Cookies and local storage
Last updated: 9 October 2026 · Version: 2026-10-09
This page lists everything that the current Innflyt websites, dashboard and widget store on your device, and every script from another provider that reads information from it. Innflyt uses no advertising, tracking or analytics cookies or scripts.
Why there is no consent banner. Under the Norwegian Electronic Communications Act (ekomloven, section 3-15), storing information on your device, or gaining access to information already on it (including by a script that has your browser send information), needs your consent, except where it is strictly necessary to provide a service you have explicitly asked for. On Innflyt, every item stored on your device is either needed for something you asked for (signing in, keeping your account secure) or remembers a choice you made yourself (language, theme, layout, closing a notice). The only script from another provider is Cloudflare Turnstile, which runs only on the dashboard's sign-in and sign-up forms to protect the sign-in you asked for. Innflyt runs no analytics or error-reporting scripts in your browser. Because everything listed is strictly necessary in that sense, no consent is needed and there is no consent banner. Items marked "only when you choose" are not written until you make that choice.
The Innflyt widget on a customer's website
The widget sets no cookies. It uses one entry in the browser's local storage, on the website where it is installed:
| Name | Purpose | When it is written | Type | How long |
|---|---|---|---|---|
innflyt_beta_notice | Remembers that you closed the beta notice, so it does not appear on every page | Only when you choose | Local storage, first party (the customer's website) | Until you clear the site's data |
Earlier versions of the widget could also store innflyt_anonymous_email. The current widget never writes it, and deletes it if it finds it when you open the feedback panel.
innflyt.com and innflyt.no
The server sets no cookies. A plain visit stores nothing on your device.
| Name | Purpose | When it is written | Type | How long |
|---|---|---|---|---|
innflyt-locale | Remembers whether you chose English or Norwegian | Only when you choose | Cookie, first party | 1 year |
innflyt-theme | Remembers whether you chose a light, dark or system theme | Only when you choose | Local storage, first party | Until you clear the site's data |
innflyt_beta_notice | Our own feedback widget runs on these websites; see above | Only when you choose | Local storage, first party | Until you clear the site's data |
The dashboard (app.innflyt.com and app.innflyt.no)
| Name | Purpose | When it is written | Type | How long |
|---|---|---|---|---|
sb-…-auth-token (may be split into numbered parts) | Keeps you signed in. Readable only by the server | When you sign in | Cookie, first party, HttpOnly, Secure | Up to 30 days; deleted when you sign out |
innflyt-attempt | Ties the sign-in code we email you to the browser where you asked for it. Readable only by the server | When you ask for a sign-in code | Cookie, first party, HttpOnly, Secure | 10 minutes |
innflyt-webauthn | Holds a reference to the server's challenge while you sign in or add a passkey. Readable only by the server | When you use a passkey | Cookie, first party, HttpOnly, Secure | 5 minutes |
innflyt-device | A random identifier for this browser, so we can tell you by email when a device you have not used before signs in to your account. Readable only by the server; we store only a hash of it | When you sign in | Cookie, first party, HttpOnly, Secure | 400 days |
innflyt-org | Remembers which of your organisations you opened last. Readable only by the server and checked against your memberships on every request | When you open an organisation | Cookie, first party, HttpOnly, Secure | 1 year |
innflyt-passkey-offer | Remembers that you chose "Not now" when offered a passkey, so this device does not ask again after every email sign-in | Only when you choose | Cookie, first party | 30 days |
innflyt-locale | Interface language | Only when you choose | Cookie, first party | 1 year |
innflyt-theme | Light, dark or system theme | Only when you choose | Local storage, first party | Until you clear the site's data |
innflyt:projectView | Remembers whether you view your projects as a list or a grid | Only when you choose | Local storage, first party | Until you clear the site's data |
innflyt_beta_notice | Our own feedback widget runs in the dashboard; see above | Only when you choose | Local storage, first party | Until you clear the site's data |
The sign-in and security cookies are strictly necessary to provide the account you asked for and to keep it secure. The others remember choices you made.
Browsers that used the dashboard before October 2026 may still hold items from earlier versions of it. Innflyt no longer reads or writes them, and you can delete them in your browser's settings.
Security check on the sign-in forms
One service from another provider runs in your browser, and only on the dashboard's sign-in and sign-up forms. It sets no cookie on Innflyt's domains and writes nothing to Innflyt's storage in your browser; it runs in a frame served from Cloudflare's own domain. The personal data it handles is described in the Privacy Policy.
| Service | Where | What it does |
|---|---|---|
| Cloudflare Turnstile | Dashboard sign-in and sign-up forms | Reads technical signals from your browser to check that a person, not a program, is signing in, so that sign-in stays secure. Cloudflare processes the signals for us, and as a controller to improve its bot detection (Cloudflare Turnstile Privacy Addendum) |
The websites and the dashboard load no analytics or error-reporting scripts. Errors are reported only from our servers.
What we do not do
- No advertising or marketing cookies, and no data sold or shared with advertisers.
- No tracking across sites, no fingerprinting for tracking, no session recording or heatmaps.
Managing what is stored
Your browser lets you see and delete cookies and local storage for each site, usually under Privacy or Site settings. Deleting the dashboard cookies signs you out; deleting the others resets your choices.
Questions
Write to privacy@innflyt.com. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).
Backroad AS · organisation number 934 341 929 · Måseskjæret 18, 5035 Bergen, Norway