1. The short version
ArterialPulse sets one cookie, and only after you sign in. We use no analytics cookies, no advertising cookies, and no cross-site trackers — there is no Google Analytics, no tag manager, no advertising pixel and no session recording anywhere in the product.
That is also why you are not being asked to accept anything. A consent banner exists to gate non-essential storage, and we don’t set any. Everything described below is either required to sign you in, required to keep bots out, or a preference you set yourself.
2. Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
ap_session | Keeps you signed in. Contains a signed token identifying your user, organization and role. Set only when you actively sign in — never on the marketing pages. Marked httpOnly (JavaScript cannot read it), SameSite=Lax, and Secure over HTTPS. | 12 hours, or until you sign out |
That is the complete list. Signing out deletes it immediately.
3. Bot protection
The sign-in, sign-up and password-reset pages load Cloudflare Turnstile, which distinguishes people from automated scripts without the puzzles a CAPTCHA would show you. It may store a short-lived challenge token in your browser. It is used for security only, is not loaded on any other page, and is not used to profile or track you.
Because the site is served through Cloudflare, Cloudflare’s network may also set its own infrastructure cookies (such as __cf_bm) to manage traffic and block abuse.
4. Preferences stored in your browser
These are not cookies — they are kept in your browser’s local storage, are never sent to our servers, and contain no identifiers. We list them because they are still data stored on your device:
arterialpulse_onboarding_dismissed— remembers that you closed the getting-started checklist.arterialpulse_onboarding_step2_done— remembers that you ticked “app installed” by hand.workbench-config-v2-…— remembers whether a study’s settings panel was left open or collapsed.
Clearing your browser’s site data removes all three. Nothing breaks; the interface simply returns to its defaults.
5. Third parties that see a request
Two things load from outside our servers. Neither sets a cookie on our domain, but both mean an external service sees your IP address:
- Map tiles come from OpenStreetMap on pages that draw a corridor map. These pages are inside the signed-in portal only.
- Payments are handled by Stripe. We redirect you to Stripe’s own hosted checkout rather than embedding it, so any cookies Stripe sets belong to Stripe’s domain and their policy, not ours. We never see your card details.
6. Managing this
You can block or delete cookies in your browser settings. Blocking ap_session will prevent you from signing in, because it is the mechanism that keeps you signed in — there is no way around that. Blocking Turnstile may prevent sign-in and sign-up from completing.
We do not respond to Do Not Track signals differently, because we do not track you in the first place.
7. Changes and contact
If we ever add analytics or any other non-essential storage, we will update this page and introduce a consent mechanism before turning it on.
Questions: contact us, or email [email protected]. See also our Privacy Policy and Terms of Service.