Cookie Policy
Exactly what Deflows stores in your browser, and how to turn analytics off.
Cookies we set
Deflows sets no advertising or analytics cookies. The cookies below are needed for the site to work at all, which is why there is no consent banner.
| Cookie | Purpose | Retention |
|---|---|---|
| deflows_anonymous_id | Identifies a browser that has not signed in, so upload limits and abuse protection can be applied. Set server-side and not readable by scripts. | 2 years |
| sb-*-auth-token | Supabase authentication. Keeps you signed in and authorises requests to your own flows and credits. | Session, refreshed while you stay signed in |
Other browser storage
One value is kept in local storage rather than a cookie, because it only ever needs to be read by the page you are on.
| Key | Purpose | Retention |
|---|---|---|
| deflows:analytics-opt-out | Remembers that you turned product analytics off. Written only when you use the toggle below, and read before analytics starts. | Until you turn analytics back on or clear site data |
Analytics
Deflows uses two analytics services, and both are configured without cookies: PostHog, hosted in the EU, for product analytics, and Vercel Analytics for aggregate traffic counts. No analytics identifier is stored on your device, so every page load starts as a new anonymous visit unless you are signed in. Marketing pages also record an anonymised session replay (pointer movement and page structure) to show where the site confuses people. The toggle below turns off both services.
- The workspace at /app has no session replay and no click tracking. Besides page views it sends only a fixed list of anonymous counters — which step you reached, the flow format, the target you chose, and how many objects a flow had — so flow contents, file names, table names, and column names never reach analytics.
- The same applies while you sign up, sign in, or manage your account: nothing beyond a page view is captured on /login, /signup, /account, or /auth.
- Everything typed into a form is masked before recording, including on the pages that are recorded — replay stores that you filled a field, never the value.
- Your flow files are parsed in your browser and are never uploaded for analytics.
- Analytics requests are proxied through this domain, so no third-party analytics script talks to your browser directly.
Turn it off
This switches off both PostHog and Vercel Analytics for this browser, including session replay. The choice is stored locally, so it applies to this browser only and resets if you clear site data.