Cookie Policy

1. What cookies we use

We keep our use of cookies and similar technologies (such as localStorage) deliberately small. We do not use advertising cookies, cross-site tracking, or third-party marketing pixels. There are two categories:

• Functional (always on). Strictly necessary for the site and product to work — session handling, CSRF protection, and remembering your language. These do not require consent because the service cannot function without them.
• Analytics (opt-in). When you consent, we use PostHog to understand page views and feature usage in aggregate. These events carry no visitor PII and are off by default.

2. Your choices

When you first visit, a banner lets you Accept all, Reject non-essential, or Customize to toggle analytics on or off. You can change your decision at any time via the Cookie preferences link in the footer, which reopens the banner.

We honor your browser’s Do-Not-Track signal: if DNT is enabled, we record a functional-only preference automatically and do not load analytics — you can still opt in explicitly from the notice.

Your choice is stored on your device (in localStorage), which is scoped to the host you set it on. Because our marketing site and the product run on separate subdomains and our cookies are host-only, you may be asked again on each — this is intentional and avoids a shared cross-subdomain tracker.

3. Cookies set by our sub-processors

Functional cookies are set by our own application and our hosting provider (Vercel) to route and secure requests. Analytics cookies/storage, when enabled, are set by PostHog. The full list of vendors that process data on our behalf — including their roles and data regions — is on our sub-processor page.

4. Changes and contact

We may update this policy as our use of cookies changes; material changes will be reflected in the version stamp above. For questions about this policy or how we use cookies, see the cookies section of our Privacy Policy or contact privacy@visitorflow.com.