Version 1.0 Effective date: [to be completed]
The short version
- PerioSync uses six cookies, a few items of browser storage and a service worker. Each one is needed to sign you in, keep Accounts secure, apply the device limit, keep the free trial to one per person, show our offline page, or remember a choice you made in the app, such as your language.
- We do not use analytics, advertising, social media or tracking cookies. We load no third-party scripts. In normal use, no other company sets cookies through our website (section 7.2 explains the one exception).
- That is why we do not show a cookie consent banner. Before we ever add a cookie or tool that needs your consent, we will ask you first, and you will be free to say no.
- If you block or delete our sign-in cookies, you cannot sign in.
- This box is a summary. The full policy below is what applies.
1. Who we are and what this policy covers
1.1 PerioSync is operated by [to be completed], an individual trading as "PerioSync", of [to be completed]. Commercial registration / tax number: [to be completed]. In this policy, "PerioSync", "we", "us" and "our" mean the operator. "You" means the holder of a PerioSync account (your "Account"), and also anyone else who visits our website.
1.2 This policy explains what we store on your device, and read from it, when you use the PerioSync website and web app at https://periosync.com, including www.periosync.com, any other web address at which we provide the Service (for example periosync.vercel.app), and the app you can install from it (the "Service"). It also explains why we do so and what your choices are.
1.3 This policy forms part of our Privacy Policy (/privacy). Read it together with our Terms of Service (/terms) (the "Terms"). Words with capital letters have the meaning given in the Terms.
1.4 This policy is written in English. If it is translated, the English text applies, except where the law requires the translation to apply.
2. What cookies and browser storage are
2.1 A cookie is a small piece of text that a website asks your browser to keep. Your browser sends it back to that website with each later request.
- A session cookie is deleted when you close your browser. (Some browsers keep session cookies if you set them to restore your last session.)
- A persistent cookie stays until its expiry date, or until you delete it.
- httpOnly means that scripts running on the page cannot read the cookie. Only our server receives it.
- Secure means that the cookie is only sent over an encrypted (HTTPS) connection.
- SameSite=Lax means that your browser does not send the cookie with most requests that start on another website. This helps protect you against some kinds of attack.
2.2 Local storage is a small store inside your browser that our pages can read and write. It is not sent to our server automatically. It stays until you or your browser clear it.
2.3 A service worker is a small script that your browser keeps for a website. Ours makes the app installable and shows our offline page when you have no connection. It uses Cache Storage, which lets an installable web app keep files on your device. We keep only one file there: a page that tells you that you are offline.
2.4 The law treats all of these the same way, because each of them stores information on your device or reads it from there. In this policy we call them all "storage".
3. The complete list
3.1 The table below lists every cookie and every item of storage that the Service sets. There are no others.
| Name | Type | What it does | How long it lasts | Category |
|---|---|---|---|---|
ps_at |
Cookie (httpOnly, Secure, SameSite=Lax) | Holds your sign-in access token, so our server knows that a request comes from your Account. | Until you close your browser. With "Remember me" (and always after you create an Account): 30 days, counted again each time your sign-in is refreshed while you use the Service. Deleted when you sign out. | Strictly necessary |
ps_rt |
Cookie (httpOnly, Secure, SameSite=Lax) | Holds your sign-in refresh token, so your sign-in can be renewed without typing your password again. | Same as ps_at |
Strictly necessary |
ps_sid |
Cookie (httpOnly, Secure, SameSite=Lax) | Our identifier for this sign-in session. It lets you see your signed-in devices and sign them out, and lets us end a session. | Until you close your browser. With "Remember me" (and after you create an Account): 30 days from when you signed in. It is not renewed. You stay signed in only while this cookie exists. We also end a sign-in that has not been used for 30 days. Deleted when you sign out. | Strictly necessary |
ps_persist |
Cookie (Secure, SameSite=Lax; readable by the page) | Remembers whether you ticked "Remember me", so a renewed sign-in keeps the lifetime you chose. It contains only "1" or "0". | Same as ps_at |
Strictly necessary |
ps_did |
Cookie (httpOnly, Secure, SameSite=Lax) | A device identifier used only to stop the same browser from claiming more than one free trial. It is set when you create an Account while a free trial is on offer, and it is read only when an Account is created in this browser. See section 5. | 365 days from the most recent time it was set. It is not deleted when you sign out. | Security and fraud prevention |
ps_device |
Local storage | A random identifier for this browser. It is created when you first submit our sign-in or sign-up form, and sent to us each time you sign up or sign in. We use it to recognise a browser you have used before in your list of signed-in devices (which is how the device limit is applied), to protect administrator accounts, and for the free-trial check when ps_did is missing. See section 5. |
Until you clear your browser data | Security, fraud prevention and device limit |
ps_lang |
Cookie (Secure in production, SameSite=Lax; readable by the page) | Remembers the language you chose for the screens (English or Arabic). It contains only "en" or "ar". Set only when you press the language switch; until then the language follows your browser's setting. | 365 days from when you last chose a language. It is not deleted when you sign out. | Functional (your preference) |
ps_announce |
Local storage | Remembers whether you switched the "Say teeth" setting (the app reads tooth numbers aloud) on or off. | Until you clear your browser data | Functional (your preference) |
periosync.credit-notice |
Local storage | Remembers which low-credit notice you dismissed, so it is not shown again. | Until you clear your browser data | Functional (your preference) |
periosync:installed |
Local storage | Remembers that the app is installed on this device (from your installation, or because your browser reports it), so we offer to open the app instead of offering to install it. | Until you clear your browser data | Functional (your preference) |
Service worker (/sw.js) |
Service worker registration | Makes the app installable and shows our offline page when you have no connection. Registered when you first open any page. It contains no personal data. | Until you clear site data for periosync.com, or we remove it in an update | Strictly necessary |
periosync-v2-1 |
Cache Storage (service worker) | Holds the "offline" page that is shown when you have no connection. It contains no personal data. | Until it is replaced by an update of the app | Strictly necessary |
3.2 The categories mean:
(a) Strictly necessary. Needed to provide the Service you asked for: signing you in, keeping your sign-in secure, and making the app work as an installable app with an offline page. The Service cannot work without the sign-in cookies. The service worker and offline page only make the app installable and show a clearer message when you are offline; the rest of the Service works without them.
(b) Security and fraud prevention (and, for ps_device, the device limit). Needed to protect Accounts, to keep the free trial to one per person and, for ps_device only, to apply the device limit that is part of the Service. Section 5 explains these items in full.
(c) Functional (your preference). Each item records a choice you made, or the fact that you installed the app, and is used only for that.
3.3 What we keep on our side. Some of these values are also recorded on our servers. Your Account and session records include the device identifier described in section 5. Our free-trial records do not keep the device identifier itself. They keep a keyed hash of it (a one-way code that cannot be turned back into the identifier). We keep session records for 12 months after a session ends, and free-trial records for 24 months after they are created. Our Privacy Policy explains these records and how long we keep them.
4. Why we do not ask for cookie consent
4.1 The rules on cookies in the European Union and the United Kingdom, and similar rules in other countries, require a website to ask for consent before it places storage on your device or reads it. There is an exception. Consent is not needed for storage that is strictly necessary to provide a service that you have asked for.
4.2 We have checked each item against that exception, and we consider that all of them fall within it:
(a) Sign-in cookies. You ask us to sign you in. We cannot keep you signed in securely without them.
(b) The service worker and offline page. They are part of the app you chose to use. They contain no personal data and are not used to recognise you.
(c) Preferences. Each item records a choice you made in the app, or the fact that you installed the app, and is used only for that.
(d) The device identifier. Your browser creates it only when you submit our sign-in or sign-up form. We place the ps_did cookie only when you create an Account while a free trial is on offer. We use them only for the purposes in section 5.
4.3 We do not use any storage for analytics or statistics, advertising or marketing, profiling, social media features, or to follow you across other websites. We do not share storage values with advertisers or data brokers.
4.4 For these reasons we do not show a cookie consent banner today. Section 8 explains what we will do if that ever changes.
4.5 If a data protection authority or a court decides that any of these items needs your consent, we will stop using it or ask for your consent first, as section 8 describes.
5. The device identifier (ps_did and ps_device)
5.1 What it is. It is a random code of 32 characters. Your browser creates it the first time you submit our sign-in or sign-up form. It is not built from your device's hardware or settings, it is not a "fingerprint" of your device, and it does not contain your name, phone number or any other detail about you. We keep a copy in local storage (ps_device). When you create an Account while a free trial is on offer, our server also keeps a copy in a cookie (ps_did). If that cookie already exists, we keep the code it holds, so the two copies can differ. Keeping two copies means that clearing only one of them is usually not enough to reset the free-trial check.
5.2 What we use it for. We use it only for these purposes:
(a) Free trial, once per person. When you create an Account while a free trial is on offer, we compare a keyed hash of the identifier with our records of earlier free trials. We also check a keyed hash of your phone number and the network address range you connect from. If these checks suggest that this phone number or browser has already had a free trial, or that several free trials were recently given on the same network (for example, a shared clinic connection), your Account is still created, but a person checks the free trial before it is added. We never refuse an Account because of this check.
(b) Recognising your devices. When you sign in, the identifier lets us recognise a browser you have used before. That browser then keeps its place in your list of signed-in devices instead of counting as a new device. Without it, each sign-in could count as a new device, and once you reach your device limit, that could sign out one of your other devices.
(c) Protecting administrator accounts. For administrator accounts only, the identifier is used as part of our protection against password guessing.
ps_did is used only for (a). Points (b) and (c) use only ps_device. For (a), we use ps_did if your browser has it, and ps_device if it does not.
5.3 What we do not do with it. We do not use it for advertising, analytics or profiling. We do not combine it with information from other websites. We do not sell it. We do not share it with anyone except the providers that host the Service for us. Other websites cannot read it.
5.4 Why ps_did stays after you sign out. If signing out deleted it, anyone could reset the free-trial check just by signing out. Signing out ends your sign-in. It is not meant to make us forget the browser.
5.5 Our legal basis.
(a) Placing it on your device. We treat both copies as strictly necessary. ps_device is created only when you submit our sign-in or sign-up form. It is used only to recognise your devices, to apply the device limit that is part of the Service, to protect administrator accounts and, where ps_did is missing, for the free-trial check. ps_did is set only when you create an Account while a free trial is on offer, and it is used only for the free-trial check.
(b) Using it as personal data. Under the EU and UK General Data Protection Regulation, we use it to recognise your devices and apply the device limit because this is needed to perform our contract with you (Article 6(1)(b)). We use it to stop repeat free trials and to protect administrator accounts against password guessing on the basis of our legitimate interests in preventing fraud and keeping Accounts secure (Article 6(1)(f)). Under Egypt's Personal Data Protection Law No. 151 of 2020, we rely on the conditions described in section 3 of our Privacy Policy.
(c) How we limit it. The identifier is random and contains nothing about you. Our free-trial records keep only a keyed hash of it. We keep the records that contain it only for the periods in section 3.3.
(d) Other uses. If we ever want to use the identifier for any other purpose, we will update this policy first. Where the law requires it, we will also ask for your consent before we do.
5.6 Your choices. You can delete the identifier at any time (section 6). You can object to our use of it for free-trial checks and administrator protection by contacting us (section 10). We will then stop, unless we have compelling legitimate grounds that override your interests, such as preventing fraud, or we need it for a legal claim. We will tell you our decision within one month. Its use to recognise your devices is part of the Service you asked for. If you do not want it, delete it as section 6 explains. If you delete ps_device, you can still sign in, but this browser may then count as a new device in your list of signed-in devices. If you delete both ps_did and ps_device, we can no longer recognise the browser when someone signs up, but our other free-trial checks still apply.
6. Blocking or deleting storage
6.1 You can block or delete cookies and local storage in your browser's settings. Look for "Privacy", "Cookies" or "Site data". To delete everything PerioSync has stored, clear the site data for periosync.com. A private or incognito window starts with no storage and deletes it when you close the window.
6.2 This is what happens if you block or delete our storage:
| If you block or delete | What happens |
|---|---|
ps_at, ps_rt or ps_sid |
You are signed out, and you cannot sign in until you allow them again. If you block all cookies, you cannot use the Service. |
ps_persist |
Your sign-in may not keep the lifetime you chose. On a shared computer, always use "Sign out" when you finish. |
ps_did only |
Nothing changes when you sign in. The free-trial check can usually still recognise this browser through ps_device. |
ps_device only |
You can still sign in. This browser may count as a new device in your list of signed-in devices, which can sign out your least recently used device if you are at your limit. The free-trial check can still recognise this browser through ps_did, if it has one. |
Both ps_did and ps_device |
The same as for ps_device above. In addition, the free-trial check can no longer recognise this browser, but our other checks still apply. |
| All local storage (blocked) | You can still sign in, but this browser may count as a new device each time you sign in, and your settings are not remembered. |
ps_announce, periosync.credit-notice or periosync:installed |
Your "Say teeth" setting goes back to the default, dismissed notices may appear again, and the app may offer to install itself again. |
The service worker or periosync-v2-1 |
The app may not be installable from this browser, and when you have no connection, your browser shows its own offline message instead of ours. The rest of the Service works as before. |
6.3 When you sign out, we delete ps_at, ps_rt, ps_sid and ps_persist from your browser and end the session on our side. Signing out does not delete ps_did, ps_device, the service worker or your settings.
7. No third-party cookies
7.1 In normal use, no other company sets or reads cookies or other storage through our website. We do not use third-party analytics, advertising, social media buttons, chat widgets or embedded content from other websites. Our fonts are stored on our own servers. Our security settings allow our pages to connect only to our own website and to our database provider.
7.2 Our hosting providers (Vercel and Supabase) process the requests your browser sends to us so that the Service can run. In normal use they do not place cookies on our website. If we switch on our hosting provider's protection during an attack, it may place a short-lived security cookie to check that a visitor is not an automated attack. That cookie is strictly necessary to protect the Service. [to be completed] Our Privacy Policy lists the providers we use and where they are.
7.3 Links that take you elsewhere. Some buttons in the Service open other services: WhatsApp, banking and payment apps such as InstaPay or Telda, and, if online payment is offered, the hosted payment pages of Fawaterak or Paymob. Those services may use their own cookies under their own policies. We do not control them, and we do not receive their cookies.
7.4 Voice dictation. Speech recognition is provided by your web browser, under the browser maker's own terms (for example Google for Chrome, Microsoft for Edge, or Apple for Safari). It does not use any cookie set by us. Our Privacy Policy explains how voice dictation handles data.
8. Our promise: we will ask before adding anything else
8.1 Before we add any cookie, storage or tool that is not strictly necessary, we will do all of the following. This includes, for example, analytics, advertising, social media features, session recording and any third-party tracker. We will:
(a) update this policy and the table in section 3;
(b) ask for your consent before anything is stored on your device or read from it, with a clear choice in which refusing is as easy as accepting;
(c) store or read nothing of that kind if you refuse or do not answer;
(d) keep the Service working for you if you refuse; and
(e) let you change your mind at any time, as easily as you gave your consent.
8.2 We will never treat your continued use of the Service as consent.
9. Changes to this policy
9.1 We update this policy whenever the storage we use changes. The version number and effective date at the top show which version is current.
9.2 If we add a new item of storage, we will update this policy and the table in section 3, including the version and date at the top, before it is used. Where the change needs your consent, section 8 applies, and nothing is stored until you agree. We may also tell you about important changes in the app, or by WhatsApp or SMS to the phone number on your Account.
10. Contact us
10.1 For any question about this policy, or to object to our use of the device identifier, contact us:
- Email: munyashraf99@gmail.com
- WhatsApp: +20 112 569 2017 or +20 103 044 9593
- Post: [to be completed], [to be completed]
10.2 If you are in the European Union or the United Kingdom, you can also contact our representative there: [to be completed]; [to be completed].
10.3 You can complain to a data protection authority. In Egypt, this is the Personal Data Protection Centre. In the European Union or the United Kingdom, it is the data protection authority of the country where you live or work.
Related documents: