1.What this policy covers
This Cookie Policy explains which cookies and similar technologies the amaina.health website uses, why, and how you can manage them. Amaina is a wellness tracker that helps you log migraine patterns and prepare for a doctor visit.
The website is where you learn about Amaina and get the app from the Apple App Store — and it is also where you can subscribe on the web. There are two ways to subscribe: in the app, through Apple's In-App Purchase, and on the web, where our health questionnaire ends in a checkout operated by Stripe and we are the seller of record (see our Terms of Use). This policy covers cookies on amaina.health, on the questionnaire pages served from our subdomain, and the cookies the web checkout sets on that path.
It does not cover the Amaina iOS app. The app is a native mobile client and generally does not use browser cookies; it uses software development kits (SDKs) from providers like Apple, Google (Firebase), and Adapty to run. What data the app collects and how we use it is described in our Privacy Policy, with the full list of providers in our Subprocessors list.
For simplicity, we use "cookies" throughout to mean cookies and similar technologies — web beacons, pixels, tags, and local/session storage.
2.What are cookies?
A cookie is a small text file a website stores in your browser. Cookies remember things — your preferences, your sign-in session, which pages you've seen, whether an ad brought you to us.
- First-party cookies are set by amaina.health.
- Third-party cookies are set by providers we use (for example, Google for analytics, or Meta for ad measurement).
- Session cookies disappear when you close your browser; persistent cookies stay until they expire or you delete them.
3.Cookies we use
Cookies on amaina.health fall into four categories. The named cookies listed below are those set by amaina.health itself and by the providers we run on it; the questionnaire and checkout pages additionally set cookies of their own, described by purpose where they appear. Exact cookie names and lifespans can change as our providers update their tools; when that happens we update this list.
3.1 Strictly necessary (always on)
Required for the site to function — to remember your cookie choices, maintain your session, and protect against fraud and abuse. You can't reject these without breaking the site.
| Cookie | Set by | Purpose | Lifespan |
|---|
cookie_consent | amaina.health | Stores your cookie preference choices | 1 year |
session / session_id | amaina.health | Maintains your session while you browse the site | Session |
csrf_token | amaina.health | Security — protects against cross-site request forgery | Session |
Note on payments. Amaina subscriptions are sold two ways: inside the iOS app through Apple's In-App Purchase, and on the web, at the end of our health questionnaire, where the payment is processed by Stripe and we are the seller of record. On the web path, Stripe sets its own cookies that are strictly necessary to process the payment and to detect and prevent fraud; Stripe collects your card and billing details directly — we never see or store them. Apple's in-app purchases set no website cookies at all. See our Privacy Policy and Subprocessors list.
3.2 Functional / preferences (optional)
Remember choices you make so the site behaves the way you expect — for example, your language or interface preferences. These aren't required, but turning them off may make the site less convenient.
| Cookie | Set by | Purpose | Lifespan |
|---|
prefs / ui_settings | amaina.health | Remembers non-essential preferences (e.g., language) | 6 months |
3.3 Analytics (optional)
Help us understand how visitors find and use the site so we can improve it. We use this data in aggregate — we don't try to identify individual visitors from it, and we don't put any health data into analytics.
| Cookie | Set by | Purpose | Lifespan |
|---|
_ga | Google Analytics 4 | Distinguishes unique visitors | 2 years |
_ga_<container-id> | Google Analytics 4 | GA4 session/state cookie — persists session and campaign data | 2 years |
_gid | Google Analytics 4 | Distinguishes unique visitors | 24 hours |
| GTM container | Google Analytics 4 (Tag Manager) | Loads other tags (analytics, advertising) | Session |
Google Search Console, if used, doesn't set cookies — it verifies the site via a meta tag or file. We mention it only because it's part of our analytics stack.
HubSpot. We use HubSpot for website email / CRM (the sign-up form and product updates you opt into) — see our Subprocessors list. If a HubSpot form or tracking script runs on a marketing page, it may set HubSpot cookies (for example, __hstc, hubspotutk, __hssc) to remember your form session and how you found us. Where it does, those cookies sit in this analytics category and load only after you consent. HubSpot never receives your health data.
3.4 Advertising (optional)
Let us measure how our web ad funnel performs and, where you consent, show you relevant ads on Meta (Facebook, Instagram) and Google. On amaina.health these are used for aggregate conversion measurement of our marketing.
| Cookie | Set by | Purpose | Lifespan |
|---|
_fbp | Meta Pixel | Identifies your browser for ad measurement | 90 days |
_fbc | Meta Pixel | Stores last-click data for ad attribution | 90 days |
_gcl_au | Google Ads | Conversion measurement | 90 days |
IDE | Google DoubleClick | Ad targeting and measurement | 13 months |
NID | Google | User preferences for Google ads | 6 months |
Hard limit — no health data in advertising. Advertising cookies run only on the website and only for aggregate conversion measurement, and only if you consent. We never send your health data, HealthKit/Health Connect data, migraine logs, structured logs, or AI outputs to Meta, Google's ad products, or any advertising platform; we never use them to build custom, lookalike, or health-interest audiences; and we never sell your personal information. See our Privacy Policy and website privacy rights notice.
If we add new cookies in the future (such as heatmap, A/B testing, or session-recording tools), we'll update this list and ask for renewed consent where required.
4.Your choices
You're in control of every optional cookie.
4.1 Via our cookie banner
When you first visit amaina.health, you'll see a cookie banner. Optional cookies (functional, analytics, advertising) do not load until you consent. You can:
- Accept all — turn on all cookie categories.
- Reject optional — only strictly necessary cookies will load.
- Customize — choose by category (functional / analytics / advertising).
You can change your choice anytime by clicking "Cookie settings" in the site footer.
4.2 Global Privacy Control (GPC)
We honor the Global Privacy Control (GPC) signal. Where your browser sends GPC on amaina.health, we treat it as a valid request to opt out of the "sale"/"sharing" of your personal information for advertising, and we apply that to the advertising and analytics cookies on this site.
To be clear, GPC here affects only the web advertising/analytics cookies — there is no health-data "sale" or "share" to opt out of, because we never put health data into cookies and never sell or share health data for advertising (see Section 3.4 and Section 7). For how GPC fits with your other rights, see our website privacy rights notice and Regional Addenda.
4.3 Via your browser
You can also manage cookies in your browser settings:
- Chrome: Settings → Privacy and security → Cookies
- Safari: Settings → Privacy → Manage Website Data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Edge: Settings → Cookies and site permissions → Cookies
Note that blocking strictly necessary cookies may break parts of the site.
4.4 Via the advertising platforms
You can also opt out of personalized advertising directly:
- Meta (Facebook, Instagram): https://www.facebook.com/help/568137493302217
- Google: https://adssettings.google.com
- General opt-out (US): http://optout.aboutads.info or http://optout.networkadvertising.org
5.Do Not Track (DNT)
Some browsers can send a "Do Not Track" (DNT) signal. There's no industry-standard response to DNT, so we currently don't change our behavior based on it. You can still control cookies using the methods in Section 4 — and, unlike DNT, we do honor the Global Privacy Control (GPC) signal (see Section 4.2).
6.The Amaina app (not covered by cookies)
The Amaina iOS app is a native mobile client and generally does not use browser cookies. Instead it relies on provider SDKs — for example, Apple (Sign in with Apple, Speech-to-text, HealthKit, and In-App Purchase for subscriptions), Google Firebase (Auth, Firestore storage, and Crashlytics crash diagnostics), Adapty (managing your App Store subscription and unlocking paid features, and forwarding subscription-lifecycle events server-side to Amplitude), Amplitude (product analytics — anonymous usage events are sent only if you turn on "Usage analytics"; separately, subscription/billing events reach Amplitude through a server-side Adapty integration regardless of that setting, as contractual billing data — see our Privacy Policy), and Anthropic (Claude), which is called only from our backend to structure your logged text.
Crucially, advertising pixels run only on the website — not in the app. The app itself does use in-app product-analytics (Amplitude) and crash-diagnostics (Firebase Crashlytics) SDKs, described in our Privacy Policy — but these carry no health data and no ad targeting, and neither feeds advertising. No health data, HealthKit/Health Connect data, structured logs, or AI outputs are ever used for advertising, in the app or on the web. For everything the app collects and how we use it — including AI processing, your consent for it, and your rights — see our Privacy Policy, AI Processing Disclosure, HealthKit Data Use, and Subprocessors list.
7.Cookies and your privacy rights
Some cookies — especially advertising cookies — can count as personal information under US state privacy laws (such as the California CPRA and, where relevant, Washington's My Health My Data Act) and, if it ever applied to us, EU/UK data-protection law. How we handle that data, and the rights you have (to opt out of "sale"/"sharing," to limit use of sensitive information, and more), is covered in our Privacy Policy and Regional Addenda. To be clear: we do not classify or use any health data through website cookies, and we never put health data into advertising.
8.Note for EEA / UK visitors (secondary)
We do not currently target the EEA or UK at launch (Amaina is US-only). We include this note only in case that changes.
If we begin offering Amaina in the EEA or UK, we would load non-essential cookies (functional, analytics, advertising) only after you give prior opt-in consent through the banner, consistent with the ePrivacy rules and GDPR/UK GDPR, and you could withdraw consent as easily as you gave it. Strictly necessary cookies would remain exempt from consent. Any personal data collected through cookies would be handled as described in our Privacy Policy and Regional Addenda, with international transfers covered by Standard Contractual Clauses (SCCs) or the UK IDTA.
9.Changes to this policy
When we add, remove, or change cookies, we'll update this Cookie Policy and change the "Effective Date" at the top. For material changes we may re-prompt for consent. The current version is always available at amaina.health/cookies.