Cookie Policy

1. About this Policy

This Cookie Policy explains what Thrive Strong Group Pty Ltd (ABN 41 691 205 366, ACN 691 205 366), trading as LinkedWithin ("LinkedWithin", "we", "us", "our"), stores on your device when you use the LinkedWithin website at linkedwithin.com and the LinkedWithin apps for iOS and Android (together, the "Platform"). Read it with our Privacy Policy, which explains how we handle personal information. Capitalised terms have the meaning given in our Terms and Conditions.

2. What cookies and similar technologies are

A cookie is a small text file a website places in your browser so it can recognise you on your next request. Browsers also offer "local storage" and "session storage", which let a website keep small pieces of information on your device without sending them to the server. Session storage is cleared when you close the tab; local storage stays until it is deleted. We use these three things, only as described below, and nothing else: no pixels, web beacons, device fingerprinting or advertising identifiers.

3. Cookies our website sets

Every cookie we set is first-party (set by linkedwithin.com and readable only by us). Each is either strictly necessary to sign you in and keep your session secure, or records a choice you made.

Cookie	Purpose	Duration	Type
auth-token	Keeps you signed in. Holds a signed session token. Marked HttpOnly (not readable by scripts), Secure (HTTPS only) and SameSite=Lax. Removed when you sign out or delete your Account.	7 days	Strictly necessary
oauth-pending	Set only while you finish creating an Account with Google or Apple sign-in, so sign-up can complete after you accept our Terms and Privacy Policy. Google and Apple sign-in on the website is currently switched off; the apps use it without cookies.	10 minutes	Strictly necessary
oauth-state	Set only while a Google or Apple sign-in on the website is in progress, to protect the sign-in from forgery (HttpOnly, Secure). Not set today because website Google and Apple sign-in is switched off.	10 minutes	Strictly necessary
sidebar_state	Remembers whether you collapsed or expanded the navigation sidebar. Set by the page in your browser, not by our server.	7 days	Preference you chose

A fourth cookie name, refresh-token, is reserved in our software but is never set on the website; the apps receive refresh tokens directly, not as cookies.

4. Information kept in your browser's storage

Our web pages keep the keys below in your browser's local storage (or, for the last row, session storage). They are never sent to us, never shared and never used to track you; they only make the Platform behave the way you set it.

Purpose	Keys	What they hold
Appearance and layout	theme sidebar-main-pages-order dashboard-cards-order lw-vault-sort lw-life-timer-countdown-format	Light or dark theme; the order you gave your sidebar pages and dashboard cards (cleared when you sign out); your Within Drive sort order; your Life Timer display format.
AI Within drawer	ai-chat-active-thread ai-chat-is-open	Which conversation is open in the AI Within drawer and whether the drawer is open.
Onboarding and hints	lw-has-seen-walkthrough ai-chat-has-seen-onboarding lw.voice.micHintDismissed ritual-glanced	Whether you have finished the welcome tour, seen the AI Within introduction, or dismissed the microphone hint, so we do not show them again; and whether you have glanced at your day in the Ten-Second Ritual today.
Help Centre in the apps	lw-help-embed (session storage)	When the app opens the Help Centre in its built-in web view, a flag that hides the website's header so the page fits the app.
Consent record	lw_cookie_policy_accepted_version	The version of this Policy you accepted, if we ever ask you to accept one (Section 8). Not written today.
Visit counting	lw-visit-sent (session storage)	A flag so our public landing page counts your visit once per browser session. The count is anonymous: page, country, referrer, campaign tags, device type, language and time zone, with no identifier. To find the country our server sends your IP address once to the ipapi.co lookup service; the IP address is not stored in the visit record, though it can appear in our technical logs for up to 30 days like any other request.

5. What we do not use

• No third-party scripts on our pages, and no third-party cookies except inside a Stripe page (Section 6.1) or a video player you chose to open (Section 6.2).
• No analytics or performance cookies and no third-party analytics service. The anonymous visit count in Section 4 is made by our own server and cannot identify you.
• No advertising or marketing cookies, pixels or tags. We show no advertising and never sell or share your information for advertising.
• No fingerprinting, session recording or cross-site tracking.
• No font requests to Google from the website: our fonts are copied into the website when it is built, so your browser does not contact Google to display them. (The mobile apps do download their typeface from Google Fonts on first run; see Section 7.)

6. Pages and players run by other companies

6.1 Stripe pages

When you buy or manage a website Subscription you are taken to checkout and billing-portal pages hosted by Stripe, our payment provider. Stripe sets its own cookies on those pages for security, fraud prevention and to run the checkout. They are governed by Stripe's privacy policy (stripe.com/privacy), not by this Policy.

6.2 The Within Player

You can attach a link to a video or audio track on another platform to an entry and play it inside LinkedWithin. Nothing loads until you press play. When you do, the Within Player opens that platform's own player in a sandboxed frame: the platform (for example YouTube, Vimeo, TikTok, Instagram, Facebook, X, Loom, Wistia, Vidyard, Streamable, Rumble, Dailymotion, Twitch, Kick, Bilibili, TED, Spotify or Google Drive) then serves the content to your browser directly, sees your IP address, and may set or read its own cookies inside the player under its own privacy policy. We keep the frame to playback features only, we send the platform no more than our own web address as the referrer, we never pass your name or account details, and where a platform offers a privacy-enhanced mode (YouTube's youtube-nocookie.com) we use it. If you would rather the platform set nothing, do not press play; the link itself sets no cookie.

7. The apps for iOS and Android

The apps do not use cookies. They keep on your device:

• your sign-in tokens, in the iOS Keychain or the Android Keystore;
• a cache of your own data so the app opens quickly and works offline, refreshed on a rolling 30-day basis;
• a push-notification token issued by Firebase Cloud Messaging, if you allow notifications;
• the app's typeface, downloaded once from Google Fonts on first run and then kept on the device (so your device contacts Google's font servers once);
• your app settings.

The apps contain no advertising identifiers and no advertising or analytics software, and they do not track you across other apps or websites, which is why you will not see an App Tracking Transparency prompt on iOS. During an AI Within voice session the app contacts a public Google STUN server once to discover your network address. The Help Centre and the Within Player open inside the app's built-in web view, where Section 4 (one session-storage flag) and Section 6.2 (the video platform's own cookies, only when you press play) apply. Our End User Licence Agreement describes on-device data in more detail.

8. Consent and your choices

8.1 Why there is no cookie banner

Cookie laws such as the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations require consent before information is stored on your device, except where the storage is strictly necessary to provide a service you have asked for or records a preference you have set. Everything in Sections 3 and 4 falls within those exemptions, so we do not ask for consent and do not show a banner. A video platform's player (Section 6.2) loads only after you press play on a link you pasted, which is the "two-click" pattern European regulators accept: your click is the request, and the platform's own notice applies from that moment. If we ever want to add a cookie or storage that needs consent (for example, analytics), we will show a consent tool first, with a Reject option and choices by category, and we will update this Policy.

8.2 Browser controls

You can view, delete and block cookies and site storage in your browser settings. If you block or delete the auth-token cookie you will be signed out and cannot sign in until it is allowed. Deleting local storage only resets the preferences in Section 4.

8.3 Do Not Track and Global Privacy Control

We do not sell or share personal information, we do not track you for advertising and we do not profile you, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off. We honour those signals in the simplest way possible: every visitor is treated as if the signal were on.

9. Regional notes

• Australia: where information kept by a cookie identifies you, it is personal information under the Privacy Act 1988 (Cth) and our Privacy Policy applies. We do not use cookies for direct marketing.
• EU/EEA and United Kingdom: see Section 8.1. Personal data in the auth-token cookie is processed to perform our contract with you (GDPR Article 6(1)(b)) and to keep the Platform secure.
• United States (including California): we do not sell or share personal information, do not use cookies for targeted advertising, and honour Global Privacy Control signals (Section 8.3), so no "Do Not Sell or Share" link is needed. California residents' rights are in our Privacy Policy.
• GCC (Saudi Arabia, the UAE and the other Gulf states): we store only what is needed to provide the service you asked for, which those laws permit as processing necessary to perform our contract with you, and we never use cookies for marketing.

10. Changes to this Policy

We will update this Policy if the cookies or storage we use change. Material changes are notified in the way our Privacy Policy describes, earlier versions stay available at linkedwithin.com/legal/cookies/v/<version>, and any new use that needs consent will be preceded by a consent tool.

11. How to contact us

Email: legal@linkedwithin.com

Post: Thrive Strong Group Pty Ltd (trading as LinkedWithin), 490 Northbourne Ave, Dickson ACT 2602, Australia

All our legal documents are at linkedwithin.com/legal.