Cookie Policy
Last updated 29 September 2026. We believe cookie policies should be readable — this one is. Below are the main cookies and tracking tools we use, alongside the full policy.
TL;DR
✓Authentication and the cookie-choice record work without Accept all
✓Optional visit and attribution identifiers require the relevant saved purpose
✓PostHog and GA4 require Analytics consent
✓Advertising pixels and remarketing tags require Advertising consent
✓Change your choice below at any time
Cookies and similar technology
Strictly NecessaryAnalyticsAdvertisingAffiliate / ReferralThird-Party
| Cookie name | Category | Purpose | Set by | Retention | HttpOnly |
|---|---|---|---|---|---|
| sb-* / *-auth-token* | Strictly Necessary | Supabase session tokens — keep you signed in. Contains a signed JWT and refresh token. | Flowen server (Supabase SSR) | Session / 1 hour (auto-renewed) | Yes |
| __vs | Analytics | First-party visitor ID for session and pageview counts. Created only with Analytics consent. | Flowen server (proxy) | 30 days (rolling) | Yes |
| __utm | Advertising | Campaign parameters captured from a URL only with Advertising consent. | Flowen server (proxy) | 30 days | Yes |
| flowen_anon_id | Advertising | First-party attribution ID. Links ad click IDs and visits to downstream conversions. Created only with Advertising consent; server-side sends recheck that purpose. | Flowen server (proxy) | 365 days | Yes |
| flowen_ref | Affiliate / Referral | Affiliate referral code. Set only with Advertising consent when arriving via a ?ref= link. Stores the partner code (short alphanumeric, not personal data) for commission attribution. | Flowen server (proxy) | 30 days | Yes |
| ph_* | Analytics | PostHog product analytics identifiers and sessions, loaded only with Analytics consent. | PostHog JS (browser) | 1 year (distinct ID) / session | No |
| flowen_consent_id | Strictly Necessary | Created when saving a choice to bind the server consent record. Not advertising attribution without Advertising consent. | Flowen server | 1 year | Yes |
| flowen_cookie_consent | Strictly Necessary | Stores your versioned Analytics, Advertising and Session replay choices so it persists across visits; a matching server record is also saved. | Flowen browser | 1 year | No |
| Provider cookies (Google, Meta, Snapchat, LinkedIn) | Advertising | May be set by advertising pixels and remarketing tags with Advertising consent; actual names and lifetimes depend on each provider. | Advertising providers | Provider-dependent | No |
| __stripe_mid / __stripe_sid | Third-Party | Stripe fraud prevention and payment flow continuity. Only set on pricing and checkout pages. | Stripe JS (browser) | 1 year / session | No |
Your choices
Browser settings: Block or delete cookies in your browser settings. Blocking strictly necessary cookies may prevent sign-in.
Change or withdraw consent: Use the Change cookie choices button above and choose Necessary only or save individual purpose choices. The choice is saved in a browser cookie and a server record. If you previously accepted all, the page reloads after withdrawal to unload scripts already running in that tab.
Existing cookies: Withdrawing consent prevents further optional tracking in this browser. You can delete existing provider cookies in your browser settings. For questions about first-party visit and attribution data, email hello@flowen.digital.
Full legal text
COOKIE POLICY
Last Updated: 29 September 2026
Effective Date: 29 September 2026
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. ABOUT THIS POLICY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
This policy explains how Flowen Speech Technologies Ltd ("Flowen", "we", "us") uses cookies and similar browser technology on flowen.digital. A cookie is a small piece of data stored by your browser. We also use localStorage and sessionStorage for in-browser state. This policy covers our own tools and the advertising and analytics providers that can load after your choice.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
2. BEFORE YOU ACCEPT ALL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Authentication cookies from Supabase keep you signed in. Stripe may use necessary fraud-prevention and payment-flow cookies on checkout pages. The flowen_cookie_consent cookie stores separate analytics, advertising and session-replay choices for one year. A flowen_consent_id is created only when you save a choice, to bind that choice to its server record. It is not used for attribution without advertising consent. Existing binary choices require a new purpose-specific choice. Optional purposes are off until that choice is saved.
Analytics consent is required for __vs visitor counting and server pageviews. Advertising consent is required for __utm campaign parameters, flowen_anon_id attribution, flowen_ref affiliate attribution and incoming advertising click-ID collection. No such identifier is created or attribution collected before the relevant saved choice. Declining or withdrawing deletes the related first-party cookies. A failed save does not enable optional tools.
PostHog and GA4 require Analytics; advertising pixels require Advertising; Sentry Session Replay requires Session replay. GTM can contain mixed-purpose tags and loads only when both Analytics and Advertising are selected. PostHog session recording is disabled. Basic Sentry error capture can run without Session Replay. Browser settings that block necessary cookies may also prevent sign-in.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
3. ANALYTICS AFTER ACCEPT ALL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
PostHog records product usage events and can set ph_* browser identifiers and session cookies. It uses the configured EU endpoint. Google Analytics 4 (GA4), loaded directly or through Google Tag Manager (GTM), measures pageviews and opted-in events and may use Google analytics identifiers. These tools start only after Analytics consent. Sentry Session Replay starts only after Session replay consent; basic error monitoring can run separately without replay.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
4. ADVERTISING AFTER ACCEPT ALL
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Meta Pixel, Snapchat Pixel, LinkedIn Insight Tag, and Google Ads tags (including remarketing through GTM) can run after Advertising consent. These providers may set their own cookies or use comparable browser identifiers to measure visits and conversions across sites. Where enabled, Flowen also sends verified conversion events server-side to Meta, Snapchat or Google Ads; these sends check the latest server consent record. Provider cookie names and retention periods can change under their own policies. No optional advertising script is injected without Advertising consent on a new page load.
We do not sell cookie data to data brokers. This is not a claim that advertising tracking never occurs: it can occur after Advertising consent.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
5. CHANGE YOUR CHOICE
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Use the "Change cookie choices" button above to reopen the banner. Choose "Necessary only" to withdraw every optional purpose, or use the separate checkboxes and "Save choices" to change one purpose. The browser choice is stored in flowen_cookie_consent and the new decision is recorded on our server. If scripts had already loaded under an earlier Accept all choice, the page reloads after the withdrawal is recorded so they are no longer running in that tab. You can also clear existing provider cookies in your browser settings. Optional tools start only after the server acknowledges the new purpose-specific decision.
If saving a choice fails, the banner shows an error and does not grant new optional tracking. For questions about first-party visit and attribution data or existing records, contact hello@flowen.digital.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
6. UPDATES AND CONTACT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
We will update this policy when our cookie practices change. For questions, email hello@flowen.digital or write to Data Protection, Flowen Speech Technologies Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.