Our website uses cookies to distinguish you from other users of our websites (theraflo.co.uk and app.theraflo.co.uk) and service. This helps us to provide you with a good experience when you browse our website and use our service and also allows us to improve our site.
A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer's hard drive.
We use the following cookies:
Strictly necessary cookies. These are cookies that are required for the operation of our website. These essential cookies are always enabled because our website won’t work properly without them. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services. You can switch off these cookies in your browser settings but you may then not be able to access all or parts of our website.
Analytics or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. [We may also share this information with third parties for this purpose so that they can serve you with relevant advertising on their websites.]
You can find more information about the individual cookies we use and the purposes for which we use them in the table below:
1. Marketing site — theraflo.co.uk
Cookie / storage | Purpose | Category | Lifetime |
|---|---|---|---|
__cf_bm (Cloudflare) | Bot management | Strictly necessary | 30 minutes |
cf_clearance (Cloudflare) | Bot / DDoS challenge pass | Strictly necessary | 30 days |
Google Tag Manager | Loader for the tags below — sets no cookies itself | Strictly necessary (loader) | — |
Consent banner state (1st-party cookie) | Remembers accept / decline choice | Strictly necessary | 6 months |
_ga, _ga_<id> (GA4) | Analytics — distinguishes users / sessions | Analytics | 2 years |
_gid (GA4, if enabled) | Analytics — 24h user differentiation | Analytics | 24 hours |
_gcl_au (Google Ads) | Conversion linker | Advertising/Functionality | 90 days |
_gcl_aw, _gcl_dc (Google Ads, set on ad click) | Conversion attribution | Advertising/Functionality | 90 days |
_fbp (Meta Pixel) | Conversion attribution | Advertising/Functionality | 90 days |
fr (Meta, set on facebook.com) | Ad delivery | Advertising/Functionality | 90 days |
li_sugr, bcookie, lidc, AnalyticsSyncHistory, UserMatchHistory (LinkedIn Insight Tag) | B2B ad attribution | Advertising/Functionality | 24 hours to 1 year |
_ttp (TikTok Pixel) | Conversion attribution | Advertising/Functionality | 13 months |
_rdt_uuid (Reddit Pixel) | Conversion attribution | Advertising/Functionality | 90 days |
UTM parameters | Captured in URL only — not stored in a cookie | n/a | n/a |
2. SaaS app — app.theraflo.co.uk
Cookie / storage | Purpose | Category | Lifetime |
|---|---|---|---|
sb-<project>-auth-token (Supabase) | Signed-in session | Strictly necessary | Session — rolling refresh tokens typically up to 7 days |
session-active | HMAC-signed session marker | Strictly necessary | 12 hours (inactivity window) |
2fa-pending | Two-factor challenge in progress | Strictly necessary | 10 minutes |
device-token | "Trust this device" for 2FA | Strictly necessary | 14 days |
__cf_bm, cf_clearance (Cloudflare) | Bot / DDoS protection | Strictly necessary | 30 minutes / 30 days |
theraflo_consent (cookie) | Remembers your cookie-consent choice (accept / reject / preferences) | Strictly necessary / functionality | 6 months |
localStorage — remembered email on sign-in form | UX convenience | Functionality | Persistent until cleared |
localStorage — sidebar collapsed flag | UI preference | Functionality | Persistent until cleared |
sessionStorage — active-tab marker | Single-session UI state | Strictly necessary | Until tab closed |
Sentry session replay (uses sessionStorage, not cookies) | Captures the session up to the moment an error occurs, for debugging. EU-hosted (Frankfurt), PII scrubbed, 0% session sampling, 100% error sampling | Strictly necessary (security / error monitoring) | Until tab closed |
Product analytics (likely PostHog EU, self-hosted or EU cloud) — ph_<key>_posthog and similar | More advanced in-app usage tracking — feature usage, funnels, retention. First-party, EU-hosted, no advertising use | Analytics | 1 year |
Stripe (subscriptions and Stripe Connect for therapist payouts): all Stripe interactions redirect to Stripe-hosted pages (Checkout, Connect onboarding, billing portal). Stripe sets its own cookies on *.stripe.com, not on our domain, so they fall outside this policy. We do not embed Stripe.js or Stripe Elements in the app.
The app sets no advertising or behavioural-analytics cookies.
-
To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.
You can choose which analytical, functionality and targeting cookies we can set by clicking on the button(s):
Strictly necessary cookies ALWAYS ACTIVE
Analytics or performance cookies ON/OFF
Functionality cookies ON/OFF
Targeting cookies ON/OFF
You can also choose to "Reject All" cookies in the cookie banner.
However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.
If you have any questions or concerns about our use of cookies, please send us an email at data@theraflo.co.uk.