Cookie Policy

This Cookie Policy explains how FlowFn, operated by FLOW FN PTE. LTD. (UEN 202617303Z), a company incorporated in Singapore ("we", "us", or "our"), uses cookies and similar tracking technologies when you use our Service. This policy should be read alongside our Privacy Policy. By using the Service, you consent to the use of cookies as described in this policy.

Cookies are small text files that are placed on your device when you visit a website. They are widely used to make websites work more efficiently and provide information to website owners. We use cookies and similar technologies (such as web beacons, pixels, and local storage) to enhance your experience with the Service.

We use the following types of cookies: (a) Essential Cookies: Required for the Service to function, including authentication and security; (b) Functional Cookies: Remember your preferences and settings; (c) Analytics Cookies: Help us understand how you use the Service; and (d) Performance Cookies: Monitor Service performance and measure our marketing — in our cookie banner and preference centre this category is labelled "Advertising & measurement" and also controls the Google Ads conversion-measurement cookies described in §6a.

Essential cookies are necessary for the Service to function and cannot be disabled. The specific essential cookies we set are: (a) `sid` — your session and authentication cookie (HTTP-only, Secure, SameSite=Lax) used to authenticate your identity and maintain your dashboard session; (b) `tid` — a team-context cookie (HTTP-only, Secure, SameSite=Lax) that remembers which team or workspace you have selected; (c) `flowfn_form_access_*` — short-lived access cookies (HTTP-only) issued when you authenticate to a password-protected public form; and (d) browser local-storage entries `cookie_consent` and `cookie_consent_prefs` that store your cookie-consent choices. Without these cookies, you cannot sign in, remain signed in, or open password-protected forms.

Functional cookies enhance functionality and personalization. These cookies: (a) remember your preferences (language, theme, etc.); (b) remember your settings and configurations; (c) provide enhanced features; and (d) remember information you have entered. The specific first-party functional cookies we set are: (i) `flowfn-color-scheme` — your light / dark theme preference, mirrored to a cookie so the next page render uses the correct mode without a flash; (ii) `ff_ref` — a 30-day attribution cookie set from `?ref=<code>` referral URLs so the signup form can credit the referrer if you create an account on a later page view; and (iii) `flowfn_home_content_version` — a 365-day cookie remembering which version of our home page you first saw (it can be pre-selected by a campaign link, e.g. `?hm=...`), so repeat visits land on a consistent page. The `ff_ref` and `flowfn_home_content_version` cookies are only written after you grant functional-cookie consent through our cookie banner; declining or not yet answering the banner suppresses them. Functional cookies may be set by us or third-party service providers.

Analytics cookies help us understand how users interact with the Service. We use Google Analytics 4 (Google LLC) on the public marketing site (flowfn.com) only — it is loaded only after you grant analytics consent through our cookie banner and is never loaded for users who decline. Google Analytics sets `_ga`, `_ga_<container-id>`, and (where used) `_gid` cookies in your browser to: (a) collect information about how you use the marketing site; (b) track which pages and features are most popular; (c) identify errors and performance issues; (d) help us improve the Service; and (e) provide usage statistics. We do not currently run Google Analytics, any third-party product analytics, session-replay, or behavioural-advertising vendor inside the authenticated dashboard.

If you grant advertising & measurement consent (the performance-cookie category — accepted or rejected as a whole via our cookie banner; signed-in users can additionally toggle the "Advertising & measurement" category individually under Dashboard → My account → Cookie preferences), we load the Google Ads conversion-measurement tag (Google LLC) on the public marketing site (flowfn.com) only. It sets `_gcl_au` and related `_gcl_*` cookies (persistent, typically 90 days) to measure whether a visit or signup followed one of our ads. We run this tag in conversion-measurement-only mode: ad-personalization consent signals are denied, Google's ads-data redaction is enabled, and we do not use remarketing, audience building, or cross-context behavioural advertising. The tag is never loaded inside the authenticated dashboard, and never loaded for visitors who decline or have not yet answered the banner. See https://policies.google.com/privacy.

Performance cookies collect information that helps us measure and improve the Service — page load times, error rates, responsiveness, and the effectiveness of our marketing. In our cookie banner and preference centre this category is labelled "Advertising & measurement" and also controls the Google Ads conversion-measurement cookies described in §6a. Beyond the measurement identifiers described there, these cookies do not collect personally identifiable information.

Some cookies are set by third-party services we use, including: (a) Google Analytics 4 on the marketing site only and only after analytics consent — see §6; (b) Stripe — when you visit a Stripe-hosted checkout, billing portal, or payment form, Stripe may set its own cookies for payment functionality, fraud prevention, and session security under its independent privacy policy at https://stripe.com/privacy; (c) BYOK third-party tools you connect to your own workflows (for example a marketing platform or external app) may set cookies in your browser when you authenticate to them; (d) AWS CloudFront edge nodes may set short-lived cookies for content delivery and signed-URL handling; and (e) Google reCAPTCHA — on the sign-up, sign-in, and FlowFn-hosted public form pages (including the form iframe that embeds load from a flowfn.com origin), Google sets a `_GRECAPTCHA` cookie used solely for invisible bot and abuse detection (reCAPTCHA v3). It is a security cookie; we do not use it for advertising or cross-site tracking. Forms served on your own custom (white-label) domain do not load reCAPTCHA. See §5a of our Sub-Processors list and https://policies.google.com/privacy; and (f) Google Ads — conversion-measurement cookies (`_gcl_*`) on the marketing site only and only after advertising & measurement consent — see §6a. These third parties operate under their own privacy policies and cookie practices.

When a third-party website embeds a FlowFn agent chat widget (via our `agent-widget.js` script), an iframe is loaded from our domain (`app.flowfn.com`). The iframe does not set any cookies in your browser. The widget's chat session is identified by a short-lived signed token held only in JavaScript memory for the lifetime of the iframe; closing the tab clears it. Messages you type into the widget are sent to our servers and processed by the AI provider configured by the agent's owner under their independent privacy policy. We do not collect your email, name, or other personal identifiers in the widget unless the embedding site explicitly chooses to pass them as agent input.

Cookies may be: (a) Session Cookies: Temporary cookies that expire when you close your browser; or (b) Persistent Cookies: Remain on your device for a set period or until you delete them. Essential and functional cookies are typically persistent to maintain your preferences (the `ff_ref` referral cookie lasts 30 days and the `flowfn_home_content_version` cookie lasts 365 days). Analytics cookies may be persistent to track usage over time, and the Google Ads conversion-measurement cookies described in §6a typically persist for around 90 days.

You can control cookies through: (a) Browser Settings: Most browsers allow you to refuse or delete cookies. Instructions vary by browser; (b) Our Cookie Banner: a cookie consent banner is shown the first time you visit the marketing site and lets you accept or reject all non-essential cookie categories (functional, analytics, and advertising & measurement); you can re-open the banner at any time from the "Cookie preferences" link in the marketing-site footer to change or withdraw your choice; (c) Our Preference Centre: signed-in users can toggle each category individually under Dashboard → My account → Cookie preferences; (d) Browser Extensions: Third-party extensions can help manage cookies; and (e) Opt-Out Tools: Industry opt-out tools may help manage certain cookies. Note: Disabling essential cookies will prevent you from signing in or using the Service.

To manage cookies in common browsers: (a) Chrome: Settings > Privacy and Security > Cookies; (b) Firefox: Options > Privacy & Security > Cookies and Site Data; (c) Safari: Preferences > Privacy > Cookies; (d) Edge: Settings > Privacy, Search, and Services > Cookies; and (e) Opera: Settings > Privacy & Security > Cookies. Consult your browser's help documentation for specific instructions.

Some browsers send "Do Not Track" (DNT) signals. We do not currently respond to DNT signals, but we respect your cookie preferences. You can manage cookies through your browser settings or our cookie preference center (if available).

In addition to cookies, we may use: (a) Local Storage: Store data locally in your browser; (b) Session Storage: Store data for a single session; (c) Web Beacons: Small images that track activity; and (d) Pixels: Tracking pixels for analytics. These technologies serve similar purposes to cookies and can be managed through browser settings.

Disabling cookies may: (a) prevent you from logging in or maintaining sessions; (b) cause the Service to forget your preferences; (c) limit functionality of certain features; (d) require you to re-enter information; and (e) affect Service performance. We recommend allowing essential cookies for optimal Service experience.

We may update this Cookie Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified via email or through the Service. The "updated_at" date indicates when this policy was last revised. Your continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions about our use of cookies, please contact our Data Protection Officer at legal@flowfn.com. For other privacy-related inquiries, see our Privacy Policy.