How cookies and similar technologies support the PropFlow website and platform.

Cookies are small text files that a website places on your device when you visit. Similar technologies include localStorage tokens, session storage, and device fingerprinting. PropFlow uses these technologies to enable essential functions and, where you consent, to improve your experience.

This policy covers the PropFlow marketing website (propflowhq.com) and the platform application (app.propflowhq.com). The types of cookies used differ between these two contexts.

Session authentication tokens: managed by Clerk to keep you signed in to your workspace, tenant portal, or applicant portal. These are essential and cannot be disabled without breaking login functionality.

CSRF protection tokens: prevent cross-site request forgery attacks. Automatically set on form interactions.

Auth presence cookie: a lightweight marker used by the Next.js middleware to make routing decisions at the edge. Contains no personal data.

Rate limiting counters: IP-based counters held server-side for up to 1 hour to prevent abuse of public endpoints. Not stored in your browser.

Maintenance bypass cookie: if a maintenance bypass secret is configured by an admin, this cookie enables authorised access during maintenance mode. Only set for authorised users.

Interface preference storage: localStorage may store non-personal UI state (e.g., open/closed chat panel, dark mode preference) to improve your experience across sessions. This data is stored on your device only.

PropFlow does not currently deploy third-party advertising or cross-site tracking technologies. If optional analytics tools are added in future, they will be disclosed in an updated version of this policy and will require your explicit consent before activation.

Any analytics used will be configured with data minimisation in mind — IP anonymisation, short retention periods, and no sharing with advertising networks.

Cloudflare Turnstile: a privacy-friendly CAPTCHA alternative that verifies human visitors on certain forms without tracking or cross-site profiling. Subject to Cloudflare's privacy policy.

Stripe: may set cookies in the context of payment flows to support fraud detection and PCI DSS compliance. These are governed by Stripe's cookie policy.

You can control cookies through your browser settings. Most browsers allow you to view, delete, and block cookies. Note that blocking strictly necessary cookies will prevent login and core platform functionality from working.

For guidance on managing cookies in common browsers, visit your browser's help centre. For EU/UK users, you have the right under the ePrivacy Directive and UK PECR to refuse non-essential cookies. We will present a consent mechanism for any non-essential cookies before they are set.

We will update this Cookie Policy if we add new cookies or change how existing ones work. Material changes will be noted with an updated effective date and, where required by law, renewed consent will be sought.

Questions about our cookie practices can be directed to us at propflowhq.com/contact.