1. What this covers
Cookies and similar browser storage on the Fyliio website, for visitors to the public pages and for staff who log in to the workspace.
2. What cookies are
Small files stored on your device so a site can keep a session or a preference. We do not use them to build an advertising profile.
3. What we set
- Staff session. After login the workspace sets an HttpOnly
access_tokencookie so the browser can call the API. It is first-party,Securein production, and not readable by JavaScript. - Firm context. After you pick a firm, the session remembers it so every request stays scoped to that firm.
- Analytics (only if you accept). Google Analytics sets
_gaand_ga_*cookies to count visits to the public pages. They are set only after you click Accept, never in the staff workspace, and you can withdraw consent at any time from Cookie settings in the footer.
Public pages do not need a login cookie.
4. Third-party requests
The site loads its icon font from Google Fonts. As with any web request, Google receives your IP address and browser details when the font loads. If you accept analytics cookies, Google Analytics also receives your IP address, browser details and the public pages you view. We do not use Google Ads, Meta Pixel, or any advertising pixels.
5. How long they last
The session cookie lasts for the login lifetime. Logging out clears it. You can also delete cookies in your browser; the workspace will then ask you to log in again.
6. Your choices
Essential cookies cannot be switched off if you use the staff workspace, because they are how login works. If you only read the public pages, you can browse with cookies blocked. Analytics cookies are optional: decline them in the banner, or change your mind at any time with Cookie settings in the footer.