Qwotio · Flowstox Ltd
Cookies & storage
What Qwotio stores in your browser, why it is used and the choices you have.
Last updated: 7 October 2026
Qwotio is a service operated by Flowstox Ltd.
Cookies are small values stored by your browser and sent to the relevant site. Session storage is kept for a browser tab and is not automatically sent with every web request. Both can be used to recognise a session or remember a choice.
Authentication and security technologies support services you request. A preference is not classified as essential merely because it exists: country/language is stored when you choose it, and trusted-device recognition is optional and set only after successful email verification and your explicit selection. Quote Analytics is optional and requires a separate choice.
| Storage / category | Purpose | Duration |
|---|---|---|
sb-…-auth-token (including chunks)Authentication / session | Supabase authentication and refresh credentials. First-party HttpOnly cookies; the application also requires its own verification grant. | The installed Supabase SSR library sets up to 400 days, refreshed when credentials rotate. Native session validity and logout can end access earlier. |
sb-…-auth-token-code-verifierAuthentication / security | Transient proof for provider flows when used. First-party cookie; not an analytics identifier. | Removed when consumed/cleared. The provider library's cookie ceiling is 400 days; that is not the validity of a verification code. |
__Host-qwotio_auth / qwotio_authSecurity | First-party HttpOnly proof of the current Qwotio authentication stage. | 10 minutes for pending/recovery/invitation stages; 8 hours after complete login. Logout revokes the grant. |
__Host-qwotio_device / qwotio_deviceTrusted device | First-party HttpOnly random secret that can replace the email-code step after a correct password. Only set when you request it; only its hash is stored server-side. | 30 days from registration, without extension on use. Revoke in Account → Security. Password change/reset revokes all devices. |
qwotio_region; legacy qwotio_localeLocale / preference | Remembers your selected country/language. The legacy preference is migrated and removed. | Selected region: 1 year. Legacy cookie: deleted during migration or a new choice. |
qwotio.themeAppearance preference · localStorage | Remembers Light, Dark or System when you select an application theme. Stored only in this browser; it does not change customer Quote Builder branding. | Until you change the preference or clear site storage. Browser storage settings may remove it earlier. |
qwotio_privacyPrivacy preference | First-party cookie recording this notice's acknowledgement and your analytics choice. Got it acknowledges information; it does not authorise analytics. | 180 days from your latest explicit choice. No automatic extension on page views. |
qwotio.submission.[builder]Requested service · sessionStorage | Random submission ID and secret prevent duplicate requests and recover confirmation after refresh. No answers or customer contact details are stored in the browser. | Until the tab session ends or site storage is cleared. Blocking storage limits refresh recovery; in-page retries still use the same identity. |
qwotio.quote-session.[revision]Optional analytics · sessionStorage | First-party, tab-scoped random session ID/secret, step/route IDs, timing, flags and estimate. Only accessed after analytics permission; no customer answers or contact information. | The browser normally clears it when the tab session ends. The app stops resuming after 30 minutes of inactivity or 24 hours total; withdrawal removes these entries from the current tab. |
Cookie preferences
You can delete or block cookies and site storage in your browser settings. Blocking authentication/security cookies can prevent login; deleting a trusted-device cookie means a new email verification is needed. You can change optional analytics here at any time. If browser storage is unavailable, your choice applies in memory until this page reloads.
These application cookies and storage entries are first-party. No third-party advertising or analytics cookies are installed by the application. Hosting protection and email-provider processing are separate provider services; email privacy settings and infrastructure behaviour should also be reviewed. Session and analytics identifiers are not used across websites.
Marketing and advertising technologies are not enabled. Adding a new optional purpose requires updated information and an explicit choice before it can run; allowing quote analytics does not allow future marketing.