LEGAL · KAI COACH NZ
Cookie & Data Notice
What this covers
This notice explains the small files (cookies and similar tech) and the device data we use when you visit kaicoach.co.nz or use the Kai Coach mobile app. It sits alongside our Privacy Policy.
1. What is a cookie?
A cookie is a tiny text file a website stores on your device so it can remember you between page loads. Mobile apps use a similar mechanism (a secure token in device storage) instead of browser cookies.
2. The cookies / tokens we set
Strictly necessary (always on)
- session_token — keeps you signed in. httpOnly, Secure, SameSite=Lax. Expires after 7 days of inactivity.
- csrf_token — protects against cross-site request forgery on form posts.
- stripe_session — set briefly by Stripe Checkout to complete a payment. Set by stripe.com, not by us.
Functional (you can disable)
- ui_prefs — remembers your dark/light theme and household size selection. Local only.
- last_store — remembers your default supermarket (Pak'nSave / Woolworths NZ / New World).
What we do NOT use
- No advertising cookies
- No cross-site tracking pixels
- No third-party social media trackers (Facebook Pixel, TikTok Pixel, etc.)
- No fingerprinting
3. Mobile app data
The Kai Coach mobile app stores the following on your device:
- Auth token (Expo SecureStore) — keeps you signed in
- Expo push token — so we can send specials alerts (only if you opt in)
- Cached meal plans & grocery lists — so the app works offline
- App preferences (theme, household size, store)
You can clear all of this by signing out, or by deleting the app.
4. Analytics
We don't currently run analytics. If we add privacy-respecting analytics later (e.g. Plausible or self-hosted, anonymised & aggregated only), we will update this notice and notify you in-app at least 14 days before turning it on. We will never use Google Analytics or any tool that profiles you across other sites.
5. Third-party processors that may set their own cookies
- Stripe (stripe.com) — sets cookies to fight fraud and complete payments. See stripe.com/cookie-settings
- Google (when you sign in via Google OAuth) — sets cookies on accounts.google.com to authenticate you. See policies.google.com/technologies/cookies
- Apple (when you use Sign in with Apple on iOS) — see apple.com/legal/privacy
We do not have control over cookies set by these third parties on their own domains. Their privacy and cookie policies apply on those domains.
6. How to manage cookies
- Browser: use your browser settings to block or delete cookies (note: blocking 'session_token' will sign you out).
- Mobile app: sign out from Profile → Sign out, or delete the app to wipe everything.
- Functional cookies: toggle in Profile → Settings (coming soon).
7. Legal basis (NZ Privacy Act 2020)
We rely on the Privacy Act's Information Privacy Principle 1 (purpose) and Principle 3 (collection from the individual). Strictly-necessary cookies are required to operate the Service you signed up for. Functional cookies improve your experience and can be disabled.
8. Changes
We'll update this notice when our cookie use changes, with at least 14 days' notice for any new optional cookie.
9. Contact
Questions? Email kaicoachnz@gmail.com. We respond within 20 working days, per the NZ Privacy Act.