Instaflow Cookie Policy
Last updated: 11 November 2026
This policy explains the cookies and similar technologies (such as local storage) used on three places: our marketing website at instaflow.ai, the Instaflow app at app.instaflow.ai, and the landing pages we host for our Merchants. Our website sets no cookies. The app uses cookies mainly to keep you signed in and remember your settings. On Merchants' landing pages, analytics only run after the shopper agrees through the shop's Shopify cookie banner, and the Merchant controls that banner.
1. Who we are
This policy is issued by Propeller Digital Limited, trading as Instaflow ("Instaflow", "we", "us"), a company registered in Ireland under number 784240, with its registered office at Unit 20, Platform 94, Mervue Business & Technology Park, Wellpark Road, Galway, H91 F9PX, Ireland. Questions: privacy@instaflow.ai.
In this policy:
- Merchant means a business that uses Instaflow to build and publish landing pages.
- Visitor means a shopper or other person who visits a landing page a Merchant has published.
Read this policy together with our Privacy Policy, which explains how we use personal data and your rights.
2. What cookies and similar technologies are
Cookies are small text files a website stores in your browser. They let the site recognise your browser on later requests, for example to keep you signed in.
Local storage and session storage are similar browser features that let a site store information on your device. Session storage is cleared when you close the browser tab. Local storage stays until it is removed.
Software development kits (SDKs) and widgets are pieces of code from another company that run on a page and may store or read information on your device.
In this policy, "cookies" covers all of these. Under the Irish ePrivacy Regulations (S.I. No. 336/2011), a website needs your consent to store or read information on your device, unless it is strictly necessary to provide a service you asked for, or is needed only to carry a communication.
First-party cookies are set by the site you are visiting. Third-party cookies are set by another company.
3. The marketing website (instaflow.ai)
Our website sets no cookies and runs no analytics or advertising scripts.
It uses two local storage keys to remember display choices you make. This information stays in your browser and isn't sent to us.
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
instaflow-theme |
Local storage | Instaflow (first party) | Remembers your light or dark theme choice | Until you clear it | No (strictly necessary for the setting you chose) |
instaflow-motion |
Local storage | Instaflow (first party) | Remembers whether you paused animations | Until you clear it | No (strictly necessary for the setting you chose) |
Google Fonts. The website loads its fonts from Google's servers (fonts.googleapis.com and fonts.gstatic.com). This sends your IP address and browser details to Google when the page loads. We have not set any cookies through this. See Google's privacy policy for how Google handles this data.
4. The Instaflow app (app.instaflow.ai)
4.1 Strictly necessary cookies
These are needed to sign you in, keep your account secure and connect your Shopify store. The app can't work without them, so they don't need consent.
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
auth-session |
Cookie (HTTP-only, secure) | Instaflow | Keeps you signed in | 30 days, renewed while you use the app | No |
password_reset_session |
Cookie (HTTP-only) | Instaflow | Runs the password reset process | 10 minutes | No |
google_oauth |
Cookie (HTTP-only, secure on HTTPS) | Instaflow | Protects the "Continue with Google" sign-in against forgery and returns you to the right page afterwards | 10 minutes | No |
shopify_oauth_state |
Cookie (HTTP-only, signed) | Instaflow | Protects the Shopify connection process against forgery | 10 minutes | No |
shopify_connection_intent |
Cookie (HTTP-only, signed) | Instaflow | Remembers that you started connecting a Shopify store from the app | 1 hour | No |
shopify_install_intent |
Cookie (HTTP-only, signed) | Instaflow | Carries a Shopify app install through to signing up or signing in | 1 hour | No |
shopify_oauth_result |
Cookie (HTTP-only) | Instaflow | Shows you a one-time message about the result of connecting Shopify | 60 seconds | No |
agentic-chat-v2:{chatId}:{userId}:message:{id} and agentic-chat-v2:{chatId}:{userId}:retry:{id} |
Local storage | Instaflow | Keeps a chat message you sent (including its text) until our server confirms it, so it can be resent without being duplicated | Removed once sent; otherwise kept until cleared | No |
landing-page-generation:idempotency-key:{store}:{product}:{hash} |
Local storage | Instaflow | Stops the same page from being generated twice | Removed when the generation succeeds | No |
4.2 Preference cookies
These remember choices you make in the app's interface. They are written when you make the choice.
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
sidebar:state and sidebar:editor |
Cookie | Instaflow | Remembers whether the sidebar is open or closed | 7 days | No (remembers a choice you made) |
workspace-layout |
Cookie | Instaflow | Remembers the width of the chat panel | 7 days | No (remembers a choice you made) |
theme |
Local storage | Instaflow | Remembers your light or dark theme | Until you clear it | No (remembers a choice you made) |
selectedStoreId |
Local storage | Instaflow | Remembers the store you last selected | Until you clear it | No (remembers a choice you made) |
4.3 Bot protection (Cloudflare Turnstile)
When you sign up, the signup page loads Cloudflare Turnstile, a check that tells people and bots apart. Cloudflare may store or read information in your browser to run the check, and it receives your IP address. We use it to stop fraudulent and automated sign-ups.
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
| Cloudflare Turnstile | Third-party widget | Cloudflare | Bot check on the signup page | Nothing stored: Turnstile doesn't set cookies, it reads browser signals during the check | No (strictly necessary for security of the sign-up you requested) |
4.4 Error tracking and session replay (Better Stack)
If you accept cookies in the app's cookie banner, the app loads Better Stack's JavaScript tag, which sends data to our error-tracking provider Better Stack in the United States (US West). We don't load the tag unless you accept, and you can change your choice at any time with the "Cookie settings" link in the app. Depending on its settings, the tag can collect:
- errors in the page;
- session replays: a reconstruction of what happened on the page, such as page changes, clicks and scrolling, so we can see what led to an error;
- web vitals (page speed measurements) and console logs;
- web analytics events;
- anonymous clicks and form submissions; and
- a browser fingerprint, which can recognise the same browser across visits.
The tag's settings are configured in Better Stack, not in the app. It records replays of every session in which you accepted the tag, and masks the text and form inputs shown on screen. The app does not tell Better Stack who you are: it doesn't send your name, email address or user ID to the tag. To work, the tag may store information in your browser.
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
_bs (holds a session ID and an anonymous visitor ID) |
Cookie (first party) | Better Stack's JavaScript tag, for Instaflow | Error tracking, session replay, web vitals and analytics | 2 years | Yes |
Error reports from our servers also go to Better Stack, with minimal data: they leave out user details, cookies, request bodies and IP addresses. They don't store anything in your browser.
5. Landing pages we host for Merchants
5.1 Who is responsible
Merchants use Instaflow to publish landing pages for their Shopify stores, at {brand}.instaflow.cc/{page} or on the Merchant's own subdomain. On these pages, the Merchant is the controller of the Visitor's personal data, and we act as the Merchant's processor. Shopify runs the cart and checkout and is an independent controller of the data it collects.
The Merchant manages the cookie banner through Shopify. On pages of stores connected through our Shopify app, the page loads Shopify's privacy banner and uses Shopify's Customer Privacy API to find out whether the Visitor has allowed analytics. The Merchant sets up the banner and decides where it appears in its Shopify settings. Shopify, not Instaflow, decides in which regions consent is asked for, based on the Merchant's settings.
Each page's footer has a "Cookie preferences" button, where Visitors can change their choice, and a link to the store's own privacy policy. If you are a Visitor with a question about your data, please contact the Merchant first.
Pages of stores that are not connected through our Shopify app load no analytics, no Shopify analytics cookies and no cookie banner. They set only the essential cart cookie.
5.2 Essential cookie
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
instaflow_cart_{shop} (where {shop} is the store's domain) |
Cookie (first party, secure on HTTPS) | The page, on behalf of the Merchant | Remembers the Visitor's Shopify cart so items stay in the cart and checkout works | 10 days | No (strictly necessary for the cart the Visitor uses) |
5.3 Analytics (only after consent)
These are set only after Shopify's Customer Privacy API reports that the Visitor has allowed analytics. If the Visitor hasn't allowed analytics, or if the Shopify API isn't available, our analytics script doesn't run, and events waiting to be sent are dropped. We use the information only to give the Merchant analytics about its page.
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
instaflow_visitor_id |
Cookie (first party) | Instaflow analytics script, for the Merchant | A random ID that recognises a returning Visitor's browser, so the Merchant can count visitors and measure sales from the page | 180 days | Yes |
instaflow.visitor_id |
Local storage | Instaflow analytics script, for the Merchant | Copy of the same random visitor ID and its expiry date | 180 days | Yes |
instaflow.session_id |
Session storage | Instaflow analytics script, for the Merchant | A random ID that groups events from one visit | Until the browser tab is closed | Yes |
With these IDs, the script sends page views, product views, add-to-cart and begin-checkout events, with page address (including campaign tags), page title, referrer and product, cart and price details, to our analytics service. We don't store the Visitor's IP address in analytics: we keep only the approximate location (country, region and city). We don't store the full browser user agent: we keep only the device, browser and operating system type. Raw events are deleted after 1 day; aggregated analytics are kept for 25 months. Our Privacy Policy (section 6) gives more detail.
5.4 Shopify cookies
The page also sends page view and add-to-cart events to Shopify's analytics, so that the Merchant's Shopify reports include visits from the landing page. Shopify sets these cookies:
| Name | Type | Set by | Purpose | Duration | Consent needed? |
|---|---|---|---|---|---|
_shopify_y |
Cookie | Shopify (through Shopify's code on the page) | Shopify analytics: recognises a returning Visitor | 360 days | Yes. Set only after consent; deleted otherwise |
_shopify_s |
Cookie | Shopify (through Shopify's code on the page) | Shopify analytics: groups a single visit | 30 minutes | Yes. Set only after consent; deleted otherwise |
_shopify_analytics |
Cookie | Shopify (through Shopify's code on the page) | Shopify analytics | 1 year | Yes. Set only after consent |
_shopify_cmp |
Cookie | Shopify (through Shopify's privacy banner) | Remember the Visitor's cookie choices | 1 year | No (stores the consent choice) |
For more about these cookies, see Shopify's cookie policy.
6. Global Privacy Control
Global Privacy Control (GPC) is a signal some browsers send to tell websites you don't want your data sold or shared.
- Instaflow website and app: these don't sell or share personal data for advertising, so GPC doesn't change how they behave.
- Merchants' landing pages: if your browser sends GPC, the page tells Shopify that data sale or sharing is not allowed, and shows an "Opt out of data sale or sharing" button in the footer. GPC does not currently turn off the page's analytics (our analytics script or Shopify's analytics). Analytics depend only on your choice in the Shopify cookie banner. To turn off analytics, use the "Cookie preferences" button in the page footer.
7. How to manage cookies
- App: the app sets only the cookies in section 4. You can delete them in your browser, but you'll be signed out and your interface settings will reset. The app asks for your consent before loading Better Stack's tag (section 4.4). You can change your choice at any time with the "Cookie settings" link in the app.
- Landing pages: use the "Cookie preferences" button in the page footer to give or withdraw consent at any time. Withdrawing is as easy as giving consent.
- Browser settings: most browsers let you see, block and delete cookies and clear local and session storage. Blocking all cookies may stop the app and the shop cart from working. Browser settings don't by themselves count as consent.
- For general information about cookies, see www.allaboutcookies.org.
8. Changes to this policy
We will update this policy when the cookies we use change, and change the "Last updated" date at the top. If a change means we need new consent, we will ask for it before using the new cookie.
9. Contact us
Propeller Digital Limited (trading as Instaflow) Unit 20, Platform 94, Mervue Business & Technology Park, Wellpark Road, Galway, H91 F9PX, Ireland Registered in Ireland, number 784240 Email: privacy@instaflow.ai
You can also complain to the Data Protection Commission at www.dataprotection.ie.
Portions of this policy were adapted from a template prepared and made publicly available by General Legal, PC ("General Legal"). The template is provided for general reference purposes only and does not constitute legal advice. General Legal has not reviewed, and takes no position on, any modifications made to this document.