Updated: 2 November 2026Draft
1. Scope and terminology
This policy applies to the Flash website, documentation and interest-registration accounts. Cookies are small values a site asks a browser to store and return. Similar technologies can include local storage, session storage, pixels, SDK identifiers, and device-access techniques. This policy uses “cookies” as a convenient collective term while the inventory identifies the actual mechanism used.
First-party cookies belong to the Flash domain being visited. A provider on another domain may set its own cookies when the browser is intentionally redirected there, for example during authentication. Choices and storage are domain-specific.
2. Authentication and preferences you choose
Flash does not currently use analytics, advertising, behavioural profiling, social-media pixels, chat widgets or external video players. Documentation stores the interface you select in localStorage so it can show the relevant instructions on your next visit. Flash does not write data to sessionStorage.
Authentication cookies provide security after you choose to sign in. Documentation storage serves only the interface preference you expressly select. These technologies are not used to measure audiences, follow users across services or build profiles. They do not require a cookie-consent banner for these purposes. Blocking authentication cookies may prevent sign-in and authenticated account features from working.
3. Cookie and storage inventory
| Name and provider | Purpose | When set | Duration |
|---|---|---|---|
| Turnstile verification (when enabled)CloudflareScope: challenges.cloudflare.com, embedded in the demo form | Checks for automated submissions using browser and network signals. | Loads when you reach the final step of the demo form. | The verification token is single-use and expires after five minutes. Flash keeps it only in page memory until submission, expiry or navigation. Pre-clearance is not enabled by this integration. |
| __sessionFlash, implemented with the Auth0 SDKScope: flashembedded.com | An encrypted, opaque session identifier keeps you signed in and protects account routes. Your profile and authentication tokens are held in an encrypted server-side session record, not in this cookie. | Set only after a user completes sign-in. | Valid for up to 7 days of inactivity and no more than 30 days from sign-in, whichever occurs first. It is removed on sign-out where the browser accepts the deletion response. These are authentication limits; server-record retention is explained in the Privacy Policy. |
| __txn_*Flash, implemented with the Auth0 SDKScope: flashembedded.com | Stores short-lived encrypted login-transaction state used for security checks such as state, nonce, and PKCE during the authentication redirect. | Set when a user starts sign-in. | Up to 1 hour; consumed and removed when the authentication flow completes. |
| flash-docs-interface (localStorage)FlashScope: The origin where documentation is viewed, normally docs.flashembedded.com | Remembers the documentation interface you select: IDE, CLI or VS Code Extension. This preference is not used for analytics, advertising or profiling. | Written when you choose an interface in the documentation. | No automatic expiry. Replaced when you choose another interface. Remove it with Reset saved interface in the documentation navigation or through your browser's site-data settings. |
4. Authentication-provider domain
Sign-in redirects the browser to the configured Auth0 tenant. Cookies created on that separate authentication domain are controlled by the configured provider and tenant settings. The authentication provider and processing information are described here: To be confirmed before publication.
5. Your controls
Browsers allow cookies to be inspected, blocked, or deleted through their privacy settings. Deleting the Flash session cookie signs the browser out. Blocking all cookies may stop the login redirect from completing because the short-lived transaction cookie is required to validate the response securely.
Use Reset saved interface below the interface selector in the documentation Guides navigation (open the navigation menu on mobile), or clear that origin's site data in your browser. Reset removes only this preference and restores IDE as the default; it does not sign you out. The website cannot clear storage belonging to the separate documentation domain.
Because no technologies requiring consent are active, Flash does not store a consent choice. The current status and routes for privacy requests are always available on the Privacy Choices page. Global Privacy Control and Do Not Track do not change the current behaviour because there is no advertising or optional tracking to disable.
6. Rule for future technologies
Flash must not activate any non-essential storage or tracking technology before this inventory is updated and, where required, valid prior consent is available. Any future consent interface must make accepting and rejecting equally direct, keep optional technologies disabled before a choice, allow granular control by purpose, and make withdrawal as easy as consent.
Before any change goes live, Flash must document the name, provider, domain, purpose, legal basis, data involved, recipients, international transfers, expiry, and removal behaviour. Consent records must be retained only as long as needed to demonstrate and honour the choice.
7. Contact and changes
Questions about this inventory can be sent to our contact email. The review date and inventory will be updated whenever a cookie, storage mechanism, provider, purpose, or duration changes. Related personal-data processing is described in the Privacy Policy.