effective on
Cookie and Tracker Policy
Lire la version française de référence
In the event of a discrepancy, the French version prevails, subject to any mandatory rules applicable to the customer. The reference version is available at
/fr/legal/cookie.
Version 2.2 — In force from 13 September 2026
1. Purpose
This policy explains how LinkyFlow uses cookies, local storage, pixels, scripts and similar technologies, collectively called "trackers", on the website and in the application.
A tracker may write or read information on your device. Some are necessary for the functioning you requested; others may only be enabled with your consent.
2. Controller and contact
The controller for the trackers placed for LinkyFlow's own purposes is GOLDEN F, 21 avenue Pasteur, 92400 Courbevoie, France. Contact: contact@linkyflow.com.
Some providers may act as separate controllers for their own services. Their role and their policy are stated in the inventory below.
3. Strictly necessary trackers
Strictly necessary trackers make it possible in particular to secure sign-in, maintain a session, prevent attacks, remember your privacy choice, balance load or run the checkout you request. They are not used to measure your audience for non-necessary purposes, nor for advertising.
They are enabled without consent where they are indispensable to the service expressly requested. You may block them in your browser, but some functions may then stop working.
4. Trackers subject to consent
Non-exempt audience measurement, product analytics, non-indispensable conversational support and marketing tracking trackers are only placed, read, and their providers only contacted, after your agreement for the purpose concerned.
That agreement is not obtained the same way everywhere, and this policy says so rather than suggesting a single mechanism:
- On the public website linkyflow.com, it is obtained through the banner described in section 5. Nothing optional loads until you have chosen, and refusing does not limit access to the essential functions.
- Inside the signed-in application — app.linkyflow.com and the Excel task pane — it follows from the acceptance of the Terms when the account is created, restated on the sign-in screen before the first click. The application therefore carries no banner: usage measurement and diagnostics are part of the service provided to the account holder, without which we can neither observe nor fix the faults they run into.
This account-level acceptance is confined to the application, where everyone present holds an account or is on the screen that tells them so. It covers no advertising, no resale, no profiling and no marketing: none of those exist at LinkyFlow, and the inventory in section 6 is exhaustive.
5. Your choice
On the public website. On your first visit, you may "Accept all", "Refuse all" or choose by purpose. The acceptance and refusal buttons are presented at the same level and with equivalent visual weight. Optional choices are off by default.
Your choice, whether an acceptance or a refusal, is kept for six months. You may change it or withdraw your consent at any time using the permanent "Manage my cookies" link in the footer and the button of the same name at the bottom of this page. Withdrawal is as simple as acceptance and stops the future processing concerned.
Closing the banner or continuing to browse without choosing is not treated as consent.
Inside the application. There is no banner and no withdrawal button, since the measurement follows the account. You may still object to it, or ask for the measurement data concerning you to be erased, by writing to contact@linkyflow.com: the request is handled manually, within the periods stated in the privacy policy. Closing the account ends that measurement.
6. Current inventory
The following table is the exhaustive inventory of the trackers that may be used in the current version of the Service. It is generated from the same list that drives the loading of the scripts: a tool absent from this table cannot load.
| Name and technology | Provider and domain | Purpose | Category | Data | Duration | Party | Consent | Scope | Policy |
|---|---|---|---|---|---|---|---|---|---|
lf-cookie-consent — localStorage | LinkyFlow (GOLDEN F) (linkyflow.com) | Remember your choice about optional trackers — acceptance as well as refusal. | Strictly necessary | The per-purpose choice and its timestamp. No identifier. | 6 months, after which you are asked again | First party | Exempt: indispensable to the requested service | public website | Policy |
lf-color-scheme — localStorage | LinkyFlow (GOLDEN F) (app.linkyflow.com) | Keep the light or dark appearance you chose. | Strictly necessary | The value light, dark or auto. | until you delete it | First party | Exempt: indispensable to the requested service | application | Policy |
lf_token — localStorage | LinkyFlow (GOLDEN F) (app.linkyflow.com) | Keep you signed in and authenticate your calls to the LinkyFlow API. | Strictly necessary | A signed session token carrying your account id and its expiry. No Provider credential. | until the token expires or you sign out | First party | Exempt: indispensable to the requested service | application | Policy |
__Secure-authjs.session-token — cookie | LinkyFlow (GOLDEN F) (app.linkyflow.com) | Keep your session open, including inside the Shopify admin. | Strictly necessary | An encrypted session identifier, in an httpOnly cookie no script can read. | 30 days | First party | Exempt: indispensable to the requested service | application | Policy |
__Host-authjs.csrf-token — cookie | LinkyFlow (GOLDEN F) (app.linkyflow.com) | Protect sign-in against requests forged from another site. | Strictly necessary | A random anti-CSRF token. | browsing session | First party | Exempt: indispensable to the requested service | application | Policy |
__Secure-authjs.callback-url — cookie | LinkyFlow (GOLDEN F) (app.linkyflow.com) | Return you to the page you asked for after signing in. | Strictly necessary | The originating internal URL. | browsing session | First party | Exempt: indispensable to the requested service | application | Policy |
__Secure-authjs.pkce.code_verifier, __Secure-authjs.state, __Secure-authjs.nonce — cookie | LinkyFlow (GOLDEN F) (app.linkyflow.com) | Secure the OAuth handshake with Google or Discord during sign-in. | Strictly necessary | Single-use random values. | 15 minutes | First party | Exempt: indispensable to the requested service | application | Policy |
chargebee.js et les cookies de la page de paiement Chargebee — cookie | Chargebee Inc. (js.chargebee.com, linkyflow.chargebee.com) | Open and secure the checkout page you request by clicking a subscription button. | Strictly necessary | A technical checkout session id. Card details are entered at Chargebee. | checkout session | Third party | Exempt: indispensable to the requested service | public website, checkout page | Policy |
_ga — cookie | Google Ireland Limited (linkyflow.com, app.linkyflow.com) | Distinguish visitors for Google Analytics 4 audience measurement. | Audience measurement | A pseudonymous browser identifier. | 2 years | Third party | Consent required (public website banner ; acceptance of the Terms at account creation) | public website, application | Policy |
_ga_<identifiant de flux> — cookie | Google Ireland Limited (linkyflow.com, app.linkyflow.com) | Keep the Google Analytics 4 stream session state. | Audience measurement | A session counter and a timestamp. | 2 years | Third party | Consent required (public website banner ; acceptance of the Terms at account creation) | public website, application | Policy |
ph_<clé de projet>_posthog — cookie | PostHog, Inc. (linkyflow.com, app.linkyflow.com) | Measure product usage: pages, screens and feature events. | Audience measurement | A pseudonymous id, the page and the event name. No secret, token or Provider data. | 1 year | Third party | Consent required (public website banner ; acceptance of the Terms at account creation) | public website, application | Policy |
__tawkuuid — cookie | tawk.to, inc. (embed.tawk.to) | Recognise a visitor from one support conversation to the next. | Conversational support | A visitor id and the visited domain. | 6 months | Third party | Consent required (public website banner) | public website | Policy |
TawkConnectionTime, twk_* — sessionStorage | tawk.to, inc. (embed.tawk.to) | Run the chat window and keep the thread of the current conversation. | Conversational support | The widget state and the messages you deliberately write. | browsing session | Third party | Consent required (public website banner) | public website | Policy |
7. Third-party services and checkout
When you open a page hosted by a third party, in particular a Chargebee checkout or a Provider authorisation journey, that third party may use its own trackers necessary for the page it controls. Before the redirection, LinkyFlow clearly indicates that you are leaving its domain where this is not obvious. The third party's policy applies on its domain.
8. Browser settings
Your browser also allows trackers to be deleted or blocked. Those settings do not prevent LinkyFlow from honouring the choice recorded in its own manager, and they may disable necessary functions.
9. Changes
The inventory is updated before a new tracker or a new purpose is enabled. Where a new consent is necessary, the tracker stays blocked until you have made a choice.
10. Contact
For any question: contact@linkyflow.com.