Cookie and browser storage policy

Last updated: 23 September 2026.

Flowstate currently uses only storage needed to provide the service and remember choices. No advertising or analytics provider is configured.

Cookies

• flowstate_session is a necessary, HttpOnly session cookie. It authenticates requests, is SameSite=Lax, is Secure over HTTPS, and expires when the browser session ends. Server-side sessions have a 120-minute lifetime.
• flowstate_remember is optional and created only when Remember me is selected. It is HttpOnly, SameSite=Lax, Secure over HTTPS, and lasts up to 30 days. Its validator rotates rather than storing reusable plaintext server-side.

Remember me can restore an eligible expired browser session. Rotation binds the token to the new server session; revoking a device also revokes its remembered login. Replaying an old validator invalidates that token family.

Flowstate does not use a CSRF cookie; the CSRF value is held in the authenticated server session and sent by the application when required.

Local browser storage

Project walkthrough capture uses temporary in-memory video chunks and a Blob URL for preview/download. It adds no tracking cookie, Local Storage or IndexedDB recording. Closing the preview releases that temporary copy; a chosen download is an ordinary device file and Add to Board uses private server media storage.

• Local Storage remembers theme, the Snap mode, the identifiers of the last Flowstate objects copied in this browser (to paste them in another tab or window), toolbar expansion, inspector groups, the dismissed mobile read-only notice, the versioned Necessary/Analytics consent choice, Local AI device recommendation/manual tier/repeated-runtime-failure state, the preferred AI Chat channel per Project, and any exact External Media provider/origin the viewer chose to load automatically on this device.
• Session Storage temporarily preserves a scrubbed pending invitation reference during the authentication flow and the bounded Shortcut placement descriptor used when copying navigation across Projects.
• IndexedDB stores a per-account offline mutation queue and eligible Board cache so supported changes can reconcile after reconnecting. A separate flowstate-local-ai database records installed tier/revision, artifact URL/hash/byte verification, and install time; it does not contain model bytes, Project context, prompts, or credentials.
• Cache Storage contains the static application shell/offline page and, only after explicit Local AI setup, dedicated webllm model/config/WASM caches that may total several gigabytes. Model caches contain immutable runtime data, never authenticated API responses, private files, public capabilities, prompts, Project context, or AI credentials; service-worker shell rotation does not manage them.
• BroadcastChannel coordinates supported same-origin offline state and Local AI runtime takeover between tabs without sending it to a third party.

Signing out or deleting the account clears that account's offline mutation queue and Board cache, and open tabs leave private screens. Clearing offline data also works when another tab holds an older database connection. Pending edits require explicit discard; Settings offers comparison, retry and JSON download first. This does not remove deliberately installed, account-independent Local AI models.

Consent categories

Necessary storage is always active because accounts, security, preferences, and offline operation depend on it. Analytics is off until affirmative consent and remains unused unless Flowstate later configures an optional provider. Adding GA4, GTM, or another provider requires server-side configuration and an update to this policy before any identifier, script, request, or cookieless ping can run.

External Media activation is separate from Analytics. By default a Board shows a local placeholder and makes no request to YouTube or a direct media origin. The viewer may load one item or remember only its provider/exact origin on this device. Cookie settings can reset all such remembered choices; they are never synced to Project state or shared with collaborators.

Search Console ownership should be verified by DNS or a same-origin static file. Those operator-side methods do not observe visitors, set browser storage, or need Analytics consent. Any future browser-loaded verification or measurement tag is instead treated as Analytics and stays behind the same affirmative choice.

Use Cookie settings in the public footer to review or change the saved optional category. Clearing site data in the browser removes browser-held preferences and offline data; server-held account and project data is managed from Flowstate Settings.