Last updated: September 24, 2026
1. About this notice
This notice explains how Harbor Software LLC ("we" or "us"), which operates Flowboard, uses cookies and similar technologies on the Flowboard website and in the Flowboard application, and how you can control them. It supplements our Privacy Policy, which explains how we handle the personal data these technologies collect. Terms defined in the Privacy Policy have the same meaning here.
Section 3 describes what each property uses. The table below lists every individual item with its name, type, purpose, category, the party that sets it and how long it lasts.
2. What these technologies are
- Cookies are small text files that a website stores in your browser and that your browser sends back with later requests to that site. A first-party cookie is set on the domain you are visiting, including by a provider acting for us on our domain. A third-party cookie is set on another domain. A session cookie ends when you close your browser, and a persistent cookie lasts until it expires or you delete it.
- Local storage and session storage let a website keep data in your browser. They are not sent with each request automatically. Local storage stays until it is cleared, and session storage is cleared when you close the browser tab.
- IndexedDB is a database in your browser that a website can use to keep larger amounts of structured data on your device.
- Cache storage lets a website keep copies of files, for example so that a page can still show when you lose your connection.
- Pixels and web beacons are tiny images or scripts that report when a page or an email is viewed. We do not use them on our website, in the application or in the emails we send, and we do not rewrite the links in our emails to track clicks.
In this notice, "storage items" means any of these.
3. What we use on each property
3.1 The website at flowboardhq.com
The website sets no cookies. It stores one item in session storage, flowboard-annual-offer-dismissed, which remembers that you closed the annual offer banner and is cleared when you close the tab. The website loads its fonts and scripts from our own domain, so opening a page does not send your browser to a third-party font or script provider.
The website uses Vercel Web Analytics to count page views. It uses no cookies and no persistent identifier, and nothing is stored on your device. The table below lists it with the provider that runs it. Like any website, ours is served by a hosting provider that records standard request data, such as your IP address and browser type, as the Privacy Policy describes. That record is not stored on your device.
3.2 The application at app.flowboardhq.com
The application, including the client portal and the public form, booking and proposal pages that workspaces publish, uses the following:
- Sign-in cookies. Our authentication provider, Clerk, sets cookies on our domains that keep team members signed in and protect their sessions. Flowboard's own code sets no cookies.
- Bot protection. At sign-up and sign-in, Clerk loads Cloudflare Turnstile, which runs a check from Cloudflare's domain and can set its own cookies there to tell people from automated tools.
- Client portal session. A client user's sign-in is kept in local storage until the client user signs out. The session itself ends on our servers after 30 days.
- Workspace data cache. The application keeps a copy of recent workspace data in IndexedDB so that it loads quickly. Entries older than 30 minutes are discarded when the application next loads. Signing out does not clear this cache, so on a shared device clear your browser's data for app.flowboardhq.com when you finish.
- Preferences. Local storage remembers your theme and accent color, the layout of the sidebar, open project tabs and chat panels, your recent searches, and which tips and prompts you dismissed. Your recent searches are stored as the text you typed, on your device only.
- Product analytics. PostHog stores an analytics identifier and its settings in local storage, and uses them to record how the application is used, as section 5.3 of the Privacy Policy describes. A small number of local storage flags also record that a one-time product event has already been counted. Product analytics does not run on the client portal or on the public form, booking and proposal pages, and for team members in the European Economic Area and the United Kingdom it runs only after they consent, as section 6.2 explains.
- Stability and offline support. A session storage item stops the application from reloading in a loop after an update, and a service worker keeps an offline page in cache storage. No workspace data is kept in that cache.
Some services you choose to use through the application run on their providers' own domains and set their own cookies there under their own policies. Examples are the payment forms provided by Stripe, signing in with a Google account, and connecting Google Calendar.
3.3 The status page and feedback portal
From the time we operate them, our status page at status.flowboardhq.com is run by Better Stack and our feedback portal at feedback.flowboardhq.com is run by Featurebase. Each sets its own cookies to run the portal, for example to keep you signed in when you post, vote or comment, or to manage a status update subscription. We add each portal's items to the table below when that portal goes live.
4. Categories we use
- Strictly necessary items are needed for a service you asked for, such as signing in, keeping a client portal session, protecting sign-up and sign-in from automated abuse, and keeping the application working. The Service cannot work properly without them.
- Preferences items remember choices you made, such as your theme or a banner you closed.
- Analytics items help us understand how the Service is used, so that we can improve it.
We do not use advertising, targeting or social media cookies.
5. No advertising and no cross-site tracking
We do not place advertising pixels or third-party advertising cookies on our website or in the application, and we do not track you across other websites. Product analytics data is kept in storage on our own domain and is used only to understand and improve Flowboard. We do not sell personal data or share it for cross-context behavioral advertising.
6. Consent and your choices
6.1 Strictly necessary and preference items
Strictly necessary items are used without asking for consent, because the Service you asked for depends on them. Preference items only remember a choice you made, and are used on the same basis.
6.2 Analytics
Page analytics on the website stores nothing on your device. For team members in the European Economic Area and the United Kingdom, the application stores and reads analytics items only after you consent, and you can change your choice in the application at any time. Declining is as easy as accepting, and nothing is stored or sent for analytics until you accept. Elsewhere, we use product analytics on the basis of our legitimate interests, as the Privacy Policy explains, and you can object by emailing privacy@flowboardhq.com.
6.3 Browser controls
Your browser lets you block cookies, delete cookies and site data, and browse privately. Its help pages explain how. You can also clear the local storage, session storage and IndexedDB data for a single site. If you block cookies for our domains, you cannot sign in to the application. If you clear the application's site data, you are signed out and your display preferences, recent searches and dismissed tips are reset. A content blocker can also stop analytics from loading.
6.4 Browser signals
We do not sell or share personal information and do no cross-site tracking, so there is nothing for a Do Not Track signal to switch off. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing, as section 15.2 of the Privacy Policy explains.
7. Changes to this notice
We update this notice and the table below when we add, remove or change a storage item. The date at the top of this page shows the last update. If a change is material, we give notice as section 17 of the Privacy Policy describes.
Cookies and storage we use
flowboardhq.com (this website)
| Name | Type | Purpose | Category | Set by | Duration |
|---|---|---|---|---|---|
| flowboard-annual-offer-dismissed | sessionStorage | Remembers that you closed the annual savings banner | Preferences | Flowboard | Until you close the browser tab |
app.flowboardhq.com (the Flowboard app)
| Name | Type | Purpose | Category | Set by | Duration |
|---|---|---|---|---|---|
| __session, __client_uat and related Clerk cookies | Cookie | Keeps you signed in and protects your session | Strictly necessary | Flowboard, set by Clerk | Session lifetime set in our authentication settings |
| Cloudflare Turnstile | Cookie and embedded check | Detects automated sign-up and sign-in attempts | Strictly necessary | Cloudflare | Set by Cloudflare |
| portal_token | localStorage | Keeps a client portal user signed in | Strictly necessary | Flowboard | Until sign-out; the server session ends after 30 days |
| flowboard-query-cache | IndexedDB | Stores recent workspace data locally so the app loads quickly | Strictly necessary | Flowboard | Entries older than 30 minutes are discarded |
| Theme, sidebar, tab and chat layout settings | localStorage | Remembers your display and layout choices | Preferences | Flowboard | Until you clear it |
| fb-recent-searches | localStorage | Shows your recent searches | Preferences | Flowboard | Until you clear it |
| Dismissed tips and prompts | localStorage | Stops onboarding tips, install and notification prompts from reappearing | Preferences | Flowboard | Until you clear it |
| ph_<project>_posthog | localStorage | Product analytics identifier and settings | Analytics | PostHog | Until you clear it |
| fb-first-task-tracked, fb-first-timer-tracked | localStorage | Records that a one-time product event has already been counted | Analytics | Flowboard | Until you clear it |
| flowboard-chunk-reload-at | sessionStorage | Prevents repeated reloads after an app update | Strictly necessary | Flowboard | Until you close the browser tab |
| Stripe payment form | Cookie | Processes card payments securely and prevents fraud when you enter payment details | Strictly necessary | Stripe | Set by Stripe |
| Offline page cache | Cache Storage | Shows an offline page when you lose connection; no workspace data is cached | Strictly necessary | Flowboard | Until the app updates |
8. Contact
Questions about this notice go to privacy@flowboardhq.com, or by post to Harbor Software LLC, 1309 Coffeen Avenue, STE 1200, Sheridan, Wyoming 82801, USA.