Crosshire
CR Crosshire

Cookie Notice

Effective: 2026-08-07

Crosshire aims to keep its footprint on your device minimal across all four surfaces (Consulting at crosshire.ch, Blogs at blogs.crosshire.ch, Learn at learn.crosshire.ch, and FitScore at fitscore.crosshire.ch). This page explains what we store and why.

1. The complete cookie list

Two cookies exist across all four surfaces. Not two categories — two cookies. Both are first-party and strictly necessary for the thing they do, so neither requires consent under EU rules:

  • access_token — FitScore only. Keeps you signed in after you click your magic link. HttpOnly (a script on the page cannot read it) and SameSite=Lax. Expires when the token does.
  • learn_lead_seen — Learn. Set only if you enter your email at one of the optional prompts, so we stop asking. It holds the value 1 and nothing else — no email, no identifier. Lasts 90 days, SameSite=Lax, and is not HttpOnly, because the page has to read it to know whether to show the prompt. In production it is scoped to the whole crosshire.ch domain, which means the other three surfaces can see it too — that is how Blogs knows not to re-ask.

Earlier versions of this page also claimed a CSRF cookie on every surface and SameSite=Strict. Neither was accurate: no CSRF cookie is set anywhere, and both real cookies are Lax. Consulting sets no cookies of its own at all.

2. Authentication (FitScore only)

FitScore uses magic-link sign-in. After you click your link, the access_token cookie above is set so you stay signed in. The Consulting, Blogs, and Learn surfaces do not require sign-in today and set no authentication cookies.

3. Analytics — read this one

We used to use Plausible, and this page used to tell you that analytics collected no personal data. Both facts have changed. Since June 2026 all four surfaces run our own tracker instead, and it is only cookieless in the narrow sense that matters least to you.

It is true that it sets no cookie. It keeps a random per-tab ID in sessionStorage (cx-tracker-session), which your browser discards when you close the tab. But the absence of a cookie says nothing about what reaches our server, and what reaches our server on every single page load is your raw IP address, your full User-Agent string, the page path, and the full URL you arrived from, kept for 180 days and linked across our four domains by IP and browser together.

So: no consent prompt appears, but not because there is nothing to tell you. We rely on legitimate interest, and you can object. Privacy Policy §2.0 sets out every field we store and §3 explains how to object.

4. No advertising trackers

None of the Crosshire surfaces embed advertising networks, social media pixels, or third-party scripts that set tracking cookies. We do not run targeted advertising and we do not share data with ad networks.

5. Local storage and session storage

Everything below stays on your device. None of it is transmitted to us, and clearing it costs you nothing but the preference itself:

  • Your theme choice (cream / coffee on Learn and Blogs, the FitScore theme).
  • Learn course progress and your language preferences.
  • learn_grading_consent_v1 — Learn records here that you have seen and accepted the notice shown before the AI writing and speaking tools will grade anything.
  • fs-cookie-banner-dismissed — that you clicked “Got it” on the FitScore banner (§6).
  • A FitScore job-card layout preference.
  • cx-tracker-session, in session storage — the per-tab tracker ID from §3, gone when the tab closes.

6. The cookie banner

A banner appears on FitScore only — an earlier version of this page said Consulting and Blogs, which was the wrong way round. It is an acknowledgement, not a choice: it states that we use essential cookies for sign-in and security, and dismissing it records fs-cookie-banner-dismissed in local storage so it does not reappear. Nothing about the tracker in §3 is conditional on it, on any surface.

7. Your choices

You can control cookies and local storage through your browser settings. Disabling essential cookies will affect features that rely on them (e.g. staying signed in to FitScore). Because we do not use advertising or tracking cookies, there is no third-party opt-out to manage.

One limit worth being straight about: clearing your browser storage does not stop the §3 tracker, because it never depended on that storage — it records the IP and User-Agent of the request itself. Blocking it from your side means blocking the request. From our side, write to darshansingh@crosshire.ch and we will exclude your address.

8. Updates

If we ever introduce additional cookies or trackers, this page will be updated with a new effective date and, where required, we will ask for your consent before any non-essential cookie is set.

9. Contact

Questions about cookies or storage? Email darshansingh@crosshire.ch.

See also: Privacy Policy · Terms · License · Imprint.