Legal · draft, October 2026

Cookie notice

Draft, not yet in force. This page is a working draft and is not legal advice. It will be reviewed and replaced before we take on paying customers.

The short version

This website sets no cookies and runs no analytics, advertising or tracking scripts.
Our fonts are served from our own servers, so loading a page tells nobody else.
The studio sites, the dashboard and the kiosk set only the few cookies below, each needed to sign in or to do what you asked.
A studio site sets no tracking cookies unless the studio adds a Meta Pixel or Google Analytics. Then the site asks you first, with a banner where rejecting is as easy as accepting, and nothing from Meta or Google loads before you say yes.

Cookies the app sets

All of them are first-party (set by us, for our own domains) and SameSite=Lax (not sent along by other sites’ forms or images). All but studio_consent are also httpOnly (scripts on the page cannot read them); that one holds only your answer to a cookie banner, and the page reads it to know whether it may load anything. The sign-in and kiosk cookies are also marked Secure, so they only travel over HTTPS. None is used for advertising or to follow you around the web.

Cookies, what they do, where and how long they last
Cookie	What it does	Where	How long
`client_session`	Keeps a client signed in to a studio’s site.	Studio sites	30 days, renewed as you use the site
`staff_session`	Keeps studio staff signed in to the dashboard.	The dashboard	30 days, renewed as you use it
`admin_session`	Keeps a Joul platform admin (our own team) signed in.	Our admin site	12 hours
`kiosk_device`	Remembers that a tablet is the studio’s paired check-in kiosk.	Studio sites, on the kiosk tablet only	180 days, renewed with each check-in
`dashboard_location`	Remembers which location is picked in the dashboard’s top bar.	The dashboard	1 year
`studio_referral`	Remembers the referral code from a friend’s link until you sign up.	Studio sites	30 days
`studio_consent`	Remembers your answer to a studio site’s cookie banner, so the site doesn’t ask on every page.	Studio sites that use Meta Pixel or Google Analytics	182 days, then the site asks again

`client_session`

What it does: Keeps a client signed in to a studio’s site.
Where: Studio sites
How long: 30 days, renewed as you use the site

`staff_session`

What it does: Keeps studio staff signed in to the dashboard.
Where: The dashboard
How long: 30 days, renewed as you use it

`admin_session`

What it does: Keeps a Joul platform admin (our own team) signed in.
Where: Our admin site
How long: 12 hours

`kiosk_device`

What it does: Remembers that a tablet is the studio’s paired check-in kiosk.
Where: Studio sites, on the kiosk tablet only
How long: 180 days, renewed with each check-in

`dashboard_location`

What it does: Remembers which location is picked in the dashboard’s top bar.
Where: The dashboard
How long: 1 year

`studio_referral`

What it does: Remembers the referral code from a friend’s link until you sign up.
Where: Studio sites
How long: 30 days

`studio_consent`

What it does: Remembers your answer to a studio site’s cookie banner, so the site doesn’t ask on every page.
Where: Studio sites that use Meta Pixel or Google Analytics
How long: 182 days, then the site asks again

Meta Pixel and Google Analytics on studio sites

A studio can add its own Meta Pixel or Google Analytics to its site, to see which ads and links bring people to book. That is the studio’s decision and the studio is responsible for it: for its site’s visitors it is the controller, and its own privacy notice should name Meta and Google. They are not our sub-processors.

When a studio does, its site shows a cookie banner before anything from Meta or Google loads. Accept and Reject are the same kind of button, one click either way. After Reject nothing loads and their cookies are removed. You can change your choice at any time from Cookies at the foot of every page of the studio’s site, which also lists what it sets. If you say yes, the site sets these two cookies, and Meta’s and Google’s own scripts set theirs (_fbp and _fbc for Meta, _ga and _ga_ followed by the studio’s ID for Google) for as long as those companies set them:

Cookies a studio site sets only after you say yes
Cookie	What it does	Where	How long
`studio_utm`	Remembers the tags of the link you arrived by (an Instagram post, a newsletter), so a booking later is counted for that link.	Studio sites, after a yes	30 days
`studio_events`	Carries a sign-up or booking to the next page, where it is passed to Meta or Google and removed.	Studio sites, after a yes	5 minutes

`studio_utm`

What it does: Remembers the tags of the link you arrived by (an Instagram post, a newsletter), so a booking later is counted for that link.
Where: Studio sites, after a yes
How long: 30 days

`studio_events`

What it does: Carries a sign-up or booking to the next page, where it is passed to Meta or Google and removed.
Where: Studio sites, after a yes
How long: 5 minutes

When there is a cookie banner

Under the UK’s Privacy and Electronic Communications Regulations (PECR), cookies that are strictly necessary for a service you asked for, such as staying signed in or remembering your answer to a cookie banner, do not need consent. Every cookie in the first table is of that kind. This website sets none at all, so it has no cookie banner, and nor does a studio site without tracking. A studio site that uses a Meta Pixel or Google Analytics shows one, because those cookies are not strictly necessary. If we ever added analytics to this website, we would ask you first in the same way and add a choice here.

The mobile app

The app does not use cookies. It keeps its sign-in in your phone’s secure storage, and signing out removes it.

Removing cookies

You can delete cookies in your browser’s settings at any time. Deleting a sign-in cookie signs you out; deleting the kiosk cookie unpairs that tablet; deleting studio_consent means the studio’s site asks you again.

Questions

Email [email protected]. How we handle personal data is in the privacy notice.