Cookie Policy

Every cookie we set, why it exists, and how to turn the optional ones off.

Last updated: August 18, 2026

1. Change your choice

Your current choice

You have not chosen yet. Optional cookies are off until you do.

Choosing “Essential only” means PostHog is never initialised and the Crisp chat script is never loaded. Nothing is dropped on your device and asked about afterwards.

A cookie is a small file a site stores in your browser so it can recognise you on the next request. Related technologies — local storage and session storage — do the same job, and this policy covers them too.

Cookies set by fitflowwcrm.com are first-party. Cookies set by another company whose code runs on our pages are third-party.

3. The categories we use

Essential — sign-in, security, and remembering your cookie choice. The service cannot work without them, so they are not optional and no consent is required for them.
Functional — the support chat widget. Off unless you accept.
Analytics — which features get used, so we know what to build. Off unless you accept.

What we do not use

No advertising cookies. No retargeting or conversion pixels. No cross-site tracking. No data broker integrations. We do not sell or share cookie data.

4. Every cookie we set

Cookie	Provider	Category	Purpose	Duration
`sb-<project>-auth-token`	Supabase (first party)	Essential	Keeps you signed in. Mirrored to an HttpOnly cookie so the token is not readable by scripts.	Session, refreshed up to 1 hour
`fitfloww_cookie_consent`	FitFloww (first party)	Essential	Remembers your cookie choice so you are not asked on every visit.	6 months
`sidebar_state`	FitFloww (first party)	Essential	Remembers whether the app sidebar is expanded or collapsed.	7 days
`crisp-client/*`	Crisp (third party)	Functional	Keeps your support chat history so a conversation survives a page reload. Set only after you accept optional cookies.	6 months
`ph_<key>_posthog`	PostHog (third party)	Analytics	Measures which features are used so we can prioritise work. Set only after you accept optional cookies.	1 year

Third-party providers are listed with what they receive in Sub-processors.

5. Controlling cookies in your browser

Your browser can block or delete cookies independently of the choice you make here. Blocking essential cookies will sign you out and stop parts of the app from working.

6. Do Not Track and Global Privacy Control

We do not respond to Do Not Track headers, because the industry never agreed what a site should do on receiving one. We do honour Global Privacy Control as an opt-out of sale and sharing, as California requires — though we do not sell or share personal information in any case.

7. Changes and contact

If we add a cookie in a new category, we ask for consent again rather than relying on your previous answer. Your choice is stored for six months, after which we ask again.

Questions: privacy@fitflowwcrm.com. See also the Privacy Policy.