply to both anonymous visitors and signed-in users, but they are only loaded after you click Accept on our consent banner.

Cookies placed (typical set, may vary by Google configuration):

_ga — used to distinguish users. Lifetime: 2 years.

_ga_<container-id> — used to persist session state. Lifetime: 2 years.

Provider: Google LLC (data controller for its own cookies)

Data collected: Anonymous usage signals such as pages visited, time on page, referrer, device category, and approximate country/city derived from IP address. IP addresses are truncated by Google before storage.

Purpose: Aggregate traffic measurement and product improvement

Legal basis: Consent — collected only after you click Accept. If you click Reject or close the banner without accepting, no Google Analytics cookies are placed and no data is sent to Google.

Data transfer: Google may process data in the United States or other jurisdictions where Google operates. Google participates in the EU-U.S. Data Privacy Framework and applies Standard Contractual Clauses for transfers from other regions.

For details on how Google uses information from sites that use its services, see How Google uses information from partner sites.

7. No Other Third-Party Cookies

Massage Cycle does not use Meta Pixel, Facebook tracking, TikTok Pixel, LinkedIn Insight, Hotjar, Microsoft Clarity, advertising networks, affiliate trackers, or any third-party profiling or marketing cookies. Google LLC is our only analytics provider.

We also do not use first-party cookies for advertising, retargeting, cross-site profiling, or to build advertising audiences.

8. How to Control Cookies

Through our consent banner: on your first visit, you can choose Accept or Reject. You can revisit this page at any time to understand your options. We provide a "Cookie Settings" control in the footer so you can change your choice at any time.

Through your browser: most browsers allow you to block or delete cookies. The exact steps depend on your browser:

• Chrome: Settings → Privacy and security → Cookies and other site data

• Safari: Settings → Privacy → Manage Website Data

• Firefox: Settings → Privacy & Security → Cookies and Site Data

• Edge: Settings → Cookies and site permissions → Cookies and site data

Blocking strictly necessary authentication cookies will sign you out and prevent access to therapist and admin areas. Blocking analytics cookies does not affect site functionality.

Google Analytics Opt-out: you can install the Google Analytics Opt-out Browser Add-on to prevent data collection by Google Analytics on all websites you visit.

9. Changes to This Policy

We may update this Cookies Policy when we add, remove, or change the cookies we use. The "Last updated" date at the top of this page reflects the most recent revision. Material changes may be communicated through a notice on the website or by email.

10. Contact

Questions about this Cookies Policy or our use of cookies can be sent through the contact channels published on Massage Cycle.