Cookie policy

1. What a cookie is

A cookie is a small file placed by a website on the user's device when the site is visited. The word "cookie" is used here in a broad sense and also covers the other forms of local storage used by browsers (localStorage, sessionStorage, and the like).

Some cookies are necessary for the service to work technically, others measure audience or serve advertising. Hyvirtus uses only strictly necessary cookies. It serves no advertising and uses no advertising cookie. Hyvirtus does run a first party audience measurement, but it is cookieless and sets no identifier on your device (see section 3).

2. Cookies used on Hyvirtus

Hyvirtus uses only cookies and local storage items that are strictly necessary for the service to work:

• Theme preference (light / dark): stored in the browser's localStorage under the key hvts_theme. Keeps the chosen display mode between two visits.
• Stable user identifier: stored in the browser's localStorage under the key hyvirtus_user_id. Generated automatically when the profile is first saved, it links the profile data to an account without relying on a third party cookie.
• User email: stored in localStorage under the key hyvirtus_user_email. Remembers the email address entered for the account.
• Application session state: various localStorage keys used to persist the application's temporary state (Dojo Live sessions in progress, ritual drafts, and so on). This data stays local and is synchronised with the server only when the user confirms an action.

These items are exempt from consent collection under Article 82 of the French Data Protection Act (loi Informatique et Libertés) and the CNIL recommendations on cookies (deliberation of 17 September 2020).

Hyvirtus uses no audience analytics cookie, no advertising pixel, no third party social network cookie. No audience-measurement data is transmitted to any third party. Hyvirtus does measure its audience, but through a first party, cookieless system described in section 3, which sets no cookie and no persistent identifier on your device.

3. First party audience measurement

Hyvirtus operates its own audience measurement, built in house and hosted on its own infrastructure. It records page views, the start of a checkout, the display of the offer and the request of a login code, in order to count visitors and pages viewed, to identify traffic sources, languages, countries and device types, and to follow the steps of the purchase funnel. The purpose is purely statistical, to steer the site. There is no individual profiling and no advertising.

This measurement is cookieless. It sets no cookie and no persistent identifier on your device. Each event is reduced to non identifying data: the event name, the page path (without query string or fragment), the referring site reduced to its hostname (internal referrers are removed), a two letter language code, the browser window width (used only to derive a device type, mobile, tablet or desktop), the origin site, a country code (two letter ISO code only, never a city or coordinates), and a UTC timestamp.

Your IP address and your user agent are never stored. They are used in memory only, to derive a two letter country code (through a local DB-IP Country Lite database, with no per event request to any third party) and to compute an ephemeral visitor identifier. That identifier is a hash combining a daily secret, your IP address and your user agent. The daily secret rotates every day and past secrets are deleted, so no correlation across days is possible. Geolocation by DB-IP.

This data stays first party. It is never shared with or transmitted to any third party and is retained for at most 400 days. This processing relies on Hyvirtus's legitimate interest (Article 6(1)(f) GDPR) in measuring and steering the traffic to its site, an interest balanced against your rights by the non identifying, cookieless and cross-day-free nature of the measurement. Because this measurement is cookieless, sets no tracker subject to consent and keeps no IP address, it is intended to fall within the consent exemption for audience measurement under Article 82 of the French Data Protection Act and the CNIL recommendations of 17 September 2020. Exercising your right to object (Article 21 GDPR), you can opt out at any time by setting the hvts_analytics_optout key to 1 in your browser's local storage. See the privacy policy for all your rights.

Should Hyvirtus introduce in the future a third party audience tool (Plausible, Fathom, Google Analytics, or others) or third party cookies, this policy would be updated beforehand and, where appropriate, a consent banner compliant with the CNIL deliberation would be deployed. No tool of this kind will be activated without prior notice and without effective consent collection where the law requires it.

4. Managing cookies from your browser

You can delete Hyvirtus cookies and local storage items at any time directly from your browser settings:

• Chrome: Settings → Privacy and security → Cookies and other site data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Safari: Settings → Privacy → Manage Website Data.
• Edge: Settings → Cookies and site permissions.

Deleting technical cookies may cause the loss of your theme preference or a temporary disconnection of your session.