Cookie Policy
Last updated 11 September 2026
What this policy covers
- This policy explains what we keep on your device when you use flow, what we read back, and the choices open to you.
- It covers cookies and everything that works like one, including the local storage your browser keeps for a site. We say "key" throughout for all of them.
- A cookie is a small file a site asks your browser to hold. On your next visit the site can read it back, which is how you stay signed in between pages.
- Our Privacy Policy explains what we do with personal data more generally.
Everything we keep on your device
- This is every key we set, what it is for and how long it lasts. It is generated from the same list the site itself reads, so it cannot drift out of date.
| Name | Provider | Purpose | Category | Retention |
|---|---|---|---|---|
| pty_session | flow social | Keeps you signed in and secures your session. | Strictly necessary | 30 days, or 14 days without a visit |
| pty_authed | flow social | Tells our public pages that you are signed in, so they can offer you the app instead of the sign-in button. Holds no identifier and grants nothing. | Strictly necessary | 1 hour |
| pty_sso_tried | flow social | Remembers that we already tried to sign you in silently from our other site, so a page does not bounce between the two. | Strictly necessary | 5 minutes |
| ptc_flow | flow social | Remembers your cookie-consent choice. Set for the whole site so you are asked once rather than on every page of it. | Strictly necessary | 6 months |
| pty_evt_unlock_<event> | flow social | Remembers that you entered the password for a protected event, one cookie per event, so you are not asked again. | Strictly necessary | 24 hours |
| flow_reply_intent | flow social | Carries the reply you gave to an event before signing in across the sign-in, so it is recorded once you are. | Strictly necessary | 10 minutes |
| theme | flow social | Remembers whether you chose the light or the dark appearance. | Strictly necessary | Until you clear your browser storage |
| flow.get-app-card.dismissed | flow social | Remembers that you closed the card about our app, so it is not shown again. | Strictly necessary | Until you clear your browser storage |
| flow.studentProgramPrompt.dismissed | flow social | Remembers that you closed the prompt asking what you study. | Strictly necessary | Until you close the tab |
| flow-invite-celebrated | flow social | Remembers that we already played the animation for an invitation you claimed. | Strictly necessary | Until you close the tab |
| flow:chunk-reload-at | flow social | Stops the page reloading over and over when part of it fails to load. | Strictly necessary | Until you close the tab |
| flow:city-beacon | flow social | The time we last checked which city you are in, so we do not check again too soon. A time, never a place, and only written if you turned that on. | Strictly necessary | Until you close the tab |
| ph_{token}_posthog | PostHog | Measures which pages and features are used and, with your consent, records a pseudonymous replay of the session with what you type hidden, so we can find and fix what is confusing. Hosted in the EU. | Analytics | 12 months |
| __ph_opt_in_out_{token} | PostHog | Measures which pages and features are used and, with your consent, records a pseudonymous replay of the session with what you type hidden, so we can find and fix what is confusing. Hosted in the EU. | Analytics | 12 months |
| ph_{token}_window_id | PostHog | Measures which pages and features are used and, with your consent, records a pseudonymous replay of the session with what you type hidden, so we can find and fix what is confusing. Hosted in the EU. | Analytics | Until you close the tab |
| ph_{token}_primary_window_exists | PostHog | Measures which pages and features are used and, with your consent, records a pseudonymous replay of the session with what you type hidden, so we can find and fix what is confusing. Hosted in the EU. | Analytics | Until you close the tab |
The ones we set without asking
- The law lets a site keep what it strictly needs to deliver what you asked for, without asking first. Everything in the table marked strictly necessary is one of those.
- One keeps you signed in. One remembers the answer you gave about the rest. The others remember that you closed a card, that we already played an animation, or that a page should stop trying to reload itself.
- None of them carries anything that identifies you, none is shared with anyone, and losing any of them costs you nothing worse than seeing a prompt again.
- We do not treat anything as strictly necessary because it is useful to us. Remembering that we showed you something is our convenience, not your need, so that lives on your account instead of on your device.
Analytics, and what your answer changes
- We measure how flow is used so we can find what is confusing and fix it. How we do that depends entirely on your answer.
- Before you answer, and if you say no, nothing is written to your device and nothing is read from it. There is no identifier, no profile, and no session recording. We count what happened without knowing who it happened to.
- If you say yes, our analytics provider sets the keys marked as analytics in the table, and we can follow one visit across pages and record a replay of the session, so a confusing screen can actually be watched back.
- Even then, we never send your name or your email address to the analytics provider. You are a meaningless identifier to it, and other people's details are hidden from any recording.
- Analytics data is held in the European Union.
Your choices
- You are asked the first time you arrive. Saying no is exactly as easy as saying yes, and nothing is held against you for it.
- You can change your mind at any time in your settings, and withdrawing is as easy as agreeing was. Withdrawing does not undo what happened while you had agreed, but it stops it continuing.
- Your answer follows your account rather than the browser you gave it in, so it holds on your phone and your laptop alike without being asked twice.
- You can also clear or block keys in your browser settings. Blocking the strictly necessary ones will stop you being able to stay signed in.
Our app
- The app does not use cookies, because it is not a browser. It keeps what it needs on your phone in the same spirit as the table above, and your analytics answer applies to it in the same way.
- Your phone's own settings control notifications and location separately from anything here, and turning either off in your phone always wins.
Changes to this policy
- We update this policy when what we keep on your device changes.
- The table above changes with the site, so it is current whether or not the words around it have moved. The date at the top of this page is the date of the current version.
Contact
- Ask us about anything on this page and we will answer. Our details are in our Privacy Policy.