Cookie Policy
Last updated: 12 July 2026
1. What Are Cookies
Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and improve your experience. We also use browser local storage for similar purposes where noted below.
2. Cookies We Use
We categorize our cookies into two groups: strictly necessary (required for the site to function) and analytics (only set after you grant consent).
a) Strictly Necessary Cookies
These cookies are essential for the website to work correctly. They do not require your consent under the ePrivacy Directive because they are necessary to provide the service you requested.
| Cookie Name | Purpose | Duration |
|---|---|---|
| next-auth.session-token | Authentication session — keeps you signed in | Session / 30 days |
| __Secure-next-auth.session-token | Same as above, used in production (HTTPS only) | Session / 30 days |
| next-auth.csrf-token | Protects against cross-site request forgery | Session |
| next-auth.callback-url | Stores redirect URL after sign-in | Session |
| fb_consent | Records your cookie consent choice (accept/reject) | 180 days |
| timezone | Stores your timezone for correct date/time display | 1 year |
b) Analytics Cookies
These cookies are only set after you click "Accept" on our cookie consent banner. They help us understand which pages and features are used so we can improve the product. They are never set on public form pages (your end-users' browsers are never tracked).
| Cookie / Storage | Purpose | Provider | Duration |
|---|---|---|---|
| ph_* | PostHog analytics session and identity | PostHog (first-party, proxied via /ingest) | 1 year |
| localStorage: ph_* | PostHog device identity and feature flags | PostHog (first-party) | Persistent until cleared |
3. Third-Party Services
We do not use any third-party advertising or marketing cookies. Analytics data is sent to PostHog via a first-party proxy (/ingest/*) on our own domain, so no third-party cookies are set by external domains. PostHog processes data on our behalf under a Data Processing Agreement.
Separately, we record a small number of aggregate, server-side product events (for example "a form received a submission" or "a subscription was created") tied only to the account holder's anonymous identifier. These do not set cookies or store anything on your device and contain no personal data, so they are processed as necessary business analytics under our legitimate interest, independent of the cookie choice above.
4. Managing Your Preferences
- Cookie banner: When you first visit, you can accept or reject analytics cookies. Your choice is stored in the
fb_consentcookie. - Settings page: Signed-in users can change their analytics preference at any time under Settings → Usage analytics.
- Cookie settings link: A "Cookie settings" link in the footer lets you reopen the consent banner at any time to change your choice.
- Browser settings: You can also delete or block cookies through your browser's privacy settings.
5. Data We Collect via Analytics
When analytics is enabled, we collect the following types of data. We do not collect your email address, name, or any other personally identifiable information via analytics.
- Pages visited and navigation patterns
- Anonymous, opaque account identifier (UUID)
- Browser type and version, operating system
- Screen resolution and viewport size
- Country-level geolocation (derived from IP; IP is not stored)
- Custom product events (e.g. "form created", "subscription started")
6. Contact
If you have questions about our use of cookies, contact us at security@formbuild.io.