# Cookie Policy

> Every cookie and browser storage entry Flashly Studio uses, what it holds, how long it lasts, and which ones need your consent.

- Document: cookies
- Language: en
- Last updated: 2026-09-20
- Canonical page: https://flashlystudio.com/cookies
- Other language: https://flashlystudio.com/fr/cookies

## In short

- Flashly uses no advertising cookie, no cross-site tracker and no social media pixel.
- Almost everything we store is strictly necessary — keeping you signed in, remembering a toggle — and needs no consent.
- Only one thing needs your consent: Sentry error session replay. It is off until you turn it on.
- Refusing is exactly as easy as accepting, and your choice lasts six months.

## 1. What this page covers

French law (Article 82 of the Data Protection Act, transposing the ePrivacy Directive) governs anything **read from or written to your device** — not just cookies. `localStorage`, `sessionStorage` and similar all count. This page lists every one of them.

The rule is simple: if something is *strictly necessary* to deliver a service you asked for, it needs no consent. Everything else does, and must be off until you say yes.

## 2. Strictly necessary — no consent required

These cannot be turned off without breaking the site. None of them tracks you across other websites.

| Name | Type | What it holds | Lifetime |
| --- | --- | --- | --- |
| `sb-<project>-auth-token` | localStorage | Your Supabase session token — this is what keeps you signed in | Until you sign out or it expires |
| `sidebar:state` | Cookie | Whether the app sidebar is open or collapsed | 7 days |
| `flashly:cookie-consent` | localStorage | Your own choice on this page, so we stop asking | 6 months |

We store the consent record itself because we have to be able to prove you gave — or refused — consent, and because re-asking a visitor who already said no is exactly what the CNIL tells traders not to do.

## 3. Functional preferences — no consent required

These only remember a choice you made in the interface. They are first-party, never read by anyone else, and carry no identifier that could follow you elsewhere. The CNIL treats preference storage of this kind as exempt when it does nothing but restore the user's own setting.

| Name | Type | What it holds | Lifetime |
| --- | --- | --- | --- |
| `generation-mode-preference` | localStorage | Which generation mode you last used (simple, guided, creative…) | Until cleared |
| `flashly:selected-vertical` | localStorage | The industry you picked, so the studio opens pre-configured | Until cleared |
| `flashly_streak` | localStorage | Your local generation streak counter | Until cleared |

You can clear all of these at any time from your browser's site-data settings, without affecting your account.

## 4. Needs your consent — off by default

| Name | Provider | What it does | Lifetime |
| --- | --- | --- | --- |
| Sentry session replay | Sentry (EU region) | If, and only if, the app hits an error, records a masked replay of that session so we can reproduce the bug. All text is masked and all media blocked before it leaves your browser. | 90 days |

**This is off until you enable it.** Nothing is recorded, and the replay code is not even loaded, before you accept.

Plain error reporting — the stack trace, the browser, the page it happened on — runs without a replay and without consent, on the legitimate-interest basis of keeping the service working. It writes nothing to your device.

### Change your mind

Use the **Cookie settings** link in the footer, on any page. Withdrawing is as easy as giving, as Article 7(3) GDPR requires. Your choice is kept for six months; after that we ask again.

## 5. Third-party requests

Two things reach out beyond our own servers on page load, which we mention because it is data leaving your browser even though it sets no cookie:

- **Google Fonts** — our typefaces are loaded from Google's servers, which receive your IP address in the process. We are migrating to self-hosted fonts to remove this dependency.
- **Stripe** — loaded only on checkout and billing pages, never on the marketing site. Stripe sets its own cookies for fraud prevention, which are strictly necessary to processing a payment you initiated. See [Stripe's privacy policy](https://stripe.com/privacy).

## 6. What we do not use

No Google Analytics. No Google Ads or Floodlight. No Meta pixel. No LinkedIn Insight tag. No TikTok pixel. No Hotjar. No fingerprinting. No data broker or advertising network of any kind.

Our product analytics are written to our own database, tied to your account, and only for signed-in users. They are described in the [Privacy Policy](/privacy).

## 7. Your browser

You can block or delete storage yourself in your browser settings. Blocking the strictly-necessary entries will sign you out and keep signing you out. Browser "Do Not Track" and Global Privacy Control signals do not currently change our behaviour, because we set nothing that those signals are designed to stop.

## 8. Questions

**privacy@flashlystudio.com** — or the CNIL, whose guidance on cookies and trackers is at [cnil.fr](https://www.cnil.fr/fr/cookies-et-autres-traceurs).