The marketing site at ferrfleet.com sets no cookies. The only browser storage it touches is localStorage for the language pill state (en / fr) and the cookie-banner dismissal flag. Both are first-party, both are user-controllable.
app.ferrfleet.com
The product app sets these cookies. Names, scope, and lifetime:
| Cookie | Purpose | Lifetime | Scope |
|---|---|---|---|
fl_session | Session JWT (httpOnly, Secure, SameSite=Lax). Set by auth.ferrfleet.com (the BFF) on successful login. | 7 days | .ferrfleet.com |
fa_oauth_state | One-time CSRF state for the OAuth callback. Used during login redirect, deleted immediately after. | session | app.ferrfleet.com |
Third-party cookies
None. FerrFleet does not embed analytics scripts (no Google Analytics, no Plausible third-party, no Segment). Server-side telemetry is opt-out at the org level — see ferrlabs.com/telemetry.
Control
You can clear cookies via your browser. Deleting fl_session signs you out of the app. The marketing site has nothing to clear.