Cookie Policy
Last updated: 22 April 2026
This policy describes the cookies set by WashFlow and how you can control them.
1. What is a cookie?
A cookie is a small text file that a website places on your device to remember information across page loads — for example, that you are signed in. We use a small number of cookies and we try to keep the list short.
2. Strictly necessary cookies
These cookies are required for the Service to work. You can't turn them off without breaking sign-in, CSRF protection, and bot detection.
- __session, __clerk_db_jwt, __client_uat — set by Clerk (our authentication provider) to keep you signed in and to issue session tokens. Expires: session or up to 1 year. Domain: your tenant subdomain + clerk.com.
- cf_clearance, __cf_bm— set by Cloudflare Turnstile when you complete the onboarding form, to prove you're a human and prevent spam signups. Expires: 30 minutes to 1 year.
- wf_cookie_consent— set by our own cookie banner once you dismiss it, so we don't show it again. Expires: 6 months.
3. Optional cookies
We do not currently set any optional tracking cookies (no third-party analytics, no advertising pixels). If we add product analytics in the future we will update this list and add an opt-in control to the cookie banner first.
4. Controlling cookies
You can:
- Clear cookies or block them per-site in your browser settings. Note that blocking the strictly-necessary cookies above will prevent you from signing in.
- Use the in-app "Manage cookies" link (bottom of most pages) to reset your consent banner preferences.
5. The embed widget
The public embed widget you can paste onto your own wash company's website is designed to set no cookies at all when used by anonymous visitors. It only loads styles and submits the booking form as an HTTP POST.
6. Changes
We'll update this list whenever we add or remove a cookie. The "Last updated" date at the top always reflects the current state.