Cookie Policy

Last updated: 17 September 2026

HumanFlow sets as few cookies as the product can work with. One of them is an advertising cookie — Google's conversion cookie, which tells us that a purchase followed an ad click and nothing more. We do not sell or share what we collect.

Strictly necessary

These cannot be switched off, because without them you cannot stay signed in.

Name	Set by	What it does	Lasts
hf_session	HumanFlow	Keeps you signed in. httpOnly, so no script on the page can read it.	7 days

Analytics — only with your permission

Nothing below is requested before you agree. If you decline, these scripts are not loaded at all rather than loaded and disabled, so no request ever leaves your browser. They measure how the site is used in aggregate — which pages people reach, where they stop. One of them, Google's conversion cookie, additionally reports that a purchase followed a click on one of our ads. We do not use any of them to build a profile of you, to assemble an advertising audience, or to follow you to other sites.

Name	Set by	What it does	Lasts
_ga, _ga_*	Google Analytics 4	Counts visits and pages in aggregate. IP anonymisation is on and advertising signals are off.	2 years
ph_*_posthog	PostHog	Counts which features are used, in aggregate.	1 year
_gcl_au	Google Ads	Records that a purchase followed a click on one of our ads, so we can tell which ads are worth running. Conversion measurement only — it does not build an audience or follow you to other sites.	90 days

Your choice, stored locally

We record your answer in your browser's local storage under hf_consent, not in a cookie — a cookie recording that you refused cookies would be a poor joke, and it would travel on every request for no reason. It stays until you clear your browser storage, and nothing on our servers reads it.

Change your mind at any time. Withdrawing permission is as easy as giving it — that is not a courtesy, it is what the rules require.

What we do not do

No retargeting pixels, and no advertising audiences built from your visit. The one advertising tag we run measures conversions only, and is listed above.
No selling or sharing of personal data with data brokers.
No cross-site tracking of your browsing elsewhere.
No session recording. We deliberately disabled it — see below.

Why there is no session replay

Error-reporting tools commonly offer session replay, which records what happens on the page. We have it switched off, on purpose. The page here contains the text you paste in to be rewritten, and recording it would ship your private writing to a third party. Our error reporting receives diagnostics only, and never your text.

Third parties you may meet

Google and Apple — only if you choose to sign in with them. Their sign-in frames set their own cookies under their own policies.
Stripe — on its own checkout and billing pages, which you reach from ours, for payment security and fraud prevention. No Stripe script runs on HumanFlow's own pages.

Each of these, and everyone else who handles your data, is listed on our subprocessor page.

Blocking them yourself

You can clear or block cookies in your browser at any time. Blocking the session cookie will sign you out and stop you signing back in; everything else on the site still works.

See also our Privacy Policy and GDPR notice. Questions: support@humanflow.pro.