Cookie Policy
The quick summary
The player sets one first-party cookie, pf_viewer_<workspace>, to count unique viewers for the video owner's analytics. It lasts 13 months and holds no personal details.
1What this policy covers
In this policy, 'Playflow', 'we' and 'us' mean the company that operates the Playflow service together with its parent company, subsidiaries, affiliates, successors and assigns. Playflow is the controller of the personal data described here.
We use cookies and browser storage to provide the Playflow website and application, protect accounts, remember a small number of named preferences, and measure video playback. On our production website and application, Google Analytics measures page visits and selected signup-funnel actions through Google Tag Manager. We do not use advertising cookies.
2Cookies and browser storage we use
The following inventory describes the measured behavior of the product. A cookie marked HttpOnly cannot be read by browser scripts. SameSite Lax limits when the browser sends it in cross-site requests.
| Name | Set by | Purpose | Lifetime | Strictly necessary |
|---|---|---|---|---|
better-auth.session_token, with a __Secure- prefix on HTTPS | Better Auth | Maintains an authenticated account session. | 7 days | Yes |
better-auth.state, with a __Secure- prefix on HTTPS | Better Auth | Protects an OAuth sign-in transaction. | 5 minutes | Yes |
vid_workspace | Playflow | Remembers the selected workspace for the application. | 30 days | Yes |
vid_platform_impersonation | Playflow | Marks a support impersonation session. | Until session expiration | Yes |
sidebar_state | Playflow app | Remembers whether the application sidebar is open. | 7 days | No, named preference |
playflow:trial-converted-banner:{workspaceId}:{convertedAt} | Playflow app | Prevents a trial completion notice from repeating. | Until cleared by the app | No, named preference |
playflow:storage-usage-banner:{workspaceId}:warning | Playflow app | Prevents a storage warning from repeating. | Until cleared by the app | No, named preference |
pf_brand_draft and pending-signup-* | Playflow app | Carries branding and signup choices into workspace setup. | Until signup completes or is cleared | No, named preference |
vid_analytics_v4_{videoId}_{eventId} | Playflow player | Queues playback events before sending analytics. | Until delivered or cleared | No, analytics queue |
pf_viewer_{workspacePublicId} | Playflow app origin, one workspace | Counts distinct video viewers; Secure, HttpOnly, SameSite None. Session-only fallback for blocked cookies or Do Not Track. | 13 months | No, playback analytics |
| Onboarding session state | Playflow app | Resumes the current onboarding step. | Session | No, product state |
Better Auth does not set a separate CSRF cookie in this product. It protects authentication requests with origin checks and uses the short-lived OAuth state cookie for sign-in callbacks. The Better Auth state and session cookies are HttpOnly and SameSite Lax. The vid_workspace and vid_platform_impersonation cookies are HttpOnly and SameSite Lax. sidebar_state is readable by the app and stores only the sidebar preference.
3Video player behavior
The analytics grant sets pf_viewer_{workspacePublicId} on the Playflow app origin to count distinct viewers within one workspace. This random identifier lasts 13 months and is Secure, HttpOnly and SameSite None, with path /. Credentialed analytics requests confirm that the browser accepted the cookie before using it. When cookies are blocked or Do Not Track is on, playback analytics use only the current session identifier; no persistent viewer cookie is created or used under Do Not Track. Watch pages, embeds and the in-app detail player send playback events; customization previews stay silent.
4Third parties
Bunny, our video infrastructure provider, and Resend, our email provider, set no Playflow product cookies. Google authentication uses Better Auth state and session cookies. Stripe may set cookies only on Stripe-hosted pages, which are governed by Stripe's own notices.
Partnero uses the first-party partnero_partner cookie to attribute new signups to referring affiliates, and Playflow uses a short-lived pf_partnero_signup cookie to carry verified new-signup attribution across authentication redirects.
5Your controls
You can block, delete, or limit cookies through your browser settings. Blocking strictly necessary cookies can prevent sign-in, security checks, workspace selection, or billing from working. You can clear named browser preferences and product storage through your browser's site-data controls. Do Not Track is honored by the edge player as described above. Playflow stores no docs search or theme storage.
This inventory includes necessary account cookies, named preferences and the workspace-scoped playback analytics cookie. We do not set advertising cookies.
Questions
Write to us and we will answer. We would rather explain something than have you guess.
Playflowprivacy@getplayflow.co
getplayflow.co/contact