Last updated: May 13, 2026
Cookie Policy
Flewnt uses a small number of cookies and local storage entries to operate the site. This page explains what they are and how to control them.
1. Strictly necessary (always active)
These are required for the site to function. They cannot be disabled. Legal basis: legitimate interest.
Authentication
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| __Secure-authjs.session-token | Cookie (HttpOnly, Secure) | Identifies your signed-in session. Set when you log in with email, LINE, or a magic link. Without it the dashboard cannot recognise you. | 30 days |
| flewnt_2fa_verified | Cookie (HttpOnly, Secure) | Records that you have completed two-factor authentication for this session. Bound to your user ID and session ID via HMAC to prevent replay. | 12 hours |
| flewnt_reset_proof | Cookie (HttpOnly, Secure) | Short-lived proof that you followed a valid password-reset link. Consumed immediately after the new password is saved. | 10 minutes (single use) |
LINE Login (transient)
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| line_oauth_state | Cookie (HttpOnly, Secure) | CSRF protection during the LINE OAuth flow. Contains a random state value verified on callback. | 10 minutes |
| line_pkce_verifier | Cookie (HttpOnly, Secure) | PKCE code verifier for the LINE authorisation exchange. Scoped to the callback path only. | 10 minutes |
Consent and visitor identity
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| flewnt_consent | Cookie | Stores your cookie preferences (which categories you accepted or declined). Read on every page load to decide whether to activate analytics and marketing pixels. | 1 year |
| flewnt_vid | Cookie | Anonymous visitor identifier (random UUID). Used to deduplicate analytics events across browser-side pixels and server-side measurement APIs. | 1 year |
Referral attribution
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| flewnt_ref | Cookie (HttpOnly) | Records which partner referred you so they receive commission if you subscribe. | 30 days |
| flewnt_user_ref | Cookie (HttpOnly) | Records which existing user referred you for the milestone rewards programme. | 30 days |
| flewnt_partner_recruit | Cookie (HttpOnly) | Records which partner invited you to the partner programme so they receive a recruitment bonus. | 30 days |
Other functional cookies
| Name | Type | Purpose | Expiry |
|---|---|---|---|
| flewnt_upgrade_uid | Cookie (HttpOnly, Secure) | Carries your user ID from a one-time upgrade link sent by the LINE bot. Consumed when you reach the upgrade page. | 15 minutes (single use) |
| admin_view | Cookie (HttpOnly, Secure) | Internal only. Lets Flewnt administrators switch between admin and user views of the dashboard. | 1 hour |
2. Analytics (optional, consent-gated)
Only activated if you accept the Analytics category on the cookie banner. Legal basis: consent. You can withdraw consent at any time via the cookie banner (click "Customize" in the site footer) or by clearing the flewnt_consent cookie and refreshing the page.
| Name | Provider | Purpose | Expiry |
|---|---|---|---|
| _ga | Google Analytics 4 | Distinguishes unique visitors. Anonymised. | 2 years |
| _ga_* | Google Analytics 4 | Maintains session state. | 2 years |
GA4 is loaded under consent mode v2. The analytics_storage signal is set to denied by default and only upgraded to granted after you accept. Data retention is set to 14 months. See Google's privacy policy.
3. Marketing (optional, consent-gated)
Only activated if you accept the Marketing category on the cookie banner. Legal basis: consent. These cookies are set by third-party scripts (Meta and TikTok) and help Flewnt measure the effectiveness of ads. No retargeting or cross-site ad profiles are built.
| Name | Provider | Purpose | Expiry |
|---|---|---|---|
| _fbp | Meta (Facebook) | Browser identifier used by the Meta Pixel for ad measurement and conversion attribution. | 90 days |
| _fbc | Meta (Facebook) | Stores the click identifier when you arrive from a Meta ad. Used for conversion attribution only. | 90 days |
| _ttp | TikTok | Browser identifier used by the TikTok Pixel for ad measurement and conversion attribution. | 13 months |
| ttclid | TikTok | Stores the click identifier when you arrive from a TikTok ad. Used for conversion attribution only. | 90 days |
When marketing consent is granted, Flewnt also enables Google Ads conversion tracking signals (ad_storage, ad_user_data, ad_personalization) through GA4. These are denied by default and only upgraded after you accept. See Meta's privacy policy and TikTok's privacy policy.
4. Local storage and session storage
The site uses a small number of browser storage entries that are not cookies but behave similarly. They never leave your browser and are not sent to our servers.
| Key | Storage | Purpose | Lifetime |
|---|---|---|---|
| flewnt_utm_first | localStorage | First-touch UTM attribution. Records the original source, medium, and campaign that brought you to the site. | 30 days (self-expiring) |
| flewnt_utm | sessionStorage | Last-touch UTM attribution for the current browser session. | Browser session |
| flewnt_visit_count | localStorage | Counts how many sessions you have had so we can detect return visits for analytics. | Persists until cleared |
| flewnt_session_counted | sessionStorage | Prevents the visit counter from incrementing more than once per browser session. | Browser session |
5. What we do not use
- No fingerprinting or cross-site tracking.
- No third-party retargeting or ad profile building.
6. Managing cookies
You can change your consent choices at any time using the "Customize" link in the site footer. Most browsers also let you block or delete cookies via settings. Blocking all cookies will not break Flewnt's marketing pages but will prevent you from signing in to the dashboard and will reset your consent preference on each visit.
7. Contact
Questions about cookies: