Cookie Policy

Cookies are small files stored by your browser. We also use localStorage, which works similarly but is only read by our own site. Together we refer to them as "cookies" on this page.

Authentication and session cookies keep you signed in and let the dashboard load your organization. Security cookies protect against cross-site request forgery and abuse.

These cannot be switched off in the product; without them sign-in and paid features cannot work.

We remember interface preferences such as sidebar collapse state, selected workspace and recently used tools so the product feels consistent between visits.

We collect aggregated usage events — pages viewed, features used, errors encountered — to find broken flows and prioritise improvements. These are not used for advertising and are not sold.

Sign-in with Google sets cookies controlled by Google during the authentication flow. Our payment processor sets cookies on its own checkout to prevent fraud. Their use is governed by their own policies.

Session cookies are deleted when you close the browser. Authentication tokens are refreshed periodically and expire after a period of inactivity, so an abandoned session cannot be reused indefinitely.

Interface preferences stored in localStorage persist until you clear your browser storage or sign out from all devices. Analytics identifiers are short-lived and rotate; they are not designed to follow you across other websites.

Strictly necessary cookies exist because the product cannot work without them: without a session token there is no way to know which workspace to load or whether you are entitled to a paid feature. There is no consent choice for these, because switching them off is equivalent to signing out.

Functional and analytics cookies are about quality. When a scan page errors for a subset of browsers, aggregated event data is usually how we find out before anyone reports it. We keep the data set deliberately small: no advertising pixels, no cross-site tracking, no sale of data to third parties.

We honour browser-level Global Privacy Control signals where they are sent, by limiting collection to strictly necessary cookies for that session. Because Do Not Track was never standardised consistently across browsers, we treat it the same way as a GPC signal rather than ignoring it.

You can delete or block cookies in your browser settings at any time. Every major browser also allows per-site rules, so you can block third-party cookies globally while keeping Reflyma signed in. Blocking strictly necessary cookies will sign you out and prevent the dashboard from loading.

Clearing site data is the quickest way to reset every preference we store: it removes the session, the workspace selection and any cached interface state, and the next sign-in starts from defaults.

When we add or remove a cookie category we update this page and change the date at the top. Material changes that affect what is collected are also announced in-product so you are not expected to re-read the policy to notice them.

For questions about this policy, about a specific cookie, or to request deletion of data associated with your account, contact support@reflyma.com and we will respond within one business day.