Necessary and requested functionality
Public demo pages do not use an advertising cookie, analytics cookie or fingerprinting identifier. Normal browser caching stores downloaded assets. The owner dashboard uses its necessary sign-in session cookie for access control; it is not a marketing identifier.
Customer accounts and installed websites
My Fluri uses necessary secure HTTP-only authentication cookies to keep a real account signed in. Sessions ordinarily last up to seven days, with renewal during use, and can be revoked by password change or account deletion. Passwords and recovery codes are not retained by the dashboard in local storage. Earlier browser-demo keys may remain from old versions; those values do not authenticate the real account and can be deleted in browser settings.
The hosted embed does not set visitor cookies, use local storage for visitor tracking or create persistent visitor identifiers. It keeps temporary in-memory state while a page is open. Each measured page view uses a fresh random event identifier solely to reject duplicate submissions. Necessary asset caching, origin checks and connection signals remain separate from optional measurements. Customer accounts and visitor installations do not share sign-in cookies across customer domains.
Analytics and preferences
Application-level public measurements use aggregate counters and do not set a persistent visitor identifier. We honour Do Not Track and Global Privacy Control for optional public view and interaction events. Delivery and security still require technical request processing. The owner’s necessary authenticated session is separate. We do not infer cookie consent from continued browsing.
New website setups preselect aggregate theme analytics, with a visible control to turn it off. Existing saved opt-outs are preserved. This is not visitor consent and does not by itself establish an exemption from applicable consent requirements. Customers must assess their implementation and disable reporting until their notices, legal basis and any required consent are ready. An embed can start with `data-analytics="false"`; a customer consent manager can later call `window.Fluri.setAnalytics(true)` or `window.Fluri.setAnalytics(false)`. These controls do not create consent records or override DNT/GPC.
Future payments and accounts
Stripe is not currently connected and no Stripe payment widget is loaded by the preview checkout. Necessary secure HTTP-only authentication cookies maintain the real customer session. They are not used for advertising. Accounts are live; payment processing remains disabled. Any future payment cookies or non-essential tracking must be disclosed before activation, with consent where required. A future advertising or behavioural analytics product must not be activated merely by changing this text.
Your controls
You can block or clear browser storage and cache using browser settings. The public catalogue remains available without sign-in cookies, but account access requires its necessary session. Contact fluritheme@gmail.com with questions.