Legal
Cookie policy
Last updated: 14 November 2026
Cookies are small files a website stores in your browser. This page lists the ones BorsFlow uses. Essential cookies are always on, because the service cannot work without them. Analytics cookies are optional and are only set after you accept them in the cookie banner.
Your choice
You can accept or refuse analytics cookies at any time. Refusing changes nothing about how the website or the app works.
You can also delete or block cookies in your browser settings. Blocking essential cookies will stop you from signing in.
Essential cookies and storage
These are needed to sign you in, keep your session secure and remember basic preferences. They do not track you across websites.
| Name | Purpose | Duration |
|---|---|---|
| next-auth.session-token | Keeps you signed in | 30 days |
| next-auth.csrf-token | Protects forms against cross-site request forgery | Session |
| next-auth.callback-url | Returns you to the right page after signing in | Session |
| bf-cookie-consent (local storage) | Remembers your cookie choice | Until you change it |
| app-storage, app_locale (local storage) | Remembers your theme, language and current workspace | Until cleared |
| bf-form:* (session storage) | Keeps your answers on a public form if the page reloads before sending | Until the tab is closed |
On secure connections the session cookies carry a __Secure- or __Host- prefix. Public forms may also run a Cloudflare Turnstile check, which processes browser signals only to tell people from bots.
Analytics cookies (optional)
Only set if you click “Accept analytics”, and only on our marketing website — never inside your workspace or on forms our customers publish. They help us understand which pages are useful and where visitors get stuck.
| Name | Provider and purpose | Duration |
|---|---|---|
| _ga | Google Analytics (loaded through Google Tag Manager): distinguishes visitors | 2 years |
| _ga_* | Google Analytics: keeps the state of a visit | 2 years |
| _clck | Microsoft Clarity: identifies a returning visitor | 1 year |
| _clsk | Microsoft Clarity: links page views into one visit | 1 day |
| CLID, MUID | Microsoft Clarity: identifies a browser across Clarity sites | 1 year |
Google Analytics runs with advertising features denied (Google Consent Mode). Microsoft Clarity records how pages are used — clicks, scrolling, mouse movement — to produce heatmaps and session replays; text typed into fields is masked. Read Google’s privacy policy and Microsoft’s privacy statement.
Fonts
Our pages load typefaces from Google Fonts. This sets no cookie, but your browser’s request reveals your IP address to Google.
More information
How we handle personal data in general is described in the privacy policy. Questions: contact our support team.