Cookies
Last updated 26 August 2026
Two cookies, both set only after you sign in, and neither of any use to anyone else. Nothing is set before you sign in, and nothing is shared.
01The cookies we set
| Name | wellovue_refresh |
|---|---|
| Purpose | Keeps you signed in, and lets a reload restore your session |
| Set when | You sign in. Never before |
| Contains | A random value. No name, email, or health data |
| Readable by scripts | No. It is HttpOnly, so page code cannot read it |
| Sent to other sites | No. It is SameSite=Strict and scoped to /api/auth |
| Expires | 30 days, or immediately when you sign out |
The second exists only so a public page can tell that you are already signed in, and offer you your own timeline instead of a login form.
| Name | wellovue_signed_in |
|---|---|
| Purpose | Lets a public page show a link to your timeline |
| Set when | You sign in. Never before |
| Contains | The single character 1. Nothing else |
| Grants access | None. The server never trusts it for anything |
| Readable by scripts | Yes, deliberately. That is the whole point of it |
| Expires | 30 days, or immediately when you sign out |
02Why there is no cookie banner
Under UK and EU rules, a cookie that is strictly necessary to provide a service the user asked for does not require consent. Keeping you signed in and knowing where to send you are both that kind of cookie, and they are the only ones we set.
If we ever add one that is not strictly necessary, you will be asked first, and it will be off until you say yes. We would rather not add one at all.
03What we do not do
- No analytics cookies. We do not use Google Analytics or any equivalent.
- No advertising or tracking cookies, and no pixels.
- No third-party scripts on any page. Public pages load nothing from another domain.
- Nothing in local storage. Your access token is held in memory for the tab and is gone when you close it.
04Removing it
Signing out deletes both. You can also clear them from your browser settings at any time. The only consequence is that you will be signed out and will need to sign in again.
If you used Wellovue before it was renamed, an older cookie named diabetes_refresh may still be on your device. It does nothing, and we delete it the next time you sign out.
05Questions
What we hold and why is set out in the privacy policy. Anything else, use the contact page.