1. The short version
ArterialPulse sets one cookie, and only after you sign in. We use no advertising cookies and no cross-site trackers — there is no Google Analytics, no tag manager, no advertising pixel and no session recording anywhere in the product.
We do count page views, using Cloudflare Web Analytics. It sets no cookie, stores nothing on your device and does not follow you from site to site (see section 4).
That is also why you are not being asked to accept anything. A consent banner exists to gate non-essential storage, and we don’t set any. Everything stored on your device is either required to sign you in, required to keep bots out, or a preference you set yourself.
2. Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
ap_session | Keeps you signed in. Contains a signed token identifying your user, organization and role. Set only when you actively sign in — never on the marketing pages. Marked httpOnly (JavaScript cannot read it), SameSite=Lax, and Secure over HTTPS. | 12 hours, or until you sign out |
That is the complete list. Signing out deletes it immediately.
3. Bot protection
The sign-in, sign-up, password-reset and contact pages load Cloudflare Turnstile, which distinguishes people from automated scripts without the puzzles a CAPTCHA would show you. It may store a short-lived challenge token in your browser. It is used for security only, is not loaded on any other page, and is not used to profile or track you.
Because the site is served through Cloudflare, Cloudflare’s network may also set its own infrastructure cookies to manage traffic and block abuse: __cf_bm, and cf_clearance, which records that your browser passed a Cloudflare security check (you may see this check on the home and sign-in pages). These belong to Cloudflare, are used for security only, and are covered by Cloudflare’s own policy. Cloudflare also hides email addresses on our pages from spam harvesters with a small script that stores nothing.
4. Page analytics
We use Cloudflare Web Analytics on the marketing site and in the portal to see which pages are visited and how fast they load. It records, in aggregate, the page address, the referring site, your browser and device type, your country, and page-load timing.
It sets no cookies, writes nothing to local storage, does not fingerprint your browser, and does not track you across other sites. We do not use it for advertising, and it does not tell us who you are. See Cloudflare Web Analytics for how Cloudflare handles it. If you block static.cloudflareinsights.com in your browser, nothing on the site breaks.
5. Preferences stored in your browser
These are not cookies — they are kept in your browser’s local storage, are never sent to our servers, and contain no identifiers. We list them because they are still data stored on your device:
arterialpulse_onboarding_dismissed— remembers that you closed the getting-started checklist.arterialpulse_onboarding_step2_done— remembers that you ticked “app installed” by hand.workbench-config-v2-…— remembers whether a study’s settings panel was left open or collapsed.
Clearing your browser’s site data removes all three. Nothing breaks; the interface simply returns to its defaults.
6. Third parties that see a request
Three things load from outside our servers. None sets a cookie on our domain, but each means an external service sees your IP address:
- Map tiles come from OpenStreetMap on pages that draw a corridor map. These pages are inside the signed-in portal only.
- Page analytics load from Cloudflare (section 4).
- Payments are handled by Stripe. We send you to Stripe’s own pages (hosted checkout, the billing portal for managing a subscription, and hosted invoice pages for purchase orders) rather than embedding them, so any cookies Stripe sets belong to Stripe’s domain and their policy, not ours. We never see your card or bank details.
7. Managing this
You can block or delete cookies in your browser settings. Blocking ap_session will prevent you from signing in, because it is the mechanism that keeps you signed in — there is no way around that. Blocking Turnstile may prevent sign-in, sign-up and the contact form from completing.
We do not respond to Do Not Track signals differently, because we do not track you in the first place: our only analytics are aggregate and cookieless, so there is nothing to switch off per visitor.
8. Changes and contact
If we ever add analytics that set cookies or identify you, or any other non-essential storage on your device, we will update this page and ask for your consent before turning it on.
Questions: contact us, or email [email protected]. See also our Privacy Policy and Terms of Service.