The short version: xMap Flows keeps on your device only what the site needs to work, unless you agree to more. With your OK it also remembers how you like the app laid out and measures which pages and sites bring people here. There are no advertising cookies, nothing is shared with advertisers, and we do not track whether you open or click our emails. You can change your choice at any time: open Cookie settings.
What cookies and browser storage are
A cookie is a small piece of text a website asks your browser to keep and send back on later visits. Browser storage (local storage and session storage) is a similar place in your browser where a site’s own pages can keep small notes, such as whether you prefer light or dark. Laws such as the EU and UK rules on electronic communications treat both the same way, and so do we: this policy covers both.
Everything listed here is first party: it belongs to flows.xmap.ai (or your organization’s own address, if it has one) and is read only by our own pages. We use no advertising, social media or cross-site tracking cookies, and no outside service sets cookies on our pages.
The three kinds
- Strictly necessary. Needed for something you asked for: signing in and keeping sign-ins secure, remembering your cookie choice, and keeping work you started (a flow you built before signing up, a chat, Academy lessons, blocks you copied). These are always on: the site cannot work without them, and the law does not ask for consent to them.
- Preferences. Remember how you like the app and the site laid out on this device, such as light or dark, the editor’s view and the films you watched. They are kept only if you agree. Without them everything works; your layout is just forgotten when you leave the page.
- Measurement. Help us learn which pages and sites bring people to xMap Flows: the page you first landed on and the site that sent you, the invite link you came with, and one count when you first see results. They are kept and sent only if you agree.
Until you choose, only strictly necessary items are kept: anything else stays in the page’s memory and is gone when you leave it.
Your choice
The first time you visit, a banner asks you. Accept all, Reject non-essential and Choose are side by side, and rejecting is as easy as accepting. Choose lets you switch Preferences and Measurement on or off one by one.
You can change your mind at any time with Cookie settings in the footer of every page, in the menu under your picture in the app, or here: open Cookie settings. Switching a kind off removes what it had kept on this device.
If your browser sends Global Privacy Control or Do Not Track, we take it as Reject non-essential without asking, and Measurement stays off. You can still switch Preferences on in Cookie settings.
Your choice is kept in your browser (xf_consent). When you are signed in, we also keep it with your account (what you chose, how and when), so we can show the choice was yours. When you sign in on another browser or device that has no choice yet, it takes the choice kept with your account, so you are asked only once; if you are not signed in, another device asks again. You can change it in each browser at any time under Cookie settings.
Every cookie and item of storage
A name ending in <flow>, <organization>, <page> or similar stands for one item for each flow, organization or page. “This tab only” means session storage, which your browser deletes when the tab is closed.
| Name | Kind | Type | Purpose | How long |
|---|---|---|---|---|
xf_session | Strictly necessary | Cookie | Keeps you signed in. Secure, HttpOnly (page scripts cannot read it), sent only to flows.xmap.ai. | Up to 30 days, or until you sign out |
xf_sso | Strictly necessary | Cookie | Makes sure a sign-in with Google or Microsoft finishes in the browser that started it. | 15 minutes |
xf_saml | Strictly necessary | Cookie | Makes sure a sign-in through your company’s single sign-on finishes in the browser that started it. | 15 minutes |
xf_consent | Strictly necessary | Browser storage | Remembers your choice in Cookie settings, so we do not ask again. | Until you change it or clear it |
xf_org | Strictly necessary | Browser storage | Remembers which of your organizations you last opened, so the app opens there. | Until you clear it |
xf_guest_flow | Strictly necessary | Browser storage | Keeps the flow you built on the home page before signing up, so it is not lost. | Until you keep the flow or clear it |
xf_academy, xf_ac_steps_<exercise> | Strictly necessary | Browser storage | The xMap Academy: lessons you did before signing in (brought into your account when you do) and the steps of an exercise you ticked. | Until you clear it |
xf_block_clip | Strictly necessary | Browser storage | The blocks you copied in the editor, so you can paste them into another flow. | Until you copy again or clear it |
xf_chat_<flow> | Strictly necessary | Browser storage | On a flow’s chat page: the messages shown and the conversation’s random id, so the flow’s agent can carry the conversation on. | Until you clear it |
xf_tpl_<page>, xf_chk_<report>, xf_ref_tab, xf_connect_popup, xf_pending, xf_invite, xf_code, xf_email, xf_next, xf_oauth, xf_import, xf_conn_back, xf_conn_block, xf_after_login, xf_login_note, xf_ai_start, xf_autotest, xf_tz | Strictly necessary | Browser storage, this tab only | What you are in the middle of in this tab: the choices on a template page while you sign in or connect an app, that this tab ran a market check (so only it is offered to keep watching it), the invite link this tab arrived with (so the company that invited you gets its credits when you sign up in it), a sign-up or invitation waiting for its code, where to take you after signing in, the request you gave Ask xMap while its flow opens, and that your time zone was sent. | Until the tab is closed |
xf_tab, xf_fl_q, xf_fl_folder, xf_fl_tag, xf_ed_view_wide, xf_cmp_pending, xf_fc_<flow>, xh_in | Strictly necessary | Browser storage, this tab only | What you are looking at in this tab: the tab, search and folder you chose on the Flows page, the editor’s view, a spot waiting to be compared, a chat with a flow in the editor, and whether the header should show Open my flows. | Until the tab is closed |
xf_theme | Preferences | Browser storage | Light or dark, so the app opens in it before your account loads. | Until you change it or clear it |
xf_ed_view, xf_sentence, xf_lib_slim, xf_drawer_h, xf_out_view, xf_run_blocks, xf_draw_hide, xf_draw_shape, xf_draw_style, xf_draw_tip, xf_golive, xf_live_<flow>, xf_runonce_told, xf_autofix, xf_fb_<flow> | Preferences | Browser storage | How you like the flow editor: the canvas or the list of steps, the flow in words, a slim block list, the height of the results panel, results as cards or a table, whether a run’s blocks are shown open, whether drawings are hidden and the drawing tool you used last, whether to show Ready to go live? and for which flows you saw it, whether xMap AI may fix a failed run on its own, and whether a flow already asked Was this useful? today. | Until you clear them |
xf_aichat_<flow>, xf_aichat_big, xf_ax_<user>, xf_ax_seen_<user> | Preferences | Browser storage | Your conversations with Ask xMap and with xMap AI about each flow on this device (up to 40 messages; Clear removes them), whether the chat is open, and which notices Ask xMap has shown you. | Until you clear them |
xf_fl_view, xf_fl_sort, xf_tc_view, xf_res_view, xf_map_view, xf_mk_days, xf_mk_off_<organization>, xf_mk_has_<organization>, xf_adv_<section>, xf_send_<app>_<organization>, xf_later_<organization>, xf_uses_<organization>, xf_navnew_<organization>, xf_first_result, xf_np_top, xf_sup_st, xf_push_tip | Preferences | Browser storage | How you like the rest of the app: cards or a chart on the Flows page and their order, results as cards or a table, how maps are shown and the period and layers of the map of results, which Advanced settings are open, the Google Sheet or Slack channel you last sent a result to, the items you put away for later today, which places of the menu have something new for you, that your first results were celebrated, the newest notice already shown, the support conversations listed, and whether you put off the offer of notifications. | Until you clear them |
xf_vids, xf_ac_sound, xf_ac_course | Preferences | Browser storage | The films you watched and where you stopped, so a film carries on; whether the xMap Academy’s sounds are on, and which level you last opened. | Until you clear them |
xf_land | Measurement | Browser storage | The page you first landed on, the name of the site that linked to it (never its full address) and campaign tags, sent with a home-page run, a sign-up or an email you leave, so we learn what brings people to xMap Flows. | 30 days |
xf_ref | Measurement | Browser storage | The invite link of another company you came with, kept until you sign up, so that company gets its referral credits. | 30 days, or until you sign in |
xf_step_results | Measurement | Browser storage | That this browser already told us you saw your first results (one count in how many people get to results). | Until you clear it |
Counting page visits
We count visits to our pages with Vercel Web Analytics, to see which pages people use. It sets no cookie and keeps nothing in your browser. Before a visit is counted, we remove from the address anything that could identify a record, a link or a person (such as the number of a flow or a sign-in link), and Vercel does not keep your IP address or any identifier that lasts beyond the day. It runs only on flows.xmap.ai, not on shared maps, lists and chat pages or on an organization’s own address. It counts under Measurement: when you switch Measurement off, or your browser sends Global Privacy Control or Do Not Track, your visits are not counted at all.
Other companies
Some things you may open from xMap Flows are run by other companies on their own sites, under their own cookie policies: paying through Stripe’s checkout and billing pages, signing in with Google or Microsoft, your company’s single sign-on, signing in to an app you connect (such as Slack or HubSpot), booking a call at call.xmap.ai, and checking your identity with Didit before an xMap Academy certificate.
Our pages also load map pictures from OpenStreetMap, and films, narration and files from our file storage. These set no cookies, but like any website they receive your IP address when your browser asks them for a picture or a file. Live cursors in the flow editor connect to Pusher while teammates have the same flow open; that connection sets no cookie either. The Privacy Policy lists every provider.
The browser extension
The xMap Flows browser extension sets no cookies and keeps no browsing history. In its own storage in your browser it keeps your sign-in (xf_ext_auth: a key that can only read and look businesses up, and the organization you picked) and how it registered with xMap Flows (xf_ext_client), until you sign out or remove it; and, until the browser closes, the address of the page you pressed its button on (xf_ext_page), to hand it to its panel. The Privacy Policy says what it sends.
Managing cookies in your browser
You can also see, block or delete cookies and storage in your browser’s settings. Blocking the xf_session cookie stops you from signing in. Deleting storage removes your layout choices and anything kept for later, and you will be asked about cookies again.
Changes to this policy
When we add, change or remove a cookie or an item of storage, we update this page and the date at the top. If a change needs your agreement, we ask again.
Contact
Questions about cookies or your privacy: legal@xmap.ai. By post: xMap Ltd., 20 Bay St., Suite 1100, Toronto, Ontario M5J 2N8, Canada. The Privacy Policy explains how we handle personal data and your rights.