Legal
Last updated: 31 August 2026
Flirtly sets five cookies. Four of them are the service working — signed in, past the age gate, and not asked the same question twice. One of them is not, and that one asks first. There is no advertising cookie, no analytics cookie, and no third-party cookie of any kind.
| Cookie | What it does | Lifetime | Strictly necessary |
|---|---|---|---|
| flirtly.session_token | Keeps you signed in after you enter a one-time code. Without it every page load is a stranger. | 30 days, extended while you keep using the service | Strictly necessary |
| flirtly.age_attest | Records that your account confirmed it is 18 or over, signed at the edge so it cannot be forged or hand-written. It is why the age gate does not ask again on every page. | 365 days | Strictly necessary |
| flirtly.age_ack | The same acknowledgement for a visitor who has not signed up yet, so the storefront can suppress its own age overlay without a server round trip. It entitles nothing: no content is served on it. | 365 days | Strictly necessary |
| flirtly.cookie_consent | Records your answer to the cookie banner, so we stop asking. It remembers a refusal exactly as durably as it remembers an acceptance. | 180 days | Strictly necessary |
| flirtly.ref | Records which partner or friend link brought you here, so a referral can be credited to them. | 90 days | No — written only with consent |
Two details the table would hide. The session cookie is served with a __Secure- prefix over HTTPS and travels with a short-lived signed cache cookie, flirtly.session_data, that holds the same session for a few minutes so every page load does not hit the database — it is part of the session, not a separate purpose. And all of them are first-party: set by flirtly.co, readable only by flirtly.co, sent to nobody else.
flirtly.ref is the only non-essential cookie on this service. It is written when you arrive through a partner or friend link, and it is what lets us credit that person if you later sign up. It is not needed to chat, to sign in, or to see anything here.
So it is not written until you say yes. Arriving through a referral link before you have answered the banner records nothing in your browser — there is no deferred write and no queue that replays after you accept. If you refuse, the click is simply not attributed and the partner who sent you is not paid for it. That is the honest consequence of refusing, and it costs you nothing.
If your browser sends a Sec-GPC: 1 header, we treat it as a refusal. The referral cookie is not written, whatever the banner was told previously — a signal you are sending now beats a click from six months ago, which is the whole point of the requirement. Only the literal value 1 is a refusal; Sec-GPC: 0 is an explicit non-refusal and is not consent either.
We do not sell or share personal data in the first place, so there is nothing else for the signal to switch off. We honour it against the one cookie it can meaningfully apply to.
No advertising or retargeting cookie. No analytics vendor — there is no Google Analytics tag, no Meta pixel, no session-replay script and no third-party tag manager anywhere on this site. No cookie set by a domain other than ours. We do not fingerprint devices to recover what a refused cookie would have told us.
The honest limit: we do record first-party product events server-side, against your account rather than against a tracking identifier — that a generation was requested, that a plan was viewed. That is not cookie-based, so refusing cookies does not switch it off. What it is, how long it is kept and how to have it deleted are in the Privacy Policy.
If we add a cookie it appears in the table above before it is set, and a non-essential one goes behind the same consent gate as the referral cookie. Questions about this page: privacy@flirtly.co.