Cookie Policy
Last updated: 4 October 2026
This policy lists every cookie and similar storage item Flipilo uses, and the third party content our pages load.
1. Cookies
| Name | Purpose | Type | Duration |
|---|---|---|---|
| flipilo_session | Keeps you signed in. Holds a random session token; cannot be read by page scripts and is only sent over HTTPS to flipilo.com. | Strictly necessary, first party | 90 days from your last visit, or until you sign out or the session is replaced on a newer device |
| flipilo_claim | Set only when you go to checkout. Holds a random one-time code so that, after you pay, this browser can be signed in to your new account. Cannot be read by page scripts. | Strictly necessary, first party | 2 hours, or until it is used |
Cloudflare, which protects our website, may also set its own security cookies (for example to tell people from bots). These are strictly necessary for security. See Cloudflare's cookie list.
2. Local storage on your device
The signed in app saves a few preferences in your browser's local storage. They stay on your device and are not sent to us automatically.
| Key | Purpose | Duration |
|---|---|---|
| flipilo_ad | Remembers the member name used for the fallback PIN sign-in (switched off for members, who sign in by email link); only set if that sign-in is used | Until you clear site data |
| flipilo_pc | Remembers the postcode you last searched from | Until you clear site data |
| flipilo_r | Remembers the search radius you last chose | Until you clear site data |
If you turn on notifications, your browser also stores a service worker and a push subscription for flipilo.com. This is needed for notifications to work and is removed when you turn notifications off or clear site data.
3. Third party content
We use Cloudflare Web Analytics, a cookieless analytics script loaded from static.cloudflareinsights.com. It does not set any cookies or use local storage on your device, and gives us only aggregated statistics about site usage. See our Privacy Policy.
Our sign-in page may show a Cloudflare Turnstile bot check, loaded in a small frame from challenges.cloudflare.com. It is used only to protect sign-in, is strictly necessary for security, and we do not use its optional pre-clearance cookie. See our Privacy Policy, section 2.2.
Our typeface is served from our own server. Car photos in the signed in app are loaded directly from AutoTrader's image servers (m.atcdn.co.uk), so when your browser fetches a photo AutoTrader receives your IP address and browser details, as with any web request.
4. Advertising cookies (only if you accept)
On our public pages (the home page, the free trial page and the page you return to after checkout) we ask whether you accept advertising cookies from Meta (Facebook and Instagram). Nothing from Meta is loaded unless you press Accept. If you accept, the Meta Pixel is loaded from connect.facebook.net and we tell Meta when you view our home page, send the free trial form and start a free trial, so we can measure which of our ads work and show them to similar people. We also send these same events to Meta from our server, matched using the identifiers below and a scrambled (hashed) copy of your email address. If you reject, none of this happens, from your browser or from our server.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| fl_consent | Remembers whether you accepted or rejected advertising cookies | Strictly necessary, first party | 180 days |
| _fbp | Set by the Meta Pixel to recognise your browser for ad measurement. Only if you accept. | Advertising, Meta | 90 days |
| _fbc | Set by the Meta Pixel when you arrive from a Meta ad, to link the visit to that ad. Only if you accept. | Advertising, Meta | 90 days |
You can change your mind at any time: change cookie settings. The signed in app does not load the Meta Pixel. Meta's own use of this data is covered by Meta's Privacy Policy.
5. Managing storage
You can delete cookies and site data in your browser settings. If you delete the session cookie you will be signed out.
6. Contact
Questions: [email protected]. See also our Privacy Policy.