What cookies are
Cookies are small pieces of data stored by your browser. We also use related technologies — localStorage, sessionStorage, and IndexedDB — to keep the Service working and measure product usage. This policy refers to all of them collectively as "cookies".
Categories we use
1. Strictly necessary (always on, cannot be disabled)
Without these, core features stop working. We rely on legitimate interest as the legal basis — no consent required.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| flowarden_token | localStorage | Keeps you signed in | 7 days |
| flowarden_csrf | cookie (HttpOnly, SameSite=Lax) | Cross-site request protection | Session |
| fw_session | cookie | Load-balancer stickiness | Session |
2. Functional (opt-out available)
Remember your preferences across visits. Disabling them doesn't break the app — you just lose personalisation.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| fw_theme | localStorage | Remember your theme preference | 1 year |
| fw_cookie_consent | localStorage | Remember your cookie choices | 6 months |
| flowarden_upsell_dismissed | localStorage | Hide the dashboard upsell banner | 30 days |
3. Analytics (requires consent in EEA/UK)
Aggregated, first-party-only. We do not share these with advertisers.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| fw_anon_id | localStorage | Anonymous visitor ID for product analytics | 12 months |
| _plausible_* | cookie (first-party) | Privacy-friendly page-view counting | 30 days |
4. What we do not use
We do not use Google Analytics cookies, Meta/Facebook Pixel, TikTok Pixel, LinkedIn Insight Tag, or any cross-site ad-tracking pixel. We never share cookie data with data brokers.
Your choices
In the cookie banner
First-time visitors see a banner with Accept All, Essential Only, or Customise. Your choice is saved in fw_cookie_consent and honoured across sessions. Change it any time at Settings → Privacy.
In your browser
All major browsers let you block or delete cookies. Instructions:
Global Privacy Control
We honour the GPC browser signal as an opt-out of any personalised marketing (we don't do targeted ads anyway).
Do Not Track
The DNT header was never finalised by standards bodies, so we do not respond to it. Use GPC above instead.