Cookies
fluah.com sets only the cookies it needs to log you in and keep your account safe.
Last updated 6 November 2026
At a glance
- Essential onlyLogging in and security
- No analyticsNo visitor counting
- No advertisingNo pixels, no retargeting
- Nothing soldOr shared with anyone
fluah.com's cookies
Each is set only when you log in or start to. Each is HttpOnly (no script can read it), Secure (sent only over HTTPS) and kept to fluah.com: no other site, docs.fluah.com included, ever receives it. docs.fluah.com sets no cookies of its own.
| Cookie | What it does | How long |
|---|---|---|
__Host-fluah_session | Keeps you logged in | Until you close the browserWith Keep me logged in: until you log out, 30 days at most |
__Host-fluah_device | Remembers a browser that entered an emailed code, so it is not asked for one every time | Until you close the browserWith Keep me logged in: 30 days, or until you log out |
__Host-fluah_flow | Holds a log-in step under way: the emailed code, or a new account through Google, Microsoft or Apple | 30 minutes |
__Host-fluah_oauth | Holds a sign-in with Google, Microsoft or Apple while it is under way | 10 minutes |
The payment page
Buying Fluah Pro at fluah.com/account/purchase loads Stripe's card form, the only page that does. Stripe sets two cookies there to stop card fraud.
| Cookie | What it does | How long |
|---|---|---|
__stripe_mid | Stripe: recognises a browser across payments, to spot fraud | 1 year |
__stripe_sid | Stripe: the same, for one visit | 30 minutes |
Stripe's card form runs in Stripe's own frames. They keep a cookie on Stripe's domain (m, 2 years) and can run an hCaptcha check against card testing. Both fall under Stripe's cookie policy.
Cloudflare
fluah.com and docs.fluah.com reach you through Cloudflare, which shields them from attacks. Today Cloudflare sets no cookies on either. If it ever has to check that a visit comes from a person, it can set these.
| Cookie | What it does | How long |
|---|---|---|
__cf_bm | Cloudflare: tells people from automated traffic | 30 minutes |
cf_clearance | Cloudflare: remembers that a visit passed its check | 30 minutes |
Cloudflare lists every cookie it can set on its cookies page.
In your browser
A few small notes stay in your browser's own storage. None of them leaves your computer.
| Name | What it does | How long |
|---|---|---|
fluah.period | Monthly or Yearly, as you picked it on Pricing or Plan | Until the tab closes |
fluah-invite | An invitation's link while you log in to accept it | Until the tab closes |
fluah-auth | Passes a Google, Microsoft or Apple sign-in from its window to the page | Removed at once |
Browser check at log in. When you log in, the page turns your browser's details (browser, language, screen size, time zone) into a one-way code and sends it with your password or emailed code. It is used only to recognise a browser you have already checked and to spot unusual log-ins, never for advertising.
What we don't do
- No analytics: no Google Analytics or anything like it
- No advertising, retargeting or social media pixels
- No fonts, videos or scripts from other sites, apart from Stripe's card form
- No selling or sharing of what a cookie holds
Your choices
Leave Keep me logged in unticked when you log in, and closing the browser logs you out. Block or delete cookies in your browser's settings at any time: every page still reads without them; logging in and paying need them. As every cookie here is essential, there is nothing else to switch off on this site.
Changes and contact
If fluah.com ever needs a cookie that is not essential, we will update this page first and ask you before it is set.
fluah.com is run by Thessova. Questions: [email protected]. Our Privacy Policy covers the rest.