Loading
Skip to main content

Cookie Policy

Last updated: October 28, 2026 — Version 1.5

This policy explains how Pictoflow uses cookies and similar technologies on the Pictoflow website and application (the "Service"). It complements our Privacy Policy.

1) Who is responsible?

Data controller: Timothée Miminoshvili, sole proprietor (trade name TEL-MI Labs) — 72 rue de Dantzig, Hall 14, 75015 Paris, France — SIREN 847 659 216 — Contact: contact@pictoflow.com
Data protection contact: Timothée Miminoshvili — dpo@pictoflow.com.

2) What is a cookie?

A cookie is a file stored on your device (computer, mobile, etc.) that allows information to be stored or retrieved. Other trackers may work similarly (localStorage, IndexedDB, SDK).

3) What Pictoflow uses — and does not use

Pictoflow uses trackers that are strictly necessary for the Service to work, and a cookie-free visit measurement on its public pages.

  • ✅ A visit measurement with no cookie and no identifier, limited to public pages (section 5)
  • ❌ No advertising or marketing tracker
  • ❌ No profiling
  • ❌ No measurement on the child's screen (Dashboard) or in the management space (Editing)

In accordance with article 82 of the French Data Protection Act, trackers that are strictly necessary to provide the service are exempt from consent. The visit measurement is exempt too, because it meets the conditions set by the CNIL: anonymous statistics, for our own use only, no tracking from one site to another. This is why Pictoflow shows a simple information banner on your first visit, without asking you to make any choice — there is nothing to accept or refuse. You can, however, object to the visit measurement (section 5).

If we were ever to introduce a tracker subject to consent, your consent would be collected before anything is set, and this policy would be updated.

4) Strictly necessary trackers used

Tracker Purpose Duration
Authentication session (localStorage, Supabase) Keep you signed in to your account Until logout
Information banner memory (localStorage) Avoid showing the banner again on every visit 6 months
Display preferences (localStorage) Theme, font, display size, timer settings — set by you Until deletion
Technical device identifier (localStorage) Count your devices (device limit) and list them in “My devices” Until deletion
Discovery mode data (IndexedDB) Run the Visitor mode, without an account, entirely on your device Until deletion
Parental lock (localStorage) Remember the Parental Gate mode on the device Until deletion
Anti-bot protection (Cloudflare Turnstile cookies, e.g. __cf_bm) Secure sensitive forms (sign-up, sign-in, account deletion) About 30 minutes
Visit measurement refusal (localStorage) Remember your objection, if you express it Until deletion

These trackers are never used to track you, neither for advertising nor to measure visits.

5) Visit measurement
Tool Cloudflare Web Analytics
Pages measured Home, about, guides, sign-up — and no other
What is measured Page viewed, domain of the site you came from, country, device type, browser, operating system, load time, and page performance indicators (how fast it displays and responds), together with the technical name, in the page's code, of the elements concerned (for example the title or an image) and the address of the main file displayed (for example the illustration image). This address may contain technical display settings, such as the image's width or quality, never any information about you
What is not No cookie, nothing stored on your device, no identifier, no tracking from one visit to the next, no parameters in the address of the page you are viewing
Retention 6 months
Your objection Button below — your choice is remembered on this device until you clear the site's data

6) Your means of control

  • Browser settings: you can block or delete cookies and local storage — the Service may then stop working properly (unable to stay signed in, lost preferences).
  • Visit measurement: object in one click (section 5). Ad blockers often prevent it as well.
  • This policy can be accessed at any time from the website footer.

7) Transfers outside the European Union

The anti-bot protection (Turnstile) and the visit measurement (Web Analytics) are provided by Cloudflare, a company established in the United States: the minimal technical data they process is governed by the European Commission's standard contractual clauses and/or its certification under the EU–US Data Privacy Framework. All other trackers listed above stay on your device or within the European Union.

8) Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, portability and objection — details and procedures in our Privacy Policy.

9) Contact and complaints

10) Updates to this policy

This policy may be updated to reflect changes in our practices, new legal requirements, or the addition of new services. You will be notified of significant changes via the website or by email.

Version history:

  • 1.0 (December 2024) - First GDPR/CNIL compliant version
  • 1.1 (July 2026) - Real data controller, marketing section aligned with actual trackers
  • 1.2 (July 2026) - Aligned with actual trackers: removal of audience measurement and of irrelevant categories, information banner (strictly necessary trackers only), actual transfers
  • 1.3 (September 2026) - brand spelling, no substantive change
  • 1.3.1 (October 2026) - Purpose of the technical device identifier corrected (device limit and “My devices” list, not synchronization), no substantive change
  • 1.4 (October 2026) - Cookie-free visit measurement of public pages (Cloudflare Web Analytics), dedicated section and right to object
  • 1.5 (October 2026) - Visit measurement: “What is measured” completed with page performance indicators (elements concerned, address of the main file displayed); “What is not” clarified (no parameters in the address of the page viewed)

Last updated: October 28, 2026