This Cookie Notice explains how Yara, operated by Flows Holdings Group LLC (“Yara,” “we,” “us,” or “our”), uses cookies and similar technologies on yara.so, in the Yara app, on portfolios we host at yara.so addresses and on custom domains, and in our emails (together, the “Sites”). It is part of our Privacy Policy.

What cookies are

Cookies are small data files a website places on your device. Session cookies are deleted when you close your browser; persistent cookies stay until they expire or you delete them. First-party cookies are set by the site you are visiting. Third-party cookies are set by another company, such as a service provider whose tool runs on the site.

We also use similar technologies: browser storage (local storage and session storage), which works like a cookie but holds more data; session replay scripts, which record how a page is used; and web beacons (small invisible images or tracked links) in some emails.

What we use

We do not use advertising cookies, and we do not run third-party ad pixels such as those from Meta, Google Ads, or LinkedIn. Here is what we do use:

Category	What it does	Set by	Examples and duration
Strictly necessary	Keeps you signed in and secure, completes sign-in and account-connection flows, and unlocks password-protected projects. The Sites cannot work without these.	Yara (first party)	Session cookies for sign-in (`__Secure-better-auth.session_token`, 30 days, renewed as you use Yara; `__Secure-better-auth.session_data`, 5 minutes); short-lived cookies for email sign-in, Google and GitHub connection, and profile or chat claim flows (10 minutes to 1 hour); `project_unlock_*` (7 days)
Functional	Remembers your choices, such as theme and sidebar state, and powers the support messenger.	Yara (first party); Intercom (third party, signed-in app only)	`yara_handle` (about 13 months); `yara_sidebar_collapsed` (1 year); theme and app state in local storage (until cleared); Intercom’s `intercom-id-` and `intercom-device-id-` (about 9 months) and `intercom-session-*` (1 week)
Analytics	Helps us understand how the Sites are used and fix problems, including session replays with typed input masked.	PostHog, through our own domain (privacy policy)	`ph_*_posthog` cookie and matching local storage (up to 1 year)
Portfolio visitor analytics	On portfolios we host, records visits so the portfolio owner can see views, replays, heatmaps, and summaries. Visitors are not identified by name.	Yara and PostHog	A separate PostHog instance stored under the name yara_public (up to 1 year), and a session replay recorder; the visitor key we store changes daily

When you sign in with Google or connect Google or GitHub, you go to that company’s site, which sets its own cookies under its own policies. Cloudflare, which delivers the Sites, may set a security cookie such as __cf_bm if it needs to check that traffic is not automated.

Session replay

In the Yara app and on portfolios we host, we use session replay to record clicks, scrolls, mouse movements, and page changes. Text typed into form fields is masked, and we do not record network request contents. In the app, replays help us find and fix problems. On portfolios, replays and visit videos are shown to the portfolio owner as part of their analytics.

Emails

Some of our emails contain web beacons or tracked links that tell us whether an email was opened and which links were clicked. You can stop this by setting your email app not to load images automatically.

Your choices

Browser settings. Most browsers let you see, block, and delete cookies and site data, including local storage. If you block strictly necessary cookies, you will not be able to sign in, and parts of the Sites will not work. Learn more at allaboutcookies.org.
Blocking analytics. Browser privacy features and content-blocking extensions can block analytics and session replay scripts without affecting sign-in.
Emails. Turn off automatic image loading in your email app to block email beacons.
Global Privacy Control. We do not use cookies to sell personal information or for cross-context behavioral advertising, so there is nothing for an opt-out signal to switch off. If that changes, we will honor Global Privacy Control signals.

Choices apply to each browser and device separately.

Changes

We may update this Cookie Notice as the technologies we use change. We will post the new version here and update the date at the top.

Questions

Questions about this Cookie Notice? Email privacy@yara.so.