Cookie Policy
Last updated: October 3, 2026
Vytal needs a few cookies to work at all: they keep you signed in and keep the app in your language. Analytics cookies are the only ones you decide about — in the EEA and the UK we ask before setting any, and anywhere else you can switch them off below.
1. What a cookie is
A cookie is a short piece of text a site asks your browser to keep and hand back on the next page. It is how a website can tell that it is still you between one page and the next, and on its own it says nothing else about you.
Vytal's cookies stay on Vytal. None of them follow you to other sites, none build a profile of you, and none are sold or handed to advertisers.
2. Cookies the app needs
Without these the app cannot do its job: you would be signed out again on every page, and the language you picked would be forgotten.
| Cookie | What it does | Kept for |
|---|---|---|
better-auth.session_token | Keeps you signed in. Set when you sign in, renewed while you use the app, and deleted when you sign out. | 30 days |
vytal-signed-in | Says only that you are signed in somewhere, so the public pages can offer “Open app” straight away. It holds no name, no email address and no key to anything. | 30 days |
NEXT_LOCALE | The language you chose on this device, so the next page opens in it. | 1 year |
vytal_cookies | Your answer to the cookie question, so it is asked once rather than on every visit. | 6 months |
better-auth.device_trust | Only if you tick “Don't ask again on this device for 30 days” when you sign in: lets this browser skip the emailed sign-in code for your account. | 30 days |
better-auth.state | Only while you sign in with Google or Apple: checks that the answer that comes back belongs to the sign-in you started. | 5 minutes |
These don't ask permission, because the site can't be delivered without them, and they stay whatever you decide below. On the live site, the names of the better-auth cookies start with __Secure-.
3. Analytics cookies
Google Analytics sets two cookies, which tell us how many people come by and which pages get read — that is how we decide what to build next. In the EEA and the UK they are set only after you accept. Elsewhere they are on until you refuse, here or in your browser.
| Cookie | What it does | Kept for |
|---|---|---|
_ga | Tells one browser from another, so coming back a second time is not counted as a second person. | 2 years |
_ga_* | Holds one visit together, so a walk through several pages counts as one visit rather than five. There is one of these for each set of statistics the site reports to. | 2 years |
What goes to Google: which pages of the public site were opened, roughly where in the world from, which language, and what kind of device and browser. Of a page, only its address and title are sent, never what you type into it. The app itself, where you log your meals and training, sends nothing at all. Your IP address is used to work out the country and city and is not stored by Google Analytics.
What never goes: your name, your email address, what you ate, your weight, your targets and your photos. Nothing that identifies your account is sent.
For this, Google Ireland Limited processes the data on our behalf under its own privacy policy, and may do so on servers outside Europe.
4. Kept on this device
A few settings never leave your browser: they are stored on the device itself and sent nowhere, so they are not cookies at all and ask nothing of you.
| Setting | What it does |
|---|---|
| Theme | Shows the right colors before the page loads. |
| Vibration | Remembers whether vibration is on. |
| Install prompt | Remembers when you last dismissed the prompt to install the app. |
| Offline copy | Lets the app work without a connection: your Today page, the foods and meals you can add, your last few days' entries, and anything you log offline until it is sent. It's removed when you sign out, or when your session has ended elsewhere. |
| Setup in progress | What you've entered while setting up your account, so a reload doesn't lose it, until setup is finished or you sign out. |
| Small interface choices | Things like routine folders you folded and hints you've dismissed, and which accounts have used this browser, so the right data is cleared when a session ends. |
5. Your choice
Analytics cookies are yours to allow or refuse, and you can change your mind here whenever you like. Refusing after having allowed also deletes the two Google cookies from this device.
Your browser can do the same from its side: every browser can block or clear a site's cookies. Clearing the necessary ones simply signs you out and forgets your language.
The privacy policy covers everything else Vytal stores, and how to get a copy of it or delete it.
6. Changes and contact
If this policy changes, the date at the top changes with it. Questions go to .