Effective Date: April 2026
VolunteerFlow uses cookies and tracking technologies to enhance user experience, measure platform usage, diagnose issues, and improve our services. This policy explains what cookies and tracking technologies we use, how we use them, and your choices regarding their use.
Cookies are small text files placed on your device when you visit a website or use a web application. Session cookies are deleted when you close your browser. Persistent cookies remain on your device until they expire or you delete them. Cookies cannot execute code, download files, or spread viruses.
These cookies are essential for the platform to function and cannot be disabled:
| Cookie | Purpose | Expiry | Type |
|---|---|---|---|
| Authentication Token (JWT) | Authenticates your login session. httpOnly and Secure flags prevent JavaScript access. | 7 days | |
| Session Management | Tracks session state and protects against CSRF attacks. | Session |
These cookies help us understand how the platform is used. No personally identifiable information is collected:
| Service | Data Collected | Type |
|---|---|---|
| Vercel Analytics | Page views, referrers, browser info, device type, general location. No PII collected. | |
| Vercel Speed Insights | Core Web Vitals and performance metrics. |
We use Sentry to monitor application errors and capture session replays for debugging:
| Service | Data Collected | Sampling |
|---|---|---|
| Sentry Error Tracking | JavaScript errors, stack traces, IP address (for geographic error patterns) | 100% of errors |
| Sentry Session Replay | Clicks, scrolls, form interactions, page context. PII masking enabled (maskAllText: true). 90-day retention. | 100% on errors, 10% random sample |
Session replays are used exclusively for debugging and improving the platform. They are not used for marketing or shared externally.
Socket.IO maintains session-based connections for instant messaging and real-time notifications. These connections are terminated when your session ends and do not persist beyond the active session.
Stripe and PayPal may set their own cookies during checkout and payment processing. These cookies are governed by their respective privacy policies and we do not control them:
IP addresses are collected by VolunteerFlow, Sentry, and Vercel for the following purposes: routing and service delivery, security and fraud prevention, geographic analytics, and error diagnosis. IP addresses are not sold to third parties. Server logs containing IP addresses are retained for 30 days.
Session replays capture your interactions with the platform, including clicks, scrolls, and form submissions. We have enabled PII masking in Sentry (maskAllText: true), which redacts common patterns of sensitive data such as email addresses, phone numbers, and payment information. Replays are used only for debugging purposes and retained for 90 days.
To request deletion of your session replay data, contact legal@volunteerflow.us.
Most browsers allow you to refuse cookies or alert you when a cookie is being set. You can view and delete cookies from your browser settings. Be aware that disabling authentication cookies will prevent you from staying signed in.
We do not currently respond to Do Not Track (DNT) browser signals. You can still use your browser's cookie controls to limit tracking. We may choose to honour DNT signals in the future.
We may use pixel tags and web beacons (small images embedded in pages) to measure engagement and track conversions. These work similarly to cookies and can be controlled through your browser settings.
We may update this Cookie and Tracking Policy to reflect changes in our practices or technology. Material changes will be notified via email. Continued use of VolunteerFlow after the effective date of updates constitutes acceptance of the revised policy.
For questions about this policy, contact legal@volunteerflow.us.
This policy should be read alongside our Privacy Policy.
© 2026 VolunteerFlow. All rights reserved.