Cookie policy
Version 2026-09 · Last updated September 9, 2026
This policy has not yet been reviewed by a lawyer.
This policy describes what PrintFlows actually stores in your browser today.
A cookie is a small file a website leaves in your browser. Some are how a site remembers you're signed in. Others are how a site counts visitors. We use both kinds, and only the first is on by default.
We also use localStorage and sessionStorage, which do the same job by a different mechanism. Everything here covers those too.
1. The short version
- Essential cookies are always on. Sign-in, security and language don't work without them, so there's no toggle. Québec's Law 25 and Canadian privacy law both allow this without consent, because you asked for the service.
- Analytics is off until you allow it. We don't count you until you say we can.
- There is no advertising on PrintFlows, so there are no advertising cookies and nothing that follows you to other sites.
- You can change your mind at any time from the Cookies section of your settings, or the link in the footer.
2. What we set
2.1 Essential: always on
The list is the table below. It is generated from the code that sets the cookies rather than typed out here, so it cannot drift from what your browser actually receives: every row gives the name, what it does, how long it lasts, and whether it is essential or analytics. On the live site the sign-in cookies (the ones named pf. and something) carry __Secure- in front of the name shown here. The sign-in software adds it on the live site, and it tells your browser never to send the cookie over a plain connection.
Also in browser storage, not as cookies: your in-progress quote request (file settings, material, quantity) so a refresh doesn't lose your work, and whether you've dismissed a notice. Both stay on your device.
| Name | What it does | How long | Category |
|---|---|---|---|
| pf.session_token | What it doesKeeps you signed in. | How long30 days | CategoryEssential |
| pf.session_data | What it doesHolds your session details so every page doesn't re-read them. | How long5 minutes | CategoryEssential |
| __Host-csrf | What it doesBlocks another site from acting as you. | How long1 hour | CategoryEssential |
| __Host-csrf-sig | What it doesSigns that token so it cannot be forged. | How long1 hour | Essential |
2.2 Analytics: off until you consent
If you allow analytics, we load a page-view counter that records rough journeys through the site, so we can see which steps people abandon. It's how we find out that a screen is confusing without asking anyone.
There is no analytics cookie today. The counter we use identifies a visit from the request itself rather than from anything stored in your browser, and PrintFlows sets nothing of its own for it, which is why the table above lists none. If that ever changes, the table changes with it and we ask again (section 5).
It's aggregated, and it isn't joined to your account, your orders or your email address.
2.3 What we don't set
No advertising cookies. No social media pixels. No cross-site tracking. No data broker tags. No session recording or heatmaps. Nothing sold to anyone.
3. Third parties
Two providers set cookies on pages where they do work for us:
- Stripe sets cookies on the checkout page for fraud prevention and to make the payment work. These are essential to taking a payment. Stripe's privacy policy governs them.
- Cloudflare, if the site is served through Cloudflare's proxy, sets a bot-management cookie in front of the whole site. It's essential to keeping the site up.
Neither is used for advertising.
Two names come from software we run rather than from our own cookie list, which is why the table in section 2 does not carry them: __cf_bm, the Cloudflare bot-management cookie described above, which lasts 30 minutes if the site is served through Cloudflare; and pf.trust_device, which the sign-in library sets for 30 days if you tell us to trust a device, so it can skip the second step there.
4. Changing your choices
In PrintFlows: Settings → Privacy and data → Manage cookies. Or the "Manage cookies" link in the footer of any page.
Turning analytics off deletes the analytics cookies on your next page load.
In your browser: every browser can block or clear cookies. Blocking essential cookies breaks sign-in: you'll be able to read the public site and get an estimate, but not place an order.
- Chrome: Settings → Privacy and security → Third-party cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy
- Edge: Settings → Cookies and site permissions
Do Not Track and Global Privacy Control: we treat a GPC signal as a refusal of analytics, so you never have to see the banner to say no.
5. If we add anything
Adding a new cookie category means asking again. We won't quietly start setting something new under a consent you gave for something else. The version number at the top of this page changes when the list does.
6. Questions
Write to [email protected]. Anything that is not about cookies can go to [email protected].
See also the privacy policy for everything we collect that isn't a cookie.
PrintFlows · Montréal, Québec, Canada