Cookie Policy

Last updated: October 14, 2026

What cookies AACFlow sets, why, how long they last, and how to change your choice at any time.

INTERNAL WARNING (not for production): this legal page still contains owner placeholders or test data (highlighted [[TO BE FILLED: ...]] markers or test company data). It must not go live in this state. Run `bun run scripts/check-legal-placeholders.ts` to list them.

This Cookie Policy explains how AACFlow uses cookies and similar technologies on aacflow.io and in the AACFlow application, what each one does, and the choices you have. It forms part of our Privacy Policy, which describes how we handle personal data more broadly.

If you are in the EU, the UK, or another region where consent is required, we ask before setting anything that is not strictly necessary. You can at any time.

What are cookies?

A cookie is a small text file a site stores on your device so it can recognize your browser on a later request. Cookies are how a site keeps you signed in between pages, remembers a preference, or counts a visit.

Session cookies are deleted when you close your browser. Persistent cookies stay until they expire or you delete them.
First-party cookies are set by the site you are visiting. Third-party cookies are set by another company whose code the site loads, such as an analytics or advertising provider.

We also use technologies that behave like cookies without being one. Local storage and session storage keep data in your browser rather than sending it with each request; pixels (also called web beacons or tags) are tiny images or scripts that record that a page or email was opened. Where this policy says "cookies", it means all of these.

How we use cookies

We group cookies into the three categories the consent banner offers. Necessary cookies are always on because the service cannot run without them. The other two are off until you turn them on.

Necessary — sign-in, session security, abuse prevention, remembering your language, currency, and theme preferences, and the choice you made in the consent banner. These do not require consent because the service you asked for cannot be delivered without them.
Analytics — how many people use AACFlow, which pages and features they reach, and where errors happen, so we can improve the product. Measurement only; we do not use these to target advertising. Google Analytics loads with analytics storage denied and cannot set analytics cookies until this category is allowed; before then, it may send limited cookieless consent and measurement signals.
Marketing — measuring which campaigns bring builders to AACFlow and showing relevant ads on other sites. Google Ads loads with ad storage denied and cannot set conversion cookies until this category is allowed; before then, it may send limited cookieless consent signals.

Cookies we use

Retention periods are the maximum lifetime set when the cookie is written; a cookie can be cleared sooner at any time. Third-party providers occasionally rename or re-scope their cookies, so treat the provider column as the authoritative reference for anything not set by AACFlow.

Necessary
Cookie	Provider	Purpose	Retention
`better-auth.session_token`	AACFlow	Keeps you signed in and identifies your session.	30 days
`better-auth.session_data`	AACFlow	Short-lived signed cache of your session so each page load does not re-read the database.	5 minutes
`c15t`	AACFlow (via c15t)	Records the cookie choice you made so the banner is not shown again. Also mirrored in your browser’s local storage.	365 days
`sidebar_collapsed`	AACFlow	Remembers whether the workspace sidebar is collapsed, so the layout does not jump on load.	1 year
`NEXT_LOCALE`	AACFlow	Remembers the language you chose (English, Russian, or German). Path /, SameSite=Lax.	1 year
`aacflow_currency`	AACFlow	Remembers the display and charge currency you chose. Path /, SameSite=Lax.	1 year
`sim-theme / sim-landing-theme`	AACFlow (local storage)	Remembers your light, dark, or system theme. Kept in your browser’s local storage, not in a cookie, and never sent to our servers.	Until you clear your browser data
`trello_oauth_state / trello_return_url / trello_credential_draft_id / instagram_oauth_state / instagram_return_url / instagram_credential_draft_id`	AACFlow	Carry the security state, return page, and pending credential draft while you connect a Trello or Instagram account, then are removed. HttpOnly; set only while you run that connection flow.	15 minutes
`chat_auth_<id> / file_auth_<id>`	AACFlow	Keeps a visitor signed in to a password- or email-protected deployed chat or file after they unlock it. HttpOnly; set only when you unlock such a deployment.	24 hours
`__cf_bm`	Cloudflare	Bot-management check on requests to providers we load, such as X.	30 minutes

Analytics
Cookie	Provider	Purpose	Retention
`_ga`	Google Analytics	Distinguishes one visitor from another.	13 months
`_ga_*`	Google Analytics	Holds the session state for a specific Analytics property.	13 months
`ph_*_posthog`	PostHog	Stores analytics identity and durable session state after analytics consent is granted.	1 year
`__ph_opt_in_out_*`	PostHog	Records PostHog’s local capture state, synchronized from your AACFlow analytics choice.	Until you change your choice
`ph__window_id / ph__primary_window_exists`	PostHog	Coordinates analytics state for the current browser tab.	Session
`sim_attribution_first / sim_attribution_last`	AACFlow	Records the campaign or website that first and most recently brought you to aacflow.io, so a sign-up or demo request can be credited to it. Holds campaign parameters, which ad network a click came from (never the click ID), the referring site’s domain, the landing page path, and when the visit happened. Expires with your analytics consent if that ends sooner.	90 days

Marketing
Cookie	Provider	Purpose	Retention
`_gcl_au`	Google Ads	Links a Google ad click to a later sign-up or demo booking on aacflow.io.	90 days
`_gcl_aw / _gcl_gs`	Google Ads	Stores the click identifier from a Google ad that brought you to aacflow.io.	90 days
`IDE`	Google (doubleclick.net)	Measures ad conversions and limits how often the same ad is shown.	13 months in the EEA and UK; 24 months elsewhere
`guest_id`	X (Twitter)	Identifies a browser to the X conversion pixel.	13 months
`guest_id_ads`	X (Twitter)	Measures conversions from X advertising.	13 months
`guest_id_marketing`	X (Twitter)	Measures the performance of X marketing campaigns.	13 months
`personalization_id`	X (Twitter)	Personalizes the ads shown on X.	13 months
`muc_ads`	X (Twitter)	Measures ad conversions across X domains.	13 months
`bfcid`	Freebuff	Stores the click ID of a Freebuff ad so a sign-up can be credited to it. Written by the Freebuff tag, which loads only with marketing consent; AACFlow deletes it when you withdraw that consent.	Until you withdraw marketing consent

Your choices

Where consent is required, the banner appears on your first visit with accept and reject offered equally, and "Customize" lets you turn each category on or off individually. To revisit that decision later — including withdrawing consent you already gave — . We ask again after 365 days.

Independently of the banner, every major browser lets you block or delete cookies from its privacy settings, and can be set to clear them each time you close it. Blocking necessary cookies will sign you out and prevent parts of AACFlow from working.

We honor Global Privacy Control (GPC). Where the applicable privacy policy provides an opt-out right, the consent service applies that signal to the covered optional categories without requiring you to use the banner.

You can also opt out with the providers directly: Google Analytics, Google Ads, X (Twitter), and PostHog.

Third-party cookies

Some cookies above are set by companies we work with rather than by AACFlow. We choose these providers and decide when their code loads, but the data they collect is also governed by their own policies, which we cannot change on your behalf.

The providers currently in use are Google (Analytics and Ads), X (Twitter), Ahrefs, Freebuff, PostHog, and Cloudflare.

Changes to this policy

We update this policy when the cookies we set change, and we revise the "Last updated" date above whenever we do. If a change materially widens what we collect, we will ask for your consent again rather than rely on a choice you made under the previous version.

Contact

Questions about this policy, or about how we use cookies, can go to privacy@aacflow.io.