Cookie Policy
Effective date: April 2, 2026
1. What Are Cookies
Cookies are small text files stored on your device by your browser. ChapterFlow uses a minimal set of cookies that are essential to the operation of the Service. We do not use cookies for advertising or third-party tracking.
2. Essential Cookies
These cookies are required for ChapterFlow to function and cannot be disabled.
| Cookie | Purpose | Duration |
|---|---|---|
| id_token | Authentication session (JWT from AWS Cognito). Secure, httpOnly. | 1 hour |
| access_token | API authorization token. Secure, httpOnly. | 1 hour |
| refresh_token | Silently renews your sign-in session — it is exchanged for fresh id/access tokens before they expire so you are not signed out every hour. Secure, httpOnly. | 30 days |
| auth_expires_at | Session expiry timestamp for proactive session management. Client-readable (not httpOnly). The stored value is the current access-token expiry (about 1 hour out), while the cookie itself persists for the full refresh window so the client can detect an expired session and renew it. | 30 days |
| cf_device | Randomly generated device identifier for abuse prevention. An opaque random value that does not contain personal information. | 1 year |
During sign-in, transient cookies (pkce_verifier, oauth_state, post_auth_redirect) are briefly set and immediately cleared after the authentication callback completes. These never persist beyond the login flow.
3. Functional Cookies
These cookies support optional features and improve your experience.
| Cookie | Purpose | Duration |
|---|---|---|
| cf_ref | Tracks referral attribution when you sign up through an invite link. Used to credit Insight Points to the referrer. | 30 days |
| cf_acq_ref, cf_acq_us, cf_acq_um, cf_acq_uc | First-party attribution. Briefly record how you reached ChapterFlow (the referring page and any utm_source / utm_medium / utm_campaign parameters on the link you followed) so that source can be saved to your account when you finish onboarding. These are first-party only — they are never shared with advertisers and are not used for cross-site tracking. | 30 minutes |
4. Local Storage and Session Storage
ChapterFlow uses browser local storage to persist your preferences and app state locally for performance. This data stays on your device. Some preferences are also synced to the server so they persist across devices.
- Reading preferences (font size, theme, learning mode, accessibility settings)
- Onboarding progress and selected interests
- Chapter reader state (current tab, quiz answers, scroll position)
- Daily reading activity tracking
- Dashboard and viewer state cache
- Badge and achievement data
- Analytics consent preference
- Query cache for offline resilience
Session storage is used minimally for transient state such as post-checkout status flags. It is cleared when you close your browser tab.
5. What We Do Not Use
- No third-party advertising cookies
- No cross-site tracking pixels
- No analytics cookies from Google Analytics or similar services
6. Managing Cookies
You can manage or delete cookies through your browser settings. Note that disabling essential cookies will prevent you from signing in to ChapterFlow. For more information about managing cookies in your browser, visit your browser's help documentation.
7. Contact
For questions about our use of cookies, contact us at support@chapterflow.ca.