Cookie Policy

Last updated July 27, 2026

Most cookie policies are written to be unreadable. This one is a list of every cookie and browser storage key StartupFlow AI can set, what each one is for, and how long it sticks around. There are five of them and four are essential.

There are no advertising cookies here. No Google Analytics, no Meta pixel, no ad network, nothing that follows you to another site. We do not sell or share anything about you with anyone who would want to.

Change your mind whenever

Your choice lasts twelve months, and you can redo it at any point, from here, or from the link in the footer of every page.

Essential

Keeps you signed in, remembers whether you chose light or dark, and stores this cookie choice. Turn these off and the site stops working, so there is no switch for them.

These do not have an on/off switch, because there is nothing meaningful to switch. Two of them are how the server knows you are signed in; one remembers whether you picked light or dark; one remembers that you already answered the cookie banner. Block them in your browser and the site will keep asking you to log in.

Name	Set by	What it does	Lasts
`sf_access` Cookie	StartupFlow AI	Proves you are signed in on each request. HttpOnly, so scripts cannot read it.	15 minutes
`sf_refresh` Cookie	StartupFlow AI	Lets us issue a fresh sign-in token without asking for your password again. HttpOnly, and we store only a hash of it on our side.	14 days
`sf_consent` Cookie	StartupFlow AI	Remembers the choice you made here so we stop asking.	12 months
`sf-theme` Local storage	StartupFlow AI	Remembers whether you picked light or dark mode.	Until you clear your browser storage

Analytics

Counts which pages and programs founders actually open, so we know what to build next. We only ever look at totals, never at what one person did.

Off unless you turn it on. Nothing in this category loads, and no key is written, until you do.

Name	Set by	What it does	Lasts
`_ga` Cookie	Google LLC (Google Analytics 4)	Tells Google Analytics whether this is your first visit or a return one, so a week of traffic can be counted as people rather than as page loads. Only set after you switch analytics on.	2 years
`_ga_<measurement-id>` Cookie	Google LLC (Google Analytics 4)	Holds the state of your current visit for Google Analytics, so several pages read as one session instead of several. Only set after you switch analytics on.	2 years

Session replay

Records your clicks and page movements when something goes wrong, so we can watch the bug back instead of guessing. Text you type is masked before it leaves your browser.

Off unless you turn it on. Nothing in this category loads, and no key is written, until you do.

Name	Set by	What it does	Lasts
`sentryReplaySession` Session storage	Sentry (Functional Software, Inc.)	Ties the recorded session to an error report. Only set after you switch session replay on.	Until you close the tab

What about analytics?

We do not run any. Not a privacy-friendly one, not a self-hosted one, none. If that changes we will add the category to the banner and list its cookies in the table above before it ever runs, and your existing choice will not be read as agreement to something you were never shown.

Error monitoring

When the app crashes we get a stack trace. That does not use cookies and stores nothing in your browser, so there is no switch for it. We run it on legitimate interest, and we strip email addresses, session tokens and cookie values out of every report before it is sent. The reasoning is set out under “Security and error logs” in the privacy policy.

Doing it in your browser instead

Every browser lets you block or clear cookies for a site, and that works here too. You do not need our permission or our interface. Be aware that clearing them signs you out and wipes the record of your cookie choice, so the banner will come back.

Questions

This is version 2026-07-27. If something here does not match what you see in your browser’s developer tools, we want to know: privacy@startupflowai.com.