Cookie Policy
Last updated: August 2026
1. What Are Cookies and Similar Technologies
Cookies are small text files stored on your device when you visit a website. Similar technologies include browser local storage and session storage, which work similarly but are accessed by the website’s own scripts rather than sent back to the server with each request.
Under POPIA, GDPR and similar laws, these technologies are treated equivalently: any technology that stores information on your device for the purpose of identifying you, tracking your activity, or maintaining session state is disclosable.
2. What Legal Flow Currently Uses
Legal Flow takes a minimal approach: two first-party cookies, both strictly necessary to keep you signed in, and one local-storage entry for a display preference. Nothing else. No analytics, no advertising, no third-party tracking of any kind.
Both cookies are set httpOnly, which means the website’s own JavaScript cannot read them. This is deliberate: it is what stops a script-injection flaw from being able to steal your session. They are also marked Secure (sent only over HTTPS) and SameSite=Lax (not sent on cross-site requests, which is what protects you from cross-site request forgery).
| Name | Purpose | Type | Duration |
|---|---|---|---|
lf_access | A short-lived signed token that proves to our servers that you are signed in. It carries only your account ID, email address and role — no matter details, no client data. | First-party cookie (httpOnly, Secure, SameSite=Lax) | 15 minutes |
lf_refresh | A random single-use token that lets your browser obtain a fresh lf_access token without asking you to sign in again. It carries no personal data at all — it is a random value, and only a hashed copy is kept on our side. It is replaced every time it is used, so a stolen one stops working as soon as the real session continues. | First-party cookie (httpOnly, Secure, SameSite=Lax) | 7 days, or until you sign out, change your password, or we detect the session has been tampered with |
currentFirm | Remembers which firm workspace you were last working in, so the app reopens where you left off. Stores only that firm’s short URL name. | Browser local storage | Until you sign out or clear browser storage |
These are strictly necessary technologies under e-Privacy / POPIA s69 — no consent banner is required for them, but we disclose them here for transparency.
2.1 No analytics, advertising or tracking
Legal Flow does not use:
- Google Analytics, Plausible, PostHog, Mixpanel, or any other web analytics tool
- Advertising networks, retargeting pixels, or marketing trackers
- Third-party chat widgets, A/B testing tools, or heatmap recorders
- Social media share buttons that load tracker scripts
If we ever add analytics in future, we will update this Cookie Policy and present you with a granular opt-in consent prompt beforeany non-essential technology is loaded into your browser.
3. Managing Browser Storage
You can clear local storage and cookies at any time through your browser settings. Doing so will sign you out of Legal Flow (you can sign back in immediately).
Most browsers also let you:
- View what is stored and delete entries individually
- Block third-party cookies. Legal Flow sets none, so this has no effect on the application — but blocking first-party cookies for this site will prevent you from signing in, because that is how your session is carried.
- Block all cookies from specific sites
- Delete all storage when you close the browser
See your browser’s help documentation for instructions.
4. Updates to This Policy
We may update this Cookie Policy from time to time. We will notify you of any changes by posting the new Cookie Policy on this page and updating the “Last updated” date.
5. Contact Us
If you have any questions about our Cookie Policy, contact us at privacy@yourlegalflow.com.