DocFlo uses only strictly necessary, first-party cookies. No advertising, analytics, or tracking cookies of any kind. This page explains exactly what we use and why.
A cookie is a small text file stored on your device when you visit a website. Your browser sends it back on each subsequent visit, allowing the site to remember information like your session. DocFlo uses only strictly necessary, first-party cookies — the minimum required to run the service.
Session (deleted on close) or persistent (set expiry date)
First-party (set by this site) or third-party (set by another domain)
Strictly necessary, functional, analytics, or advertising
Required for the website to function. Cannot be switched off without breaking core features. Do not require consent under the ePrivacy Directive.
Remember choices like language or theme. Not required for basic operation. Require consent.
Collect usage data to improve the site (Google Analytics, Mixpanel, Hotjar etc.). Require consent.
Track behaviour across sites to serve personalised ads (Meta Pixel, Google Ads, LinkedIn Tag etc.). Require explicit consent.
Every cookie set by docflo.app, with full technical attributes. All are strictly necessary and first-party.
When Yes — cookie cannot be read by JavaScript, protecting session tokens from XSS.
When Yes — only sent over HTTPS, never plain HTTP.
Only sent for same-site requests. SAMESITE=LAX also sent on top-level navigations. Both prevent CSRF.
We also use browser localStorage for one item. Unlike cookies, local storage is never sent to the server — it stays entirely in your browser.
Clear it anytime: DevTools → Application → Local Storage → docflo.app → delete docflo_cookie_consent. The notice will reappear on your next visit.
Cookie use in the EU/EEA is governed by the ePrivacy Directive (2002/58/EC), implemented in national law (e.g. PECR in the UK). Strictly necessary cookies are exempt from the consent requirement — they are essential for a service explicitly requested by the user.
Required to provide the authenticated session you explicitly requested by signing in. Without these, sign-in is technically impossible.
Required to enforce fair-use rate limits that allow us to offer free PDF tools without abuse — an operational necessity.
Required to avoid showing the cookie notice on every page visit — a basic, expected user experience.
No consent gate needed
Because all our cookies are strictly necessary, we are not required to obtain consent before setting them. The cookie notice is shown for transparency only. If we ever add non-essential cookies in the future, we will implement a full consent management platform (CMP) before deploying them.
● FIRST-PARTY (WHAT DOCFLO USES)
Set by the domain you are visiting (docflo.app). Only docflo.app can read them. Cannot track you across other websites.
○ THIRD-PARTY (NOT USED)
Set by a domain different from the one you are visiting. Can track behaviour across multiple sites. DocFlo sets zero third-party cookies.
While sub-processors like Stripe may set their own cookies when you visit their own sites directly, they set no cookies on docflo.app itself.
View, delete, and block cookies via your browser's built-in settings. See Section 09 for step-by-step instructions per browser.
Most browsers let you delete data for a specific site only. Chrome/Edge: Settings → Privacy → Site Settings → search docflo.app → Delete.
Cookies are session-only in private mode — deleted when you close the window. Session cookies still work during your visit.
Extensions like uBlock Origin or Privacy Badger can block specific cookies. Since DocFlo has no third-party cookies, their effect is limited.
Do I need to accept cookies to use DocFlo?
For anonymous use (processing PDFs without an account), only anon_id is set. For authenticated use, the NextAuth cookies are also required. All are strictly necessary — there is no consent gate to pass through.
Does DocFlo track me across other websites?
No. All DocFlo cookies are first-party and scoped to the docflo.app domain. They cannot be read by other websites. We have no advertising network relationships and no tracking pixels.
Are my uploaded PDFs associated with a cookie?
For authenticated users, operations are linked to your account. For anonymous users, operations are counted against your anon_id for rate-limiting only. File contents are never stored — deleted immediately after processing.
I see a cookie from a different domain on docflo.app. Why?
DocFlo sets no third-party cookies. If you observe one from another domain, please report it to privacy@docflo.app with the cookie name and domain so we can investigate.
Why doesn't DocFlo use analytics?
We made a deliberate product decision to avoid third-party analytics platforms that harvest user data. We operate on minimum data collection, and usage analytics fall outside that minimum.
Will you add more cookies in the future?
If we ever introduce non-essential cookies, we will: (1) update this policy before deploying them, (2) implement a consent management platform, and (3) notify registered users by email.
We may update this policy when we change our cookie usage or when laws change. Material changes will be reflected in an updated “Last updated” date. Registered users will be notified by email where required. Your continued use of DocFlo after any changes constitutes acceptance.
We respond to all cookie and privacy enquiries within 72 hours.