Cookie policy
Last updated, 24 August 2026.
The short version
This site stores one cookie by default, and only after you have chosen: a record of your cookie choice. Nothing optional runs until you accept it. Choosing Essential only rejects all optional tracking, and the record of that choice is then the only thing in your browser from this site. You can change or withdraw your choice at any time using Cookie settings at the bottom of any page.
Essential, cineflow_consent_v1
Provider, CineFlow, first party. Purpose, remembering the cookie choice you made so you are not asked again on every page. Category, essential. Value, the single word essential or the single word analytics, and nothing else, so it carries no identifier and nothing personal. Domain, .cineflow.cloud, which is the CineFlow app reading the same choice so you are not asked a second time after signing in. Path, /. Secure and SameSite=Lax. Lifetime, six months, after which you are asked again. The v1 in the name is the version of this disclosure, so if what we use or what we use it for changes materially, the name changes with it and you are asked afresh.
Optional, analytics
Provider, PostHog, on its EU cloud at eu.i.posthog.com with scripts served from eu-assets.i.posthog.com. Purpose, counting page views and page exits, how far down a page people read, click and scroll maps, and clicks on links through to the CineFlow app, so we can see which pages lead to a signup. Category, analytics, optional. Data sent, the page URL including any campaign parameters you arrived with, the referring page, your browser and screen size, a randomly generated device identifier, and your IP address as part of the request. Storage, one cookie named ph_ followed by the PostHog project key and _posthog, set on .cineflow.cloud, Secure, SameSite=Lax, kept for one year, plus one localStorage entry and up to three sessionStorage entries with the same ph_ prefix. All of them hold that same random device identifier and PostHog's own session state. This loads nothing and stores nothing unless you turn it on.
What we deliberately do not run
No advertising, no remarketing, no advertising or conversion pixels, no attribution vendor, no social media embeds, no embedded video, no support or chat widget, no A/B testing tool, and no session replay. PostHog is able to record sessions, capture form interactions, run surveys, and capture errors, and every one of those is switched off explicitly in the site's code rather than left to a default, because none of them is what this site's analytics is for. Turning any of them back on would be a change of purpose, which means a new version of this page and a fresh choice for everyone. One caveat we would rather state than hide: after you accept analytics, PostHog's own loader sometimes still fetches a small helper script from eu-assets.i.posthog.com for a feature that is switched off in our settings. The feature does not run and captures nothing, but the request for the file is made, and it is made only after you have accepted.
Cloudflare
This site is served by Cloudflare Pages, and Cloudflare processes each request in order to deliver the site. Cloudflare Web Analytics is currently enabled on the account and its beacon script, from static.cloudflareinsights.com, is added to the page by Cloudflare's network rather than by this site's code. It sets no cookie and writes nothing to browser storage. Because it is added by the network after this site's code has run, this site's consent controls cannot hold it behind your choice. It is named here for that reason. Switching it off belongs in the Cloudflare account settings and is the one outstanding item on this page.
The support form
Sending a message from the contact form posts what you typed to this site's own endpoint, which passes it to Resend to deliver the email. It sets no cookie and stores nothing in your browser. This runs on the server when you press send, not when you load the page.
Changing or withdrawing your choice
Cookie settings, at the bottom of every page, reopens the same controls the banner offers. Withdrawing is as easy as consenting: turn the category off and save, and we stop collecting and delete the analytics cookie and browser storage entries this site is able to delete. Anything already collected under the consent you had given is handled as a deletion request, which you can also make directly by writing to [email protected].
What this page does not claim
This page describes what the site does. It is not a statement that the site complies with any particular law, and it has not been reviewed by a lawyer. The open questions we know of are, which regimes apply given an Australian operator with visitors in the UK and EU, the correct retention period for analytics events held by PostHog, whether a data processing agreement is in place with each provider named here, and whether Cloudflare's own processing needs its own disclosure. Those are for qualified legal review, not for this page.
Contact
Questions about cookies on this site, write to [email protected].