Legal
Cookies policy
This site uses three essential cookies. There are no advertising, analytics, or cross-site tracking cookies, so there is no cookie consent banner to dismiss.
Last updated: November 11, 2026
What cookies are
Cookies are small text files a website can store in your browser. They can keep you signed in, remember preferences, or track activity across sites. We only use essential first-party cookies.
Cookies we use
| Name | Purpose | Type | Duration |
|---|---|---|---|
everflow_session | Keeps a signed-in operator authenticated. It contains an HMAC-signed random session token, not your password. | Essential, first party, HTTP-only, SameSite Lax | 14 days maximum, 24 hours without activity |
everflow_device | Recognizes a browser that has signed in before, so a new-device alert is not sent on every login. It contains an opaque random value, not your password or session token. | Essential, first party, HTTP-only, SameSite Lax | 1 year |
everflow_2fa | Holds a short-lived challenge after a correct password when two-factor authentication is enabled. It is replaced by the session cookie only after a valid authenticator or recovery code. | Essential, first party, HTTP-only, SameSite Lax | 10 minutes |
These cookies are only set during operator dashboard sign-in. Visitors reading the public website or using a chat assistant do not receive them.
What we do not use
- No analytics cookies or tags.
- No advertising or retargeting pixels.
- No social media tracking embeds.
- No third-party fonts, which avoids a third-party font request.
- No browser fingerprinting script.
Embedded assistants
A client website can embed an EverFlow assistant in an iframe. The assistant keeps the current conversation identifier in the page memory so it can continue the conversation. It does not set advertising cookies or track visitors across sites.
Managing cookies
You can clear or block cookies in your browser settings. Blocking the session cookie prevents sign-in to the operator dashboard, but the public website continues to work. Blocking or clearing the device cookie only makes the browser new again for login alerts. The 2FA challenge cookie is temporary and expires after ten minutes. Instructions are available in your browser's help pages.
If this changes
If we add a non-essential cookie, tag, or third-party embed, we will update this page and add a consent mechanism before it is used. Questions about this policy are handled under your service agreement.
These policies describe how EverFlow Automations operates and are reviewed as the business changes.