Cookie notice
Version: 14 October 2026
This notice lists the cookies and the browser storage that Hyfo uses on your device. It was drawn up from what the service sets. The cookies set by the sign-in provider come from its own software.
1. What is and is not used
- Hyfo does not use advertising cookies, analytics or tracking cookies, and no advertising or analytics service is built into it.
- Entries in the “strictly necessary” category are needed for the service to work or for something you have asked it to do, such as signing in, so they are set without asking.
- “Preference” entries only remember a choice you made or the state of the screen, such as a collapsed menu, a column width or the day a greeting was last shown. They hold no personal data.
2. Consent
Hyfo shows no cookie banner. For the strictly necessary entries none is needed. The preference entries are a small number of settings you set yourself, and we have treated them in the same way. Whether that is right, and the position for preference storage in particular: [to be confirmed before launch].
3. The list
| Name | What it does | Type | Category | How long it lasts | Set by |
|---|---|---|---|---|---|
| hyfo-active-org | Remembers which company's workspace you are working in, for people who belong to more than one. Holds an organisation identifier only. | Cookie | Strictly necessary | 1 year | This service |
| hr_access | Keeps the HR Hub unlocked after the owner enters the HR passcode. Signed, and tied to one person in one workspace. | Cookie | Strictly necessary | 4 hours, and only on the HR pages | This service |
| hr_lockout | Counts wrong HR passcode attempts so the HR Hub can lock for 15 minutes after five. | Cookie | Strictly necessary | 1 hour | This service |
| Internal name | Set while an owner is using "View as" to look at the service as another person. Holds that person's identifier. | Cookie | Strictly necessary | Until the browser is closed | This service |
| Internal name | Set while the platform operator is using "View as" in the Hyfo console to look at the service as one of its users. Holds that membership's identifier. Only ever honoured for the operator. | Cookie | Strictly necessary | 2 hours | This service |
| qbo_oauth_state | A security check while an owner or admin connects QuickBooks: it proves the reply came from the request they started. | Cookie | Strictly necessary | 10 minutes | This service |
| xero_oauth_state | A security check while an owner or admin connects Xero: it proves the reply came from the request they started. | Cookie | Strictly necessary | 10 minutes | This service |
| __session | Keeps you signed in: the session token. | Cookie | Strictly necessary | A short-lived token that Clerk renews while you are active; exact lifetime [to be confirmed before launch] | Clerk |
| __client_uat | Tells the service whether a session exists and when it was last updated. | Cookie | Strictly necessary | [to be confirmed before launch] | Clerk |
| __refresh_ followed by an identifier | Renews the session token without asking you to sign in again. | Cookie | Strictly necessary | [to be confirmed before launch] | Clerk |
| hyfo-invitations-not-now | Remembers that you chose Not now on an invitation from another company, until you close the browser tab. | Session storage | Preference | Until the browser tab is closed | This service |
| sidebar-collapsed-groups | Remembers which groups in the sidebar menu you have collapsed. | Local storage | Preference | Until you clear it | This service |
| Internal name | Remembers whether the sidebar is open or closed. | Local storage | Preference | Until you clear it | This service |
| Internal name | Remembers where you moved the assistant launcher, whether you hid it, and the day its greeting last appeared. | Local storage | Preference | Until you clear it | This service |
| Internal name | Remembers the day a birthday or work anniversary celebration was last shown to you, so it appears once. | Local storage | Preference | Until you clear it | This service |
| Internal name | Holds a running timesheet timer in your browser until you stop or discard it. | Local storage | Strictly necessary | Until you stop or discard the timer | This service |
| Internal name | Remembers that you dismissed the prompt to install the app on your device. | Local storage | Preference | Until you clear it | This service |
| flo_changelog_seen | Remembers the latest "What's new" release you have seen, so the new-release mark clears. | Local storage | Preference | Until you clear it | This service |
| flo-doc-line-cols | Remembers the column widths you set in the quote and invoice line editor. | Local storage | Preference | Until you clear it | This service |
| hyfo:zipLayout | Remember whether you last asked for a receipts zip in folders or as one folder. | Local storage | Preference | Until you clear it | This service |
| flo:projectScope, flo:projectSort:v2, hyfo:retiredStagesNotice | Remember the scope and the sort order you chose on the projects list, and that you dismissed a one-off note there. | Local storage | Preference | Until you clear it | This service |
| flo.schedule.mobileView.v1, flo.myTasks.view.v1, flo.myCalendar.hiddenKinds.v1, flo.myCalendar.teamHiddenKinds.v1, flo.meetingProjects.v1 followed by a team identifier | Remember the view you chose on the mobile rota, on My tasks, and in a team's meeting and project lists, and what you switched off on My calendar. | Local storage | Preference | Until you clear it | This service |
| Internal name | In the Outlook add-in and the Teams tab only: keeps the connection token you pasted so you do not paste it again. | Local storage | Strictly necessary | Until you disconnect | This service |
| intake-draft- followed by part of the form's link code | On the client set-up form: keeps what a client has typed so far, on their own device, so a reload does not lose it. Removed when the form is sent. | Local storage | Strictly necessary | Until the form is sent or the client clears it | This service |
| hyfo-cache-v3 | Lets the app be installed and shows an offline page when there is no connection. It holds that page and the app's own images and scripts, never your pages or data. | Cache | Strictly necessary | Until the app is updated or you clear site data | This service |
Entries marked “Internal name” are stored under an internal key that is not shown here; the description says what each does. A development or preview copy of the service can set further sign-in cookies, with names beginning “__clerk”. The sign-in provider may also set short-lived cookies while you are redirected during sign-in.
4. Clearing them
You can delete cookies and site data in your browser's settings at any time. You will be signed out, and the preferences above will go back to their defaults.
5. Contact
Questions about this notice: hello@hyfo.uk.