Cookie Policy
This Cookie Policy explains how Hubflo Corp. ("Hubflo," "we," "us," or "our") uses cookies and similar technologies on winpal.app and in our web app (together, the "Website"). It supplements our Privacy Policy. WinPal is operated by Hubflo Corp., the U.S. subsidiary of Hubflo.
The mobile App does not use cookies. The App uses local device storage and the identifiers described in the Privacy Policy.
1. What are cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, make them work more efficiently, and report information to the owner. "Similar technologies" include local storage, session storage, pixels, tags, and software development kits (SDKs) that perform comparable functions.
We use two types of cookies:
- First-party cookies — set by Hubflo.
- Third-party cookies — set by our vendors (for example, analytics and advertising services).
We also classify cookies by how long they last:
- Session cookies — deleted when you close your browser.
- Persistent cookies — remain until they expire or you delete them.
2. Categories of cookies we use
2.1 Strictly necessary cookies
These cookies are required for the Website to function. They cannot be switched off. They include authentication, session management, security, and load-balancing cookies. Without them, the Website will not work properly.
Examples: session ID, CSRF token, authentication token, cookie-consent preferences.
2.2 Functional cookies
These cookies remember choices you make to improve your experience, such as language, region, or display preferences. If you disable them, parts of the Website may not work as expected.
2.3 Analytics cookies
These cookies help us understand how visitors use the Website so we can improve it. They collect information such as which pages you visit, how long you spend on each page, and which features you use.
Vendor: PostHog (product analytics).
2.4 Marketing and advertising cookies
These cookies are set by our advertising partners on our marketing website. They help us measure the effectiveness of our advertising and show you relevant ads on other sites.
Vendors: Meta (Facebook) Pixel, Google Ads.
These cookies are not used inside the web app or the mobile app — only on the marketing website.
3. Cookie table
| Cookie name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
sb-access-token | WinPal (Supabase) | Authentication | Strictly necessary | Session |
sb-refresh-token | WinPal (Supabase) | Authentication refresh | Strictly necessary | 7 days |
cookie-consent | WinPal | Stores your cookie preferences | Strictly necessary | 12 months |
ph_* | PostHog | Product analytics | Analytics | 12 months |
_fbp | Meta | Ad measurement and retargeting | Marketing | 3 months |
_gcl_au | Google Ads | Ad conversion tracking | Marketing | 3 months |
4. Your choices
4.1 Consent banner (EEA, UK, Switzerland, and other consent-required regions)
When you first visit the Website from a region where consent is required, we show a consent banner. You can:
- Accept all — allow all cookies.
- Reject all — decline all non-essential cookies. Strictly necessary cookies still load.
- Customize — choose which categories to enable.
You can change your choices at any time by clicking "Cookie settings" in the footer of the Website.
4.2 Global Privacy Control (GPC)
On our marketing website, we honor the Global Privacy Control (GPC) browser signal as an opt-out of "sharing" under California's CPRA and similar laws. If your browser sends a GPC signal, we treat it as a request to disable marketing and advertising cookies.
4.3 Browser controls
Most browsers let you view, manage, and delete cookies through their settings. Guides:
Blocking all cookies will prevent parts of the Website from working.
4.4 Opt-out tools
You can opt out of many advertising cookies through:
5. Do Not Track
Our Website does not respond to "Do Not Track" browser signals because there is no industry-standard definition of how to interpret them. We do honor Global Privacy Control (see Section 4.2).
6. Changes to this Policy
We may update this Cookie Policy from time to time. When we do, we will update the "Last updated" date at the top. Material changes will be notified through a prominent notice on the Website and, where required, by re-prompting for consent.
7. Contact
Questions about this Cookie Policy?
Hubflo Corp.
1411 Broadway
New York, NY 10018
privacy@winpal.app
WinPal is operated by Hubflo Corp., the U.S. subsidiary of Hubflo. For general questions, contact hello@winpal.app.