What cookies and browser storage do
A cookie is a small value a website asks your browser to store and send back with later requests. FocusFlow also uses local storage and session storage. These are browser storage mechanisms, not cookies, and they are not automatically sent with every request. They support account sessions, security flows, saved preferences, consent choices, and app behavior.
Necessary first-party cookies
FocusFlow sets these cookies on the FocusFlow site to keep authentication and security flows working. The authentication cookies are HttpOnly, so page scripts cannot read their values. In production they are marked Secure and use the configured SameSite behavior.
- ff_auth: holds the signed-in session. Its cookie lifetime follows the session token lifetime, which defaults to 24 hours and can be configured; the session may be invalidated earlier by sign-out or server-side security actions.
- ff_login_mfa: temporarily carries a multi-factor login challenge for up to 5 minutes.
- ff_recovery: temporarily carries an account-recovery session for up to 10 minutes.
- ff_trusted_device: remembers a device for multi-factor sign-in for up to 30 days, subject to server-side expiry or revocation.
- ff_google_login: protects the Google sign-in callback and is scoped to its authentication path for up to 10 minutes.
If you block FocusFlow authentication cookies, FocusFlow cannot reliably keep you signed in or complete the associated login and recovery flows. Core account features that require an authenticated session will not work.
Security and abuse prevention
FocusFlow uses Cloudflare Turnstile for some verification flows. Turnstile is provided by Cloudflare and may process browser or device signals needed to distinguish people from automated abuse. FocusFlow's code does not specify a Turnstile cookie name or retention period; Cloudflare controls its own browser-side behavior. Google sign-in also redirects to Google, where Google's own cookies and privacy controls apply.
Analytics and error reporting
After you allow optional analytics and error reporting, FocusFlow can initialize PostHog product analytics and Sentry error reporting. PostHog is configured to persist in local storage rather than cookie storage. Sentry sends technical error reports and sampled browser traces; FocusFlow configures user-info collection off. These services receive data needed to provide those functions.
The privacy banner's Allow, Decline, and Preferences controls store a choice in FocusFlow local storage. Preferences lets you enable or disable PostHog and Sentry. You can reopen those controls using the Manage privacy preferences button on the Privacy Policy page. If local storage is unavailable, FocusFlow cannot save the choice and displays an error in the preferences panel.
Current implementation detail: the site HTML also loads a Google Analytics tag from Google Tag Manager without checking this consent choice. The current banner does not switch that tag on or off. FocusFlow's source does not set a retention period for Google's identifiers; exact browser-side identifiers and lifetimes depend on Google's implementation and browser behavior. You can use browser privacy settings or blocking tools to limit third-party scripts and storage.
Preferences and other browser storage
FocusFlow stores choices such as theme, language, and analytics consent in local storage. Some first-visit campaign parameters are kept in session storage for the current browser tab/session. The calendar and task interfaces also use local storage for app caches and pending offline changes. These values generally remain until FocusFlow removes them, you clear site data, or the browser removes them; the application does not assign a single expiry time to all local-storage entries.
Third-party services and your choices
Google Tag Manager/Analytics, Google sign-in, Cloudflare Turnstile, PostHog, and Sentry are the third-party services in the implementation that are relevant to browser requests or measurement. Some services are contacted only during a feature you choose; Google Analytics currently loads with the site page, while PostHog and Sentry are gated by the optional consent choice. Each provider has its own privacy practices and may receive information when its service is used.
You can change the FocusFlow consent choice using the privacy controls, clear cookies and site storage in your browser, or use browser controls/extensions to block third-party cookies or scripts. Blocking necessary cookies or storage can prevent sign-in, security checks, saved preferences, or core features from working. Browser controls may not stop all network requests or delete data already held by a third party.
For privacy or cookie questions, contact privacy@usefocusflow.app. See the Privacy Policy for broader information-handling details.