What is saved
This demo stores a random session identifier in hashed form, sample passes, an immutable credit ledger, bookings, request retry keys and a short rate-limit counter in a local server database. Data is sent to this demo’s server when you activate, book, cancel or clear; it does not remain only in your browser.
Cookies and isolation
The essential ty_session cookie links this browser to an isolated sandbox. It is HttpOnly and SameSite=Lax. The ty_csrf cookie protects form actions and can be read by the page. Both are host-only, last up to 24 hours and use Secure outside explicit loopback development. This is a simulation, not production customer authentication. Other visitors cannot inspect your bookings or consume your sample places.
How long it stays
Your sandbox expires 24 hours after it starts. Expired data cannot be read or changed. Bounded cleanup removes up to 100 expired sandboxes on server startup and mutations. Physical deletion may occur later than expiry if the server is idle. Sample passes have a separate 30-day validity rule; this does not extend the sandbox lifetime.
Clearing the demo
Use “Clear my demo” in My training to delete your current session’s records and cookies. A later page visit starts an empty session. This does not erase other visitors’ records or the shared timetable fixtures. Deleting cookies alone disconnects the browser; server records remain inaccessible until scheduled expiry and cleanup.
What is not collected
No names, email addresses, health details, body measurements, passwords, uploads or payment details are requested. There are no analytics, advertising cookies, wearable connections, messages to coaches or external calendar services. All photos and fonts are served locally. No payment provider is connected.
Local verification copies
The implementation includes a local backup and restore verification using synthetic test records only. Runtime retention and any future off-computer recovery must be defined before public staging. This demonstration is not presented as an operational service.
Privacy text for this local demonstration · 30 September 2026.