LEGAL
Cookie Notice
Every cookie and piece of browser storage FileMentra uses, what it is for and how long it lasts.
- Effective
- September 22, 2026
- Last updated
- September 22, 2026
- Provided by
- LUMI TECHOLOGY CORPORATION - FZCO
1. What we use and why
Cookies are small files a website stores in your browser. Browser storage (session storage and local storage) works in a similar way but never leaves your device on its own. FileMentra uses both where they are strictly necessary to provide the service you asked for, with two exceptions described below: fm_first_touch, which records which of our tagged links brought you to the site, and Google’s and Meta’s ad cookies on our public pages. All our cookies are first-party, are sent only to FileMentra, and are marked Secure and HttpOnly so that scripts cannot read them.
2. Cookies
| Name | Purpose | Duration |
|---|---|---|
| __Host-filementra_session | Keeps you signed in to a workspace. Without it you cannot use the app | Up to 12 hours, and ends sooner after inactivity |
| __Host-filementra_account_pass | Remembers that you have signed in while you choose a workspace | 15 minutes |
| filementra_oauth | Protects a sign-in with Google against forgery | 10 minutes |
| filementra_oauth_connect | Holds a pending Google connection until you confirm it with your password | 15 minutes |
| filementra_onetap | Ties Google’s “Continue as” prompt on the sign-in page to your browser, so the answer cannot be replayed elsewhere | 10 minutes |
| filementra_room_guest | Keeps a guest signed in to a Room after the email code | Up to 4 hours |
| fm_first_touch | Set only when you arrive on one of our tagged links, such as an ad. Holds that link's campaign labels, the page you landed on, the site that sent you and the time. When you set up a workspace, it is stored with the workspace so we can tell which ads bring signups, and the cookie is deleted. It holds no identifier and is never shared | 30 days, or until you set up your workspace |
3. Browser storage
| Key | Purpose | Duration |
|---|---|---|
| filementra.registrationEmail (session storage) | Shows the address you registered with on the “check your inbox” screen | Until you close the tab |
| filementra-transfer-token (session storage) | Keeps the secret of a transfer you are receiving out of the address bar | Until you close the tab |
| filementra-signing-token (session storage) | Keeps your signing link secret while you sign a document | Until you close the tab |
| filementra-vault-session (session storage) | Keeps a Vault guest signed in after the email code | Until you close the tab, at most 12 hours |
| fm_ad_consent (local storage and cookie) | Remembers whether you allowed or refused Google’s analytics and ad cookies and Meta’s ad cookies; the cookie copy lets our server respect the same choice | Local storage until you clear it; the cookie 1 year |
| filementra-sidebar-collapsed (local storage) | Remembers whether you collapsed the menu | Until you clear it |
4. Third parties
On our public website pages (the home, product, pricing, help and legal pages, not the app, shared links, signing or guest pages) we load Google’s tag (gtag.js) for Google Ads (AW-18460028746) and Google Analytics (G-XWJ44WDZSL). With your consent, or where the law does not ask for it first, it may set Google’s cookies: _ga and _ga_XWJ44WDZSL, which tell visits to our website apart for Google Analytics, for up to 2 years, and _gcl_au, which links a visit to the ad that brought it, for up to 90 days. Analytics receives only our public pages, with their addresses cleaned of anything but campaign tags. Without consent it runs in Google’s consent mode: it sets no cookies and sends Google only anonymous signals that a page was viewed. Google handles this data under its own privacy policy.
On the same public pages we load Meta’s pixel (fbevents.js, pixel 1614063203694307), so we can see which of our Facebook and Instagram ads bring visits, signups and paid plans. With your consent, or where the law does not ask for it first, it sets Meta’s _fbp cookie, which links a visit to the ad that brought it, for up to 90 days; where consent is required it does not load at all until you allow it. Besides page views it records only that someone looked at a product or pricing page, opened the sign-up page, created an account, started a paid plan or sent a sales enquiry: those last three are sent from the moment they happen, with nothing about your files. When you create an account, our server also tells Meta directly (Meta’s Conversions API), under the same consent, so the signup is counted even if the pixel is blocked: it sends your email address and account id only as one-way hashes, with your IP address, browser type and the _fbp and _fbc cookies, which Meta uses to match the signup to the ad that brought it. Meta’s automatic event detection is switched off. Meta handles this data under its own privacy policy. Our payment page is provided by Stripe, which sets its own cookies to prevent fraud when you pay; see Stripe’s privacy policy. Our network provider Cloudflare may set a strictly necessary cookie to protect the site against attacks.
Our sign-in page, and only that page, offers Google’s “Continue as” prompt for people already signed in to Google. To show it, the page loads Google’s sign-in script, which may set Google’s own cookies (such as g_state, which remembers that you closed the prompt) and lets Google know that the sign-in page was opened. If you choose to sign in with Google, Google’s pages set their own cookies too. Google handles this under its own privacy policy.
5. Your choices
You can delete or block cookies and browser storage in your browser settings. Blocking our own cookies will stop sign-in, guest access and transfers from working; refusing Google’s or Meta’s ad cookies above changes nothing about how FileMentra works. More about how we handle personal data is in our Privacy Notice. Questions: [email protected].