Cookie Policy
Lire en françaisLast updated
In short
- Flashly uses no advertising cookie, no cross-site tracker and no social media pixel.
- Almost everything we store is strictly necessary — keeping you signed in, remembering a toggle — and needs no consent.
- Only one thing needs your consent: Sentry error session replay. It is off until you turn it on.
- Refusing is exactly as easy as accepting, and your choice lasts six months.
This summary is here to be read. It is not a substitute for the text below, which is what actually governs.
1. What this page covers
French law (Article 82 of the Data Protection Act, transposing the ePrivacy Directive) governs anything read from or written to your device — not just cookies. localStorage, sessionStorage and similar all count. This page lists every one of them.
The rule is simple: if something is strictly necessary to deliver a service you asked for, it needs no consent. Everything else does, and must be off until you say yes.
2. Strictly necessary — no consent required
These cannot be turned off without breaking the site. None of them tracks you across other websites.
| Name | Type | What it holds | Lifetime |
|---|---|---|---|
sb-<project>-auth-token | localStorage | Your Supabase session token — this is what keeps you signed in | Until you sign out or it expires |
sidebar:state | Cookie | Whether the app sidebar is open or collapsed | 7 days |
flashly:cookie-consent | localStorage | Your own choice on this page, so we stop asking | 6 months |
We store the consent record itself because we have to be able to prove you gave — or refused — consent, and because re-asking a visitor who already said no is exactly what the CNIL tells traders not to do.
3. Functional preferences — no consent required
These only remember a choice you made in the interface. They are first-party, never read by anyone else, and carry no identifier that could follow you elsewhere. The CNIL treats preference storage of this kind as exempt when it does nothing but restore the user's own setting.
| Name | Type | What it holds | Lifetime |
|---|---|---|---|
generation-mode-preference | localStorage | Which generation mode you last used (simple, guided, creative…) | Until cleared |
flashly:selected-vertical | localStorage | The industry you picked, so the studio opens pre-configured | Until cleared |
flashly_streak | localStorage | Your local generation streak counter | Until cleared |
You can clear all of these at any time from your browser's site-data settings, without affecting your account.
4. Needs your consent — off by default
| Name | Provider | What it does | Lifetime |
|---|---|---|---|
| Sentry session replay | Sentry (EU region) | If, and only if, the app hits an error, records a masked replay of that session so we can reproduce the bug. All text is masked and all media blocked before it leaves your browser. | 90 days |
This is off until you enable it. Nothing is recorded, and the replay code is not even loaded, before you accept.
Plain error reporting — the stack trace, the browser, the page it happened on — runs without a replay and without consent, on the legitimate-interest basis of keeping the service working. It writes nothing to your device.
Change your mind
Use the Cookie settings link in the footer, on any page. Withdrawing is as easy as giving, as Article 7(3) GDPR requires. Your choice is kept for six months; after that we ask again.
5. Third-party requests
Two things reach out beyond our own servers on page load, which we mention because it is data leaving your browser even though it sets no cookie:
- Google Fonts — our typefaces are loaded from Google's servers, which receive your IP address in the process. We are migrating to self-hosted fonts to remove this dependency.
- Stripe — loaded only on checkout and billing pages, never on the marketing site. Stripe sets its own cookies for fraud prevention, which are strictly necessary to processing a payment you initiated. See Stripe's privacy policy.
6. What we do not use
No Google Analytics. No Google Ads or Floodlight. No Meta pixel. No LinkedIn Insight tag. No TikTok pixel. No Hotjar. No fingerprinting. No data broker or advertising network of any kind.
Our product analytics are written to our own database, tied to your account, and only for signed-in users. They are described in the Privacy Policy.
7. Your browser
You can block or delete storage yourself in your browser settings. Blocking the strictly-necessary entries will sign you out and keep signing you out. Browser "Do Not Track" and Global Privacy Control signals do not currently change our behaviour, because we set nothing that those signals are designed to stop.
8. Questions
privacy@flashlystudio.com — or the CNIL, whose guidance on cookies and trackers is at cnil.fr.