Cookies

These are strictly necessary. Without them you cannot stay signed in, so they are not optional and need no consent.

fg_session

Set when you sign in or create an account. It holds a random session token that tells our API which account the request belongs to. It cannot be read by scripts (HttpOnly) and is only sent over HTTPS. It lasts up to 30 days and is deleted when you sign out. You can see and end your sessions under Settings → Security.

fg_oauth

Set only if you choose “Continue with Google”. It carries a signed, one-time value that protects the sign-in redirect against forgery. It is removed when the sign-in completes and expires after 10 minutes either way.

fg_bankid

Set only while a BankID identification is waiting. It carries an encrypted reference to that identification, so that only this browser can collect the result. It is removed when the identification ends and expires after 5 minutes either way.

fg_bankid_signup

Set if you identify with BankID and have no account yet. It carries your name and a keyed hash of your personal number, encrypted, so the sign-up form can finish the account. It is removed when you finish or start over and expires after 15 minutes either way.

fg_dev

Set when you sign in. It holds a code that shows this browser has signed in to your account before, so that we only email you about sign-ins from a new device. It lasts 365 days.

Partners share links that pass through our redirect (addresses containing /a/) on the way to one of Flow Group’s apps. A person who clicks such a link is never shown this website; they are sent straight to the app or its store page.

fg_vid

Set by the redirect on our tracking domain. It holds a random identifier that contains nothing about you, and is saved with the record of the click so that repeat clicks from the same browser can be told apart from new visitors. It cannot be read by scripts or by any other website. It lasts 365 days and is renewed on each click.

The cookie is not what credits a partner. The link itself carries a click reference to the app, and the app reports back with that reference when someone signs up. Blocking or deleting fg_vid does not stop the link from working.

The redirect also records the time, the link, the browser’s user agent, the referring page, the country reported by our network provider and a one-way hash of the IP address. The hash and the user agent are removed after 90 days. See the privacy policy.

Open point in this draft. Because the cookie is set by a redirect, before any page is shown, there is no moment at which consent could be asked. Whether it counts as strictly necessary under the Swedish Electronic Communications Act (2022:482, chapter 9, section 28), or should be removed, is being decided as part of the legal review.

To see whether the public landing page works, we keep eight daily totals:

• views of the landing page
• clicks on its buttons, and which button
• views of the sign-up page
• BankID identifications started on the sign-in and sign-up forms
• BankID identifications finished there, and whether the person already had an account
• accounts created on the sign-up form
• views of the programs page while we test showing a leaderboard there, and which version of the page was shown
• clicks on that page’s sign-up button, and which version of the page it was on

Your browser sends a short message to our own server, and the server adds one to the total for that day. No cookie is set or read, nothing is saved in your browser, and nothing goes to anyone else. The totals hold no IP address, no browser details and no identifier, so we cannot tell whether two counts came from the same person.

The server does read two things in passing. It uses a one-way hash of your IP address to stop one address sending too many messages, and forgets it after a minute. It reads the browser’s user agent to leave out search-engine crawlers, and does not keep it. Our own logs leave out the IP address for these messages. As with any request on the internet, our hosting provider’s equipment handles the address to deliver the message.

Open point in this draft. Sending this message involves a script in your browser, even though nothing is stored there. Whether that needs consent under the Swedish Electronic Communications Act (2022:482, chapter 9, section 28) is being decided as part of the legal review.

The website remembers a few interface choices in your browser’s local storage. They exist because you made the choice, they stay on your device, and they are never sent to us. Clearing your browser’s site data resets them.

theme

Light or dark, when you pick one instead of following your system setting.

fg_sidebar

Whether the sidebar in the portal is collapsed.

fg_portal_advanced

Whether advanced options are shown in the partner portal.

fg_tour:…

That you have already seen the first-run tour of the portal, so it does not open again. The same fact is also saved on your account.

fg_login_method

Whether you last signed in with BankID or with email, so the sign-in page opens on the same choice.

fg_bankid_signup

Your name, shown on the sign-up form after you identify with BankID. It is kept for this tab only, for at most 14 minutes.

One language choice is a cookie instead, because the server needs it to send the page in the right language:

fa_locale

Set only when you choose a language. It lasts one year.

From this website

Signing out deletes the session cookie. You can also delete cookies and site data for this site in your browser’s settings; you will then be signed out.

From tracking links

Delete cookies for the tracking domain in your browser, or block cookies for it. Links keep working either way. To ask what we hold about a click, or to object, write to [privacy contact email].

If this changes

If we ever add a cookie that is not strictly necessary on this website, we will ask for your consent before it is set and list it here.