Flow Cookie Policy
Version: 2026-10-09 · Effective date: October 9, 2026 · Last updated: October 9, 2026
This Cookie Policy explains how Flow Labs LLC (“Flow,” “we,” “us”) uses cookies and similar technologies (local storage, session storage) on theflowtool.com, the Flow web application at app.theflowtool.com, and our example workspace at tryflow.theflowtool.com. It supplements our Privacy Policy.
What are cookies?
Cookies are small text files placed on your device when you visit a website. They let the site remember your actions and preferences — such as keeping you logged in — and help us understand how the product is used. “Session” cookies expire when you close your browser; “persistent” cookies remain until they expire or you delete them. We also use local storage, a related browser technology that stores data on your device until it is cleared.
Update Cookies Settings
Cookies we use
Strictly necessary
These are required for Flow to function — logging in and keeping your session secure. They cannot be switched off.
Cookie / storage
Provider
Purpose
Duration
flow.auth (local storage)
Supabase
Keeps you signed in to your Flow account
Until you sign out
`flow_consent`
Flow
Records your cookie choices across theflowtool.com, app.theflowtool.com, and tryflow.theflowtool.com
12 months
A note on signing in. Flow’s authentication and database provider, Supabase, does not set cookies. Your sign-in session is kept in your browser’s local storage, and each request carries a short-lived token in a request header rather than a session cookie.
Analytics
These help us understand which features are used and how the product performs. They do not run unless you accept analytics cookies.
Cookie / storage
Provider
Purpose
Duration
`ph_phc_*` (cookie + local storage)
PostHog
Product analytics — feature usage, page views, device information; assigns a random identifier to recognize returning users
1 year
_ga, _ga_*
Google LLC
Website analytics on theflowtool.com only; assigns a random identifier to recognize returning visitors
2 years
Analytics requests are routed through our own subdomain, p.theflowtool.com, so that they are not blocked by tracking blockers. This is a technical relay to PostHog; it does not change what is collected or who receives it, and it means the PostHog cookie is set as a first-party cookie on our domain.
What our analytics deliberately does not do:
No session replay. We do not record video or reconstructions of your screen. Session recording is disabled at the code level.
No on-screen text. We remove the visible text of the elements you interact with before events are sent, so client names, project titles, messages, and dollar figures cannot reach our analytics provider. We keep the element type, so we can see *that* a button was clicked but not *what it said*.
Personal-data masking is applied to automatically captured events.
Payments
Payments — subscribing to a Flow plan, managing your billing, and paying an invoice sent through Flow — are completed on pages hosted by our payment processor, Stripe, at stripe.com. Stripe sets its own strictly necessary cookies there for fraud prevention and payment security (typically __stripe_mid, 1 year, and __stripe_sid, 30 minutes). Flow sets no payment cookies on theflowtool.com or app.theflowtool.com.
Advertising
With your permission, we use advertising cookies — including the Meta (Facebook/Instagram) Pixel — to measure how well our ads perform and to show you relevant ads based on your visit to our site. These cookies are off by default. We only set them, and only share information with advertising partners, after you accept the “Advertising” category in our cookie banner or cookie settings.
Advertising tags run on theflowtool.com, on the sign-in and sign-up pages of app.theflowtool.com, and on tryflow.theflowtool.com, our example workspace, which contains only made-up data. They are never loaded inside a real Flow workspace.
If your browser sends a Global Privacy Control (GPC) signal, we treat that as a request to keep advertising cookies off, even if you previously accepted them.
You can change your choice at any time from the “Cookie Preferences” link at the bottom of this page.
Advertising cookies set: _fbp, _fbc (Meta Pixel). Lifetime: up to 90 days, renewed on each visit.
Your choices
You can accept or decline analytics and advertising cookies via the banner shown on your first visit, and change your choice at any time via the Cookie Settings link in our website footer or under Settings → Legal & Privacy inside the application. Your choice is stored against .theflowtool.com, so it applies to the website, the app, and tryflow.theflowtool.com.
Declining optional cookies does not affect your ability to use Flow. You can also clear or block cookies in your browser settings, though blocking strictly necessary cookies will prevent you from logging in. We treat a Global Privacy Control browser signal as a decline of analytics cookies.
Changes
We will update this page when the cookies we use change, and revise the “Last updated” date and version above.
Contact
Flow Labs LLC · 13620 Weinstein Court, Centreville, VA 20120 · support@theflowtool.com