Cookie & Tracking Policy

Effective Date: April 2026 · Last Updated: September 23, 2026

PowerHouseTech LLC dba VolunteerFlow ("VolunteerFlow") uses a small number of cookies to keep you signed in and remember your preferences. This policy explains what cookies and tracking technologies we use, how we use them, and your choices regarding their use.

1. What Are Cookies

Cookies are small text files placed on your device when you visit a website or use a web application. Session cookies are deleted when you close your browser. Persistent cookies remain on your device until they expire or you delete them. Cookies cannot execute code, download files, or spread viruses.

2. Types of Cookies We Use

2.1 Cookies We Set

We set the following first-party cookies. All except the language cookie are required for sign-in and cannot be disabled:

Cookie	Purpose	Expiry	Type
vf_token	Keeps an organization user signed in. httpOnly and Secure, so page scripts cannot read it.	7 days, or 30 days with “remember me”	Required
vf_portal_token	Keeps a volunteer signed in to the volunteer portal. httpOnly and Secure.	7 days	Required
vf_staff_token	Keeps a VolunteerFlow staff member signed in to the internal staff console. httpOnly and Secure.	Up to 8 hours	Required
vf_2fa_pending	Holds a sign-in in progress while you enter a two-factor code.	5 minutes	Required
vf_support_tab	Marks a browser tab a VolunteerFlow support agent is using to view an account, so support sessions stay separate.	Session	Required
vf_lang	Remembers the language you chose.	1 year	Preference

2.2 Performance Measurement

We use Vercel Web Analytics and Speed Insights to count page views and measure page performance (Core Web Vitals). They do not set cookies and do not identify individual visitors.

2.3 Session Recording

We do not record user sessions. No session replay or screen recording tool is enabled.

2.4 Real-Time Messaging

Socket.IO maintains session-based connections for instant messaging and real-time notifications. These connections are terminated when your session ends and do not persist beyond the active session.

3. Third-Party Content

Some pages load content from other companies, which may set their own cookies or receive your IP address. We do not control these cookies; each is governed by that company's privacy policy:

Stripe (stripe.com/privacy), during checkout for a VolunteerFlow subscription.
Square (squareup.com/legal), on donation, store, and kiosk payment pages.
YouTube and Vimeo, when an organization embeds a video, for example in a training course.
Google Fonts, when an organization chooses a custom font for its branding.

4. IP Address Collection

IP addresses are collected by VolunteerFlow and our hosting providers for routing and service delivery, security and fraud prevention, and diagnosing errors. IP addresses are not sold to third parties. Sign-in session records, which include the IP address, are deleted 35 days after they are created.

5. Your Choices

Sign-in cookies: Cannot be disabled; they are required for sign-in to work.
Language cookie: Delete it in your browser settings; the site falls back to your browser language.
Third-party content: Use your browser's cookie controls to block third-party cookies.

Most browsers allow you to refuse cookies or alert you when a cookie is being set. You can view and delete cookies from your browser settings. Be aware that disabling sign-in cookies will prevent you from staying signed in.

6. Do Not Track

We do not currently respond to Do Not Track (DNT) browser signals. You can still use your browser's cookie controls to limit tracking. We may choose to honour DNT signals in the future.

7. Pixel Tags and Web Beacons

We do not use pixel tags, web beacons, or advertising trackers.

8. Updates to This Policy

We may update this Cookie and Tracking Policy to reflect changes in our practices or technology. Material changes will be notified via email. Continued use of VolunteerFlow after the effective date of updates constitutes acceptance of the revised policy.

For questions about this policy, contact legal@volunteerflow.us.

This policy should be read alongside our Privacy Policy.