Legal
Cookie Policy
Which cookies DayOneFlow sets, why and for how long. Only cookies that are strictly necessary for signing in are used.
Last updated
Draft: this page is being prepared and has not yet been reviewed by counsel. Text in [square brackets] will be completed before DayOneFlow is offered to customers.
Summary
DayOneFlow uses only cookies that are strictly necessary for staff to sign in to the application and to stay signed in.
- There are no analytics, advertising, social-media or other tracking cookies, and no third-party cookies. The site loads no third-party scripts, and its fonts are served from DayOneFlow's own server.
- Reading the public website sets no cookies. They are set only when someone signs in, or starts to.
- Candidates and new hires use a personal link that works without cookies.
What cookies are
A cookie is a small piece of text that a website asks your browser to keep and to send back with later requests. A cookie is strictly necessary when a service you asked for cannot work without it: here, signing in.
The cookies DayOneFlow sets
| Name | Purpose | Duration | Set by |
|---|---|---|---|
__Secure-authjs.session-token | Keeps a staff user signed in. | 12 hours; deleted when you sign out | DayOneFlow (first party) |
__Host-authjs.csrf-token | Protects the sign-in service against requests forged by other websites (cross-site request forgery). | Until you close your browser | DayOneFlow (first party) |
__Secure-authjs.callback-url | Remembers the page to return to after signing in. | Until you close your browser | DayOneFlow (first party) |
__Secure-authjs.pkce.code_verifier | Google sign-in only: protects the step where Google sends you back to DayOneFlow. | 15 minutes; deleted once sign-in is complete | DayOneFlow (first party) |
DayOneFlow sets these cookies itself, through the Auth.js sign-in library it uses. All of them are marked HttpOnly, so scripts in the page cannot read them. They are sent only over encrypted connections, only to DayOneFlow's own address, and with SameSite=Lax. Without an encrypted connection, which happens only when the software is run locally for development, the same cookies are named without the __Secure- or __Host- prefix.
The session cookie is encrypted and holds no name, email address or profile: only an internal account identifier and a session version. DayOneFlow checks both against its database on every request, so disabling an account or resetting a password ends its sessions at once.
[TO CONFIRM: whether __Secure-authjs.state (15 minutes) is also set during Google sign-in. The sign-in library sets it only when it is configured to use that check, and DayOneFlow's current configuration does not.]
Google sign-in
Where “Sign in with Google” is offered and you choose it, your browser goes to Google's own sign-in pages. Google's cookies and privacy policy apply there. DayOneFlow does not set, read or receive Google's cookies; it sets only the short-lived cookie listed above to protect your return.
Candidates and new hires
Candidates and new hires have no account. Their personal page opens from a private link that works without cookies: DayOneFlow sets none for it. Whoever holds the link can use it, so please keep it to yourself. The organization can revoke it and send you a new one.
Other browser storage
DayOneFlow does not use local storage, session storage or other browser storage, and no tracking pixels. What the web server records about each request is described in the Privacy notice.
Why there is no cookie banner
Because DayOneFlow sets only strictly necessary cookies, it does not show a cookie banner or ask for consent to cookies. [To confirm with counsel for each jurisdiction where DayOneFlow is offered.]
Managing cookies
You can see, block and delete cookies in your browser's settings. If you block these cookies, you cannot sign in to DayOneFlow; the public website and personal links still work without them. Signing out deletes the session cookie, and the other cookies expire as shown above.
Changes and contact
We update this policy when the cookies DayOneFlow uses change; the date above shows the current version. Questions about cookies or privacy: privacy@dayoneflow.com. How DayOneFlow handles personal data in general is explained in the Privacy notice.