What are cookies?
Cookies are small text files that a website places on your device when you visit. They allow the site to remember information about your visit (such as your preferences or whether you are logged in) and to function correctly across page loads and sessions. Cookies are not programmes; they cannot run code or access other data on your device.
Similar technologies, such as localStorage and sessionStorage, work analogously to cookies and are covered by this policy where we use them.
How Formward uses cookies
Formward uses a minimal set of cookies. We have organised them into the categories below, consistent with the consent manager embedded in this site. We will only activate marketing cookies after you have given explicit consent. The Analytics category covers cookieless statistics, which run unless you switch them off (see below).
Essential cookies
Essential cookies are strictly necessary for the Service to function. They do not require your consent under ePrivacy rules and cannot be disabled through the consent manager (though you can block them in your browser settings, which will prevent the Service from working correctly).
| Cookie / Key | Purpose | Retention | Party |
|---|---|---|---|
| better-auth. | Authenticates your logged-in session. Set by our own better-auth instance; never shared with third parties. | Session / 30 days | First party |
| formward_ | Stores your cookie consent preferences (accepted/ | 6 months | First party |
| __stripe_ __stripe_ | Set by Stripe during the payment checkout flow to prevent fraudulent transactions and to associate your browser with a checkout session. Only present when you initiate a subscription upgrade or billing change. | 1 year / session respectively | Stripe (third party) |
| better-auth. | Lets the browser that opens your email verification link sign in once, so the account is not left unsigned after you verify. Holds a signed, single-use ticket, readable only by our server, and is removed as soon as it is used. | Up to 15 minutes | First party |
| NEXT_ | Remembers the language you chose for the signed-in app, so your pages open in it. Holds only the language code. It is not set from visits to the public pages. | 1 year | First party |
| fw_wizard_ | Keeps the name and notification address you typed in the create-form wizard when the wizard redirects you back to it, so you do not retype them. Readable only by our server. | 2 minutes | First party |
| formward. (localStorage) | Keeps the form you start building on the /build page before you sign up, so it is still there after signup. It stays in your browser until you verify your email and the form is created. | 7 days | First party |
| fw-page-<slug> | Remembers that you entered the password of a password-protected Formward Page, so you can keep reading it. One cookie per page, signed and readable only by our server. | 1 hour | First party |
| __Host-formward- | Keeps you signed in to a respondent portal after you follow your login link. Holds a random session value, readable only by our server. | 12 hours | First party |
| __Host-formward- | Binds a portal login link to the browser that asked for it, so the link cannot be used from another browser. Removed once the login completes. | 5 minutes | First party |
Analytics cookies
We do not set any analytics cookies. We do measure page views on our website and in the signed-in dashboard, but without cookies, using two tools: our own first-party counter, running on our own EU infrastructure, and Plausible Analytics (Plausible Insights OÜ, Estonia, with data hosted in the EU). Neither writes anything to your device, the only thing our code reads is your own consent choice (so that a no is honoured), and no Plausible script is loaded: page views are sent through our own domain. So there is nothing here to consent to under the ePrivacy Directive. Our counter records the page path, an external referrer hostname, a country resolved from a local offline lookup, and a daily-rotating keyed hash of your IP; never a raw IP. Plausible receives the page address with identifiers removed, the referring site's host, your browser's user agent and your IP address, and stores neither the IP address nor the user agent. Besides page views we send Plausible two events with no further detail: that an account was created and that a form was created. See section 2.6 of our Privacy Policy for the detail. Even though no consent is required, turning off the Analytics category in our consent manager stops both, as does a Global Privacy Control signal from your browser.
| Cookie / Key | Purpose | Retention |
|---|---|---|
| None currently set | ||
Optional session recording
Session recording is optional and off by default. It is a choice for your signed-in account, stored on our server with the date and wording version, and not in your browser. It is never switched on by Accept all or by an analytics choice, and it does not apply to visitors who are not signed in. Where the feature is enabled, we ask once with a short, dismissible note in the dashboard. You can switch it on or off at any time under cookie settings (when signed in) or in Account settings; switching it off deletes your recordings. Masked recordings cover only signed-in form creation and setup, are linked to your account, stored on our own EU infrastructure and deleted after seven days. See the Privacy Policy for masking, access and retention. A localStorage timestamp synchronizes consent changes between your open tabs; it is not an analytics identifier.
Marketing cookies
We do not set advertising cookies and we use no third-party marketing cookies. The one cookie in the marketing category is our own partner referral cookie. It is set only when you arrive through a link shared by a partner of the Formward Partner Program, and it holds nothing but that partner's code, so that the partner can be credited if you create an account. We do not set it if your browser sends a Global Privacy Control signal or if you have declined marketing cookies in the consent manager. We will update this policy and seek fresh consent before activating any other marketing cookies.
| Cookie / Key | Purpose | Retention |
|---|---|---|
| fw_ref | Remembers which partner's link you came from, so the partner can be credited if you sign up. Holds only the partner's code. First party, not readable by scripts. | 60 days |
Managing your cookie preferences
You can change your cookie preferences at any time via:
- Cookie settings control: Click "Cookie settings" in the site footer to reopen the consent manager and update your choices.
- Browser settings: Most browsers allow you to view, delete, and block cookies through their settings menu (typically under Privacy or Security). Blocking essential cookies will prevent you from logging in to Formward.
- Private / incognito mode: Cookies set in a private browsing session are typically deleted when you close the window.
For further information on managing cookies, visit allaboutcookies.org.
Changes to this policy
We will update this Cookie Policy when we add or remove cookies, or when regulatory guidance changes. Material changes will be reflected in the "Last updated" date above. Where the changes require fresh consent, the consent banner will reappear.
Contact
Questions about our use of cookies? Contact us at privacy@formward.eu.