Platform · Legal
Cookie Policy
Version of 5 August 2026
What changed: Web fonts are now self-hosted, so no request reaches Google's font CDN and no visitor IP address is disclosed to Google before a cookie choice is made.
This policy covers glowflow.online and every clinic website running on the GlowFlow platform. It describes exactly what is stored in your browser, and what is not.
What we actually use
| What | Type | Purpose | Lifetime |
|---|---|---|---|
| Supabase authentication token | Local storage (strictly necessary) | Keeps clinic staff and portal users signed in. | Until sign-out or expiry |
| glowflow.cookie-consent.v1 | Local storage (strictly necessary) | Remembers your answer to the cookie banner so we don't ask again. | Until you clear it |
| Booking draft and slot hold | Session storage (strictly necessary) | Keeps your selected treatments and held time slot while you complete a booking. | Until the tab is closed |
| Google Ads gtag.js (AW-18098432312) | Third-party script and cookies (optional) | Measures whether a Google advert led to a booking. Loaded only after you click Accept. | Set by Google; up to 90 days |
Consent is real, not decorative
The Google Ads tag is not present in the page we send you. It is injected by the browser only after you actively accept optional cookies. If you decline, or simply never answer the banner, no request is made to Google and no conversion is recorded. The site works exactly the same either way.
Fonts are served from this site, not from Google
The typefaces used here (Inter and Playfair Display) are stored on this site's own domain and served with the page. No request is made to Google's font servers, so your IP address and browser details are never disclosed to Google merely by opening a page — not before you answer the cookie banner, and not after.
What we do not use
- No Google Analytics, and no general web-analytics product.
- No advertising or retargeting pixels other than the Google Ads conversion tag described above.
- No social-media tracking pixels.
- No cross-site profiling, and no sale of browsing data.
- No web fonts loaded from a third-party CDN.
Separately from cookies: if the application hits an unexpected error, a diagnostic report containing the error and the page you were on is sent to our hosting provider's error reporting so we can fix the fault. It is listed on the sub-processor page.
Changing your choice
Clear this site's data in your browser, or delete the glowflow.cookie-consent.v1 entry from local storage. The banner then reappears on your next visit and you can choose again. Declining after previously accepting stops the tag loading on subsequent page loads; to remove cookies Google has already set, clear cookies for google.com in your browser settings.
More detail
Which third parties receive information, and where, is set out on our sub-processor page, and the wider picture is in our privacy policy. Questions: admin@glowflow.online.