Cookies & Tracking — Invoice Flow

This page covers the website invoiceflow.management only. The Invoice Flow Android app does not use cookies — see the privacy policy for how the app measures usage.

1. What we use

The site loads a Google Tag Manager container, which in turn loads Google Analytics 4. There is no advertising pixel, no remarketing tag, no social-network tracker and no third-party ad network on this site.

2. The cookies

Cookie	Set by	Purpose	Lifetime
`_ga`	Google Analytics	Distinguishes one browser from another so repeat visits are not counted as new people	2 years
`_ga_<container>`	Google Analytics	Keeps session state for the GA4 property	2 years
Local storage key `stay`	This site	Remembers that we already redirected you to your language once, so the language picker does not fight your choice. Strictly functional, no tracking	Until the tab is closed

If Cloudflare is in front of the site, it may additionally set its own security cookie (__cf_bm or similar) to tell humans from bots. That is a strictly necessary cookie and carries no analytics data.

3. What is measured

We record how content is used, never who you are. The events are:

Pageviews — URL, page type, page language, category.
Scroll depth — whether you reached 25/50/75/90/100% of a page, so we know if an article is actually read to the end.
Reading time — how many seconds the tab was visible, reported at 15/30/60/120/300-second marks.
Clicks on the Google Play buttons — which button, on which page, in which language.
Site search — the search term typed into the site search box and how many results it returned. Do not type personal information there.
Navigation clicks — language switches, menu links, article and blog cards.
Outbound clicks — the domain of an external link you follow.

No name, email address, invoice content or account identifier is ever part of these events. IP anonymisation is on by default in Google Analytics 4, and we do not enable Google Signals or advertising features.

4. Turning it off

Decline analytics in the consent banner shown on your first visit; your choice is remembered and can be reopened from the banner control. TODO(owner): the consent banner is not implemented yet. Until a Consent Mode v2 banner is deployed, GTM must be configured to keep analytics storage denied for visitors from the EU/EEA and the UK.
Install the Google Analytics opt-out browser add-on.
Block cookies for this site in your browser settings, or use a content blocker. Nothing on the site breaks if you do — no page here depends on analytics.
Send a Do Not Track or Global Privacy Control signal; we honour it by not loading analytics.

5. Retention

Event-level analytics data is kept for a maximum of 14 months and then deleted by Google Analytics. Aggregate reports may be kept longer, but they contain no individual-level data.

6. Third-party policies

Google Privacy Policy · How Google uses cookies

7. Contact

Questions about tracking on this site: [email protected]