< back
Cookie Policy
Last updated: October 21, 2026 - Effective: October 21, 2026
The short version: we set one cookie, and only when you sign in - it keeps you signed in. We do not use advertising cookies, retargeting pixels or anyone else's analytics on our pages, and we do not sell what we learn. A few things we show you - mostly videos - come from other companies, and they can set their own cookies inside their players. Everything is listed below, by name.
Contents
- The cookie we set
- What we keep in your browser instead of cookies
- How we count visits
- Other companies' content on our pages
- Checkout, booking and other places we send you
- Our emails
- What we do not do
- Your choices
- Changes to this policy
- How to contact us
1. The cookie we set
sb-fnioslsnlzyjpumdknva-auth-token
Keeps you signed in, so every page knows it is you without asking again. It holds your sign-in session, not your password. When the session is long it is split into parts with .0, .1 on the end of the name.
Set: when you sign in or make an account. Nobody who is not signed in gets it.
Lasts: until you sign out, or up to about 13 months.
Kind: strictly necessary. Without it you cannot stay signed in.
Sent to: this site only (it is not shared with other sites or domains).
That is the only cookie Hapitalist (run by Wannabe Press, LLC) sets itself.
2. What we keep in your browser instead of cookies
Some small settings live in your browser's own storage (called local storage and session storage). Unlike cookies, these are never sent along with your requests; the page reads them on your device. Session storage is cleared when you close the tab.
Your settings
joy_theme, joy_font, joy_text_scale - light or dark, the font and the text size you picked.
joy_nav_pins_v1 - which buttons you pinned to the bottom bar.
rd_* - your reader settings (font, size, line height, width).
Signing in
joy_signed_in_here, joy_srv_cookie, joy-auth - help this browser keep your session in step with the sign-in cookie above.
joy_came_for, joy_login_bounces (session storage) - the page you were on when you were asked to sign in, so we can take you straight back to it.
Coach Joy and the tools
joy_coach_room, joy_room_ok - which conversation with Joy you have open.
askjoy_vid - a random id for a conversation with the Ask Joy button when you are not signed in, so the conversation is still there when you come back.
joy_tier, joy_reader_key, joy_pending_kit, joy_last_tool - small reminders so pages open faster and where you left off.
joy_tarot_device, joy_tarot_guest_pull - if you pull a tarot card without signing in: a random id for this browser (one free card a day) and the card you pulled, so it can be saved to your account when you make one.
Where you came from
joy_anon - a random id for a visitor who is not signed in, used to count visits to our kits and tools.
joy_ref, joy_ref_at, joy_ref_sid, joy_ref_claimed, joy_ref_tracked (session storage) - if you arrived through someone's referral link (?ref=), which link it was, so the person who sent you is credited if you join.
joy_acq_done - that we have already noted how this browser first found us (a campaign tag, or the site that linked to us). We note it once and never overwrite it.
Speed
Our pages install a service worker that keeps copies of the site's own files (pages, scripts, styles) on your device so the app loads quickly and works on a bad connection. It holds no information about you.
3. How we count visits
We count page views, errors and the steps people take through the app in our own database - not with Google Analytics or any other outside analytics service. If you are signed in, this is tied to your account and used as the Privacy Policy describes. If you are not, it is tied only to the random ids above. It is used to see what works and what is broken, never for advertising.
4. Other companies' content on our pages
Some of what we show you is loaded from other companies. When it loads, your browser talks to them directly, so they receive your IP address and browser details, and some of them set cookies under their own name, governed by their own policies:
- Google Fonts (fonts.googleapis.com, fonts.gstatic.com) - the fonts on every page. No cookies.
- Streamable - most of our course and lesson videos. Its player can set its own cookies and runs its own analytics (Google Analytics) inside the player.
- YouTube - a few older posts embed YouTube videos. Most use YouTube's privacy-enhanced mode (youtube-nocookie.com), which sets no cookies until you press play; a couple use the standard player, which can.
- Vimeo, Spotify and Google Docs/Forms - embedded in a handful of posts and pages (for example, an application form). Each can set its own cookies.
- Embedly (cdn.embed.ly) - shows a few links in older posts as previews. It can set its own cookies.
- Images in some posts load from Unsplash and from the file store of our old publishing platform (storage.ghost.io).
5. Checkout, booking and other places we send you
- Payments happen on Stripe's own pages (checkout.stripe.com, buy.stripe.com). Stripe uses its own cookies there to process the payment and prevent fraud. We never see your full card number.
- Booking a call takes you to TidyCal (tidycal.com).
- The shop, the podcast and our other sites (shop.hapitalist.com, podcast.hapitalist.com, consulting.hapitalist.com) run on other platforms with their own cookie policies.
6. Our emails
The emails we send contain a small image that tells us the email was opened, and their links pass through a tracking address that tells us a link was clicked, before taking you where it says. We use this to know whether emails are arriving and which ones help, and to stop emailing people who no longer read them. Most email apps let you turn off loading images, which stops the open count.
7. What we do not do
- No advertising or retargeting cookies, and no tracking pixels from Facebook, Google Ads, TikTok or anyone else on our pages.
- No outside analytics on our pages.
- We do not sell personal information or share it for cross-context behavioral advertising.
8. Your choices
- Sign out to remove the sign-in cookie.
- Your browser settings let you block or delete cookies and clear site data (which also clears the browser storage in section 2). If you block our cookie you will not be able to stay signed in; everything you can read without an account still works.
- Embedded players (section 4) follow your browser's third-party cookie settings; many browsers block their cookies by default.
9. Changes to this policy
If we add a cookie or a new kind of tracking, we will list it here first and change the "Last updated" date above.
10. How to contact us
Questions about cookies or anything on this page: support@hapitalist.com. See also our Privacy Policy and Terms of Service.