Cookie & Tracking Policy
Effective Date: April 2026 · Last Updated: October 29, 2026
PowerHouseTech LLC dba VolunteerFlow ("VolunteerFlow") uses a small number of cookies to keep you signed in and remember your preferences. This policy explains what cookies and tracking technologies we use, how we use them, and your choices regarding their use.
1. What Are Cookies
Cookies are small text files placed on your device when you visit a website or use a web application. Session cookies are deleted when you close your browser. Persistent cookies remain on your device until they expire or you delete them. Cookies cannot execute code, download files, or spread viruses.
2. Types of Cookies We Use
2.1 Cookies We Set
We set the following first-party cookies and browser storage. All except the language cookie, the campaign entry and the partner referral entry are required for sign-in and cannot be disabled:
| Cookie | Purpose | Expiry | Type |
|---|
| vf_token | Keeps an organization user signed in. httpOnly and Secure, so page scripts cannot read it. | 7 days, or 30 days with “remember me” | Required |
| vf_portal_token | Keeps a volunteer signed in to the volunteer portal. httpOnly and Secure. | 7 days | Required |
| vf_staff_token | Keeps a VolunteerFlow staff member signed in to the internal staff console. httpOnly and Secure. | Up to 8 hours | Required |
| vf_partner | Keeps a VolunteerFlow partner signed in to their partner portal after they sign in with an emailed code. httpOnly and Secure, and sent only to the partner portal. | 7 days | Required |
| vf_2fa_pending | Holds a sign-in in progress while you enter a two-factor code. | 5 minutes | Required |
| vf_support_tab | Marks a browser tab a VolunteerFlow support agent is using to view an account, so support sessions stay separate. | Session | Required |
| vf_partner_ref | Stored in your browser (local storage, not a cookie) only when you arrive through a VolunteerFlow partner's referral link. It holds that partner's referral code, when you first used the link and the page you landed on, so a demo request or free trial you start later is credited to the partner who referred you. It contains nothing about you. | 90 days | Referral |
| HeyCatch (browser storage) | On our public marketing pages only, our analytics provider HeyCatch keeps a random anonymous id in your browser tab (session storage, not a cookie) so page views and clicks in one visit can be counted together. It is not set on the app, sign-in or portals, and not at all when your browser sends Do Not Track or Global Privacy Control. It contains nothing about you. | Until you close the tab | Analytics |
| vf_utm | Stored in your browser tab (session storage, not a cookie) only when you arrive from an ad, a newsletter or another website. It holds the campaign tags in the address (utm_source and similar) and the address of the website that sent you, so a free trial or demo request you start later in the same tab is credited to that campaign. It contains nothing about you. | Until you close the tab | Referral |
| vf_lang | Remembers the language you chose. | 1 year | Preference |
2.2 Performance Measurement
We use Vercel Web Analytics and Speed Insights to count page views and measure page performance (Core Web Vitals). They do not set cookies and do not identify individual visitors.
We also count clicks on buttons and links on our public website. For each click we store which button was pressed, the page it was on, and which website or ad campaign sent you there. We do not use cookies for this, and we do not store your IP address or anything else that identifies you.
2.3 Session Recording
We do not record user sessions. No session replay or screen recording tool is enabled.
2.4 Real-Time Messaging
Socket.IO maintains session-based connections for instant messaging and real-time notifications. These connections are terminated when your session ends and do not persist beyond the active session.
3. Third-Party Content
Some pages load content from other companies, which may set their own cookies or receive your IP address. We do not control these cookies; each is governed by that company's privacy policy:
- Stripe (stripe.com/privacy), during checkout for a VolunteerFlow subscription.
- Square (squareup.com/legal), on donation, store, and kiosk payment pages.
- YouTube and Vimeo, when an organization embeds a video, for example in a training course.
- Google Fonts, when an organization chooses a custom font for its branding.
4. IP Address Collection
IP addresses are collected by VolunteerFlow and our hosting providers for routing and service delivery, security and fraud prevention, and diagnosing errors. IP addresses are not sold to third parties. Sign-in session records, which include the IP address, are deleted 35 days after they are created.
5. Your Choices
- Sign-in cookies: Cannot be disabled; they are required for sign-in to work.
- Language cookie: Delete it in your browser settings; the site falls back to your browser language.
- Campaign entry: Close the browser tab; it is removed when the tab closes.
- Partner referral entry: Clear this site's data in your browser settings; the referral is then no longer credited to the partner.
- Third-party content: Use your browser's cookie controls to block third-party cookies.
Most browsers allow you to refuse cookies or alert you when a cookie is being set. You can view and delete cookies from your browser settings. Be aware that disabling sign-in cookies will prevent you from staying signed in.
6. Do Not Track
Our public marketing pages do not run analytics for visitors whose browser sends Do Not Track (DNT) or Global Privacy Control. We do not otherwise respond to DNT browser signals. You can still use your browser's cookie controls to limit tracking. We may choose to honour DNT signals in the future.
7. Pixel Tags and Web Beacons
We do not use pixel tags, web beacons, or advertising trackers.
8. Updates to This Policy
We may update this Cookie and Tracking Policy to reflect changes in our practices or technology. Material changes will be notified via email. Continued use of VolunteerFlow after the effective date of updates constitutes acceptance of the revised policy.
For questions about this policy, contact legal@volunteerflow.us.
This policy should be read alongside our Privacy Policy.
© 2026 VolunteerFlow. All rights reserved.