Legal
Cookie policy
Every cookie and item of browser storage that Flung's sites set, what each is for, how long it lasts, and whether it needs your yes. It adds detail to the privacy policy.
Last updated: 2026-10-31
TL;DR
| Question | Answer |
|---|---|
| Who sets these? | Buun Group Pty Ltd, ABN 75 687 193 675, Spring Mountain, QLD 4300, Australia. Questions go to legal@buungroup.com (opens in a new tab). |
| What is set without asking? | Only what a site needs to work: the sign-in cookies once you sign in, your cookie choice, your theme, and a few remembered layout choices in the portal. None of them tracks you. |
| What needs your yes? | Google Analytics and PostHog, on these docs and flung.dev only. Nothing of either loads until you accept. |
| What about the portal and the staff console? | They run no analytics script, set no analytics cookie and show no banner. They set only the cookies and storage listed for them below. The app's usage events are sent from Flung's servers, so they need no cookie or browser storage; the privacy policy says what they hold and how to turn them off. |
| How do I change my answer? | Cookie settings, at the foot of every page of these docs. |
What cookies and storage are
A cookie is a small piece of text a site asks your browser to keep and send back with each request. Browser storage (local storage and session storage) is kept in your browser and read only by the site's own pages, never sent to a server by itself. "Essential" below means the site cannot do what you asked without it, so the law does not need your yes for it.
The portal and the API
app.flung.dev, and the API it signs in to at api.flung.dev.
| Name | Kind | What it is for | How long | Essential |
|---|---|---|---|---|
__Host-flung_session | Cookie on the API's address. Scripts cannot read it, and it is sent only over HTTPS. | Keeps you signed in. It holds a random value; Flung keeps only its hash. | 7 days from sign-in, never extended. Removed when you sign out. | Yes |
flung_signed_in | Cookie on flung.dev | Says that a session exists, so these docs can show you are signed in. It holds 1 and grants nothing. | The same as the session | Yes |
__Host-flung_sso | Cookie on the API's address. Scripts cannot read it. | Ties a Continue with Google or GitHub sign-in to the browser that started it, so a sign-in link sent to someone else signs nobody in. | 10 minutes. Removed when the sign-in finishes. | Yes |
flung-portal:theme | Local storage | Remembers the light or dark theme you picked | Until you clear your browser's storage | Yes |
flung-portal:theme:rail | Local storage | Remembers that you pinned the side menu open | Until you unpin it | Yes |
flung-portal:workspace | Local storage | Opens the workspace you used last | Until you clear your browser's storage | Yes |
flung-portal:jump-links | Local storage | Remembers that you opened the list of suggested pages | Until you close it | Yes |
flung-portal:setup:<person id> | Local storage | Keeps your answers to the setup questions while you go through them, so a reload does not lose them | Until you finish setup | Yes |
flung-portal:billing-details:<workspace id> | Local storage | Remembers whether you opened or closed the billing details on the Plan page | Until you clear your browser's storage | Yes |
flung-portal:brands-upsell:<workspace id> | Local storage | Remembers that you put away the note about brands | Until you clear your browser's storage | Yes |
flung-portal:academy-watched | Local storage | Remembers which Academy lessons you watched | Until you clear your browser's storage | Yes |
flung-portal:flungie-entered | Session storage | Plays the Flungie's entrance on the home page once a visit | Until you close the tab | Yes |
| Cloudflare Turnstile | A frame from challenges.cloudflare.com, on the sign-in, app approval and deletion forms | Tells a person from an automated program | Sets no cookie on Flung's sites. Cloudflare handles its own signals. | Yes |
The staff console
admin.flung.dev, used only by Flung staff. No customer or visitor receives these.
| Name | Kind | What it is for | How long | Essential |
|---|---|---|---|---|
flung_admin | Cookie on the API's address, under its staff paths only. Scripts cannot read it. | Keeps the staff member signed in | 8 hours. Removed when they sign out. | Yes |
flung-admin:theme and flung-admin:theme:rail | Local storage | Remember the theme and the pinned side menu | Until the browser's storage is cleared | Yes |
The status page
The status page sets one item: flung-status:theme in local storage, for the theme you picked, until you clear your browser's storage. It is essential and sets no cookie.
These docs and flung.dev
| Name | Kind | What it is for | How long | Essential |
|---|---|---|---|---|
flung_consent | Local storage | Remembers your answer to the cookie banner: yes or no to analytics, the version of the policy it was given for, and when | Until you change it or clear your browser's storage. A new version of the policy asks again. | Yes |
docs:theme | Local storage | Remembers the light or dark theme | Until you clear your browser's storage | Yes |
docs:code-tab | Local storage | Remembers the language you picked for code samples | Until you clear your browser's storage | Yes |
_ga | Cookie, set by Google Analytics, only after you accept | Tells one visitor from another, to count visits | Up to 2 years | No |
_ga_<id> | Cookie, set by Google Analytics, only after you accept | Keeps the state of the current visit | Up to 2 years | No |
ph_<key>_posthog | Cookie and local storage, set by PostHog, only after you accept | Tells one visit from the next, to count which links and buttons are used | Up to 1 year | No |
The signed-in marker flung_signed_in, from the portal above, is also read here.
What happens when you choose
| You | What happens |
|---|---|
| Do nothing | Analytics stays off. Nothing is requested from Google or PostHog, and the banner waits. |
| Accept | Google Analytics loads with IP anonymisation asked for and its advertising features off, and PostHog loads with screen recording off and nothing you type captured. Each page view is sent with its address and never its query. |
| Reject | Nothing of either loads, and the banner does not ask again for this version of the policy. |
| Send Do Not Track or Global Privacy Control | Flung treats it as a no and does not ask. |
| Take a yes back | Both stop at once, and their cookies and storage are removed. |
Change your mind
Use Cookie settings at the foot of every page of these docs to see your answer and change it. You can also clear the site's data in your browser's settings, which removes every item above for that site and brings the banner back.
Changes to this policy
We change the date at the top whenever this policy changes. When a change adds a cookie that needs your yes, the banner asks again.
See also
| Page | Why |
|---|---|
| Privacy policy | What the analytics tools receive, and your rights |
| Subprocessors | Google, PostHog and the other providers that handle data for Flung |
| Security | How the sign-in cookies are protected |
| Data processing addendum | The terms Flung processes a workspace's personal data under |
| Terms of service | The agreement to use Flung |
| Acceptable use policy | What Flung may not be used for |
| Data deletion | Every way to delete your data |