1. Summary
This website sets no cookies unless you create an account. No analytics cookies, no advertising cookies, no tracking of any kind — not now and not then. Reading this site sets nothing at all, apart from one note on your device that you have seen the pop-up introducing the Routine Generator, so that it is not shown to you again (clause 6.2.2). Three cookies exist only once you start signing in — by pressing Save routine to your account, or Sign in in the header — and clause 6A names each one and says what it is for.
It does store things in your browser — the answers you give the Routine Generator — but it uses a different facility to do it, and that facility does not send anything anywhere. Clause 6 lists everything stored, by name.
No third-party request leaves your browser to display this site. Every file a page needs comes from sensible.com.sg. Until 7 September 2026 that was not true — two typefaces came from Google Fonts — and clause 5 records what was disclosed and when it stopped, rather than deleting it.
There is no cookie banner, because nothing is set until you ask for it. A banner exists to collect consent for cookies dropped on arrival. Nothing is dropped on arrival here; the only cookies are the ones that come with an account you chose to create. That is not an oversight.
2. What a cookie is, and why this page is short
2.1 A cookie is a small file a website asks your browser to store and then sends back to a server on every subsequent request. That return trip is what makes cookies useful for keeping you logged in, and what makes them useful for tracking you.
2.2 Until 16 September 2026 this website had no server-side component, no accounts and no analytics, so it had nothing to send a cookie back to, and it set none. That changed when accounts were added. It is still true of every page you can read: browsing this site sets no cookies at all. Three cookies are set only once you start signing in, and only from that moment. Two things start it: pressing Save routine to your account, and pressing Sign in in the header, which appears on every page. They are described in clause 6A. If you never press either, nothing on this site sets a cookie, and clause 2.3 still describes your visit. If you press one and then abandon the sign-in, the only cookie set is sensible_oauth, which expires in ten minutes.
2.3 We verified this on 2 September 2026 by loading every page of the website in an instrumented browser and inspecting the cookie store afterwards. It was empty. That measurement describes a visit in which no sign-in is started, which is every visit until you press Save routine to your account or Sign in. It was re-run on 16 September 2026, after accounts were built, on a visit that went all the way through the Routine Generator to a finished routine and created no account: the cookie store for this website was inspected in the browser's own developer tools — the view that shows every cookie, including the ones a script is not allowed to read — and it was empty. The storage list in clause 6 was re-derived from the source of all 24 pages on 4 September 2026.
3. Do you need to consent to anything?
3.1 Under the Personal Data Protection Act 2012, consent obligations attach to the collection, use or disclosure of personal data. The Personal Data Protection Commission's Advisory Guidelines on the PDPA for Selected Topics (revised May 2024) address when data collected through online activities amounts to personal data.
3.2 Reading this website still collects no personal data through your browser. The items in clause 6 stay on your device unless you sign in and save a routine, in which case a short code derived from some of them is sent to us — clause 8A of the Notice says exactly which, and your pregnancy or breastfeeding answer is never among them. If you never sign in, nothing is sent and there is nothing here for you to consent to. That was the whole position until 16 September 2026 and it remains the position for every reader who does not create an account.
3.2A Signing in is different, and it is the act of consent. From 16 September 2026 this website has accounts. Creating one is a deliberate thing you do: you press a button, you leave for a page hosted by Shopify, you enter your email address, and you enter a code we send to it. From that point we hold your email address and the routines you save — set out in full at clause 8A of the Privacy Policy & Data Protection Notice. We treat that sequence as your consent to hold them, because there is no way to arrive at it by accident. Nothing about it is silent, and nothing is collected before it.
3.2B Agreeing to hear from us is a separate question again. It is never bundled into signing in, the box is never ticked for you, and you can sign in without touching it. Clause 9 of the Notice governs it, and clause 9.1AA says plainly what the one list covers.
3.3 If we ever collect something we do not collect today — analytics, advertising, or anything that transmits data about your visit — we will publish a revised policy, present a consent mechanism, and obtain your consent before it operates. It will not be added quietly. That promise was made on 4 September 2026 and it is worth saying how it was kept when accounts arrived: this policy was revised, clause 6A was written, and the question of hearing from us was asked separately rather than folded into the account.
4. What we do not do
For the avoidance of doubt, and because the negative list is the useful one:
- No Google Analytics or any other analytics package
- No tag manager
- No advertising or conversion pixels
- No social media pixels or share widgets that phone home
- No session recording, heatmaps, or scroll tracking
- No fingerprinting
- No A/B testing tools
- No chat widget
- No cross-site tracking of any kind
- No sale or sharing of browsing data. There is none to sell.
5. Third-party requests
5.1 There are none. Loading any page of this website causes your browser to request files from sensible.com.sg and from nowhere else. No analytics, no tag manager, no advertising or consent vendor, no social buttons, no embedded video, no hosted fonts, no content delivery network. Because nothing on the page points at another company, no other company is told your IP address or which page of this site you were reading.
5.2 This was not always true, and we are not going to quietly delete the admission. Until 7 September 2026 every page requested two typefaces from Google Fonts (fonts.googleapis.com for the stylesheet, fonts.gstatic.com for the font files), and one page kept requesting a third until 9 September 2026. To serve those requests Google received the IP address and the Referer header, which identifies the page being read. On a website about skin conditions that was not trivial. This document said at the time that the answer was to remove the request rather than to describe it more elegantly. The typefaces are now served from sensible.com.sg itself and the requests are gone.
5.3 What that means in practice, and how to check it. You do not have to take this paragraph on trust. Open your browser's developer tools, select the Network tab, and reload any page: every row will be a sensible.com.sg address. Separately, this site sends a Content-Security-Policy header — enforced by your browser, not by us — whose default-src, font-src and connect-src are set to this origin only. If a third-party request were ever added here by mistake, your browser would block it rather than serve it.
5.3A One thing does leave this site, and only if you ask for it. Pressing "Save routine to your account" takes you to a sign-in page on shopify.com — you leave this website, sign in there, and come back. Nothing on any page of this site loads anything from Shopify, and no Shopify code runs here. Clause 12.8 of the Privacy Policy & Data Protection Notice sets out what they can see while you are on their page.
5.4 Two outbound links on the moisturiser page point to pubmed.ncbi.nlm.nih.gov. Those are links, not requests — nothing is sent unless you click, and if you do, you have left this site.
6. Everything this website stores in your browser
6.1 The website uses two standard browser facilities, localStorage and sessionStorage. Neither transmits anything. Both are visible to you in your browser's developer tools.
6.2 Every item is named with the prefix sensible_.
6.2.1 Your routine answers and the routine built from them
localStorage — persists until you clear it.
| Name | What it holds |
|---|---|
sensible_routine_pregnancy_status | Whether you said you are pregnant, breastfeeding, both, or neither |
sensible_routine_skin_type | Oily, dry or combination |
sensible_routine_cleanser | The cleanser recommendation, and whether you said you wear makeup or sunscreen |
sensible_routine_sun_exposure | Whether you said you exercise or sweat heavily in the sun |
sensible_routine_actives | The skin concerns and goals you selected, in the order you ranked them |
sensible_routine_selected_actives | The active ingredients in your routine |
sensible_routine_suggested_actives | The actives the generator suggested for you, kept so the results page can show what it did and did not pick |
sensible_routine_coverage_notes | Notes on which of your concerns each active was chosen for |
sensible_routine_moisturizer | The moisturiser recommendation |
sensible_routine_sunscreen | The sunscreen recommendation |
sensible_shop_bag | Which steps you marked as bought, skipped, added to your list, or removed |
sensible_shelf_wants | Which products you pressed "I'd buy this" on. This stays on your device. It is not sent to us and it is not counted anywhere — see the Privacy Policy & Data Protection Notice, clause 6 |
6.2.2 Interface state — no personal data
localStorage.
| Name | What it holds |
|---|---|
sensible_routine_actives_entered | Whether you have visited the actives page before |
sensible_routine_actives_shortfall | An internal flag noting that fewer actives were available than expected |
sensible_routine_cue_hover_done | Whether you have seen the "hover for more" hint |
sensible_routine_cue_actives_done | Whether you have seen the actives hint |
sensible_routine_cue_removex_done | Whether you have seen the "tap ✕ to remove" hint |
sensible_hub_dealt | Whether the routine hub's opening animation has already played |
sensible_routine_actives_browsed | Whether you have opened the page that explains the active ingredients |
sensible_routine_last_page | Which step of the routine generator you were on last, so that coming back takes you to where you left off rather than to the start |
sensible_intro_seen | Whether this device has already seen the pop-up that introduces the Routine Generator, so that it is shown only once. "Start over" does not remove it (clause 7.1) |
6.2.3 Session state — cleared when you close the tab
sessionStorage.
| Name | What it holds |
|---|---|
sensible_routine_whirlpool_shown | Whether an introductory overlay has been shown |
sensible_shop_layer_ack | Whether you have acknowledged the ingredient-layering notice |
sensible_routine_pregnancy_session | Whether you have answered or confirmed the pregnancy question during this visit, so you are not asked twice |
sensible_news_pending | Whether you ticked the box asking to hear from us, just before signing in, so your answer is not lost while you are away on the sign-in page. Read once when you come back, then removed |
sensible_routine_exclude_backup | If you press the ✕ on a step to take it out of your routine, this holds that step's own answer so that pressing ✕ again puts it back — including after you reload the page or go into a step and come back. It is your own answer, kept on your device, and it goes when the tab closes |
sensible_routine_editing | Which of your saved routines you pressed Edit on, so that saving puts the edited version in its place instead of adding a new one. Removed once saved, or when you start a new routine |
6.3 That is the complete list of items stored in localStorage and sessionStorage. If you find something stored by this website that is not on it, tell us at dpo@sensible.com.sg and we will either explain it or remove it.
6A. Cookies set by accounts
6A.1 These three cookies are set only when you start signing in — either by pressing Save routine to your account, or by pressing Sign in in the header, which is on every page. None of them is sent to any other company. If you never start signing in, none of them exists; if you start and then change your mind, only sensible_oauth will have been set, and it expires in ten minutes.
| Name | Lasts | What it holds | Why |
|---|---|---|---|
sensible_oauth | 10 minutes | A single-use random number, which page to return you to, and — if you ticked it — your answer to "tell me when the shop opens" | So that the reply from the sign-in page can be checked as genuine, and so you come back to the page you left with your answer intact |
sensible_session | 30 days | Proof that you are signed in | So you are not asked to sign in again every time |
sensible_logout | 30 days | One code that identifies your sign-in | So that Sign out can end your sign-in at Shopify as well as here |
6A.2 All three are encrypted, so your browser cannot read what is inside them, and all three are marked HttpOnly, so no script running on the page can read them either.
6A.3 Signing out. Pressing Sign out deletes sensible_session and sensible_logout from your browser straight away, and then sends you briefly to Shopify's page so that your sign-in there is ended too, before returning you to our home page. Both steps matter: without the second, Shopify would still remember you, and pressing Sign in again would let you straight back in without asking for a code. If that second step cannot be completed, you are still signed out of this website. Clearing your browser's cookies also signs you out here. None of the three cookies holds your routine, your answers, or your email address — what an account holds is set out in clause 8A of the Privacy Policy & Data Protection Notice.
6A.4 Thirty days, not a year. The sign-in system we use offers sessions lasting up to 365 days. We set 30 on purpose: a routine built around a pregnancy or breastfeeding answer is not something to leave signed in on a shared or mislaid phone for a year.
7. Your control over it
7.1 Clear it from the website. A "Start over" control on the pages that show a finished routine clears every sensible_ item at once, from both stores — except sensible_intro_seen, so that the introductory pop-up does not come back — and takes you back to the first question. It tells you what it will do and asks before doing it.
7.2 Clear it from your browser. Clearing site data or browsing data for sensible.com.sg erases all of it.
7.3 Prevent it entirely. Private or incognito browsing discards everything when you close the window. Blocking site data for this domain will also work, but the Routine Generator will not be able to remember your answers between pages and will not function usefully.
7.4 What you lose. Erasing this data erases the routine stored on your device. Unless you have saved it to an account, we hold no copy and cannot restore it. That is a direct consequence of not collecting it. If you have saved it to an account, signing in shows it again — see clause 8A of the Privacy Policy & Data Protection Notice, which also explains why redoing it asks the pregnancy and breastfeeding question again.
8. When you buy something — from the Shop Opening Date
8.1 Checkout is operated by Shopify on our behalf. Shopify's checkout does set cookies, which are necessary to keep a shopping cart and to process a payment securely.
8.2 Those cookies are set by Shopify under its own terms and policies, at the point you enter the checkout, and not before. Browsing this site does not set them.
8.3 We will update this Policy to list them before the shop opens. This clause is a statement of intent, not a description of anything currently in operation.
9. Changes
9.1 If we begin using cookies, we will revise this Policy, say so prominently, and — where consent is required — obtain it before the cookie operates.
9.2 The date at the top of this Policy is the date it took effect. Superseded versions are retained internally.
10. Contact
| SENSIBLE SKIN PTE. LTD. | UEN 202640831H |
| Registered office | On the public register at ACRA, under UEN 202640831H |
| Data Protection Officer | The Data Protection Officer |
| dpo@sensible.com.sg |
Version 2.6 · In force from 30 September 2026.
The list in clause 6 was checked against the site's own source on 4 September 2026. We review this Policy whenever the site's scripts or third-party requests change, and again before the shop opens. If you find something stored by this website that is not on that list, tell us — the address is in clause 10.