Cookies and privacy
Coming soon. Web tracking isn't generally available yet — today it runs only on pages and forms published from the app. See Overview for what's live now.
This page exists so you can answer the question "what does your tracking actually store?" without having to ask anyone. If your legal or privacy team wants specifics, this page has them.
The short version
Web tracking sets three first-party cookies on your own domain. They hold two random identifiers and a record of the visitor's consent choice. They do not contain names, email addresses, phone numbers, or anything readable.
They are first-party — set on your domain, readable only by your site. They are not third-party cookies, they are not shared with other companies, and they cannot be used to follow someone around the rest of the web.
The three cookies
| Cookie | What's in it | How long |
|---|---|---|
_tfy_vk | A random visitor ID. Meaningless on its own. | 13 months |
_tfy_ih | A scrambled, one-way version of the visitor's email address — only set once they've identified themselves. | 13 months |
_tfy_c | Whether the visitor granted or denied consent. | 13 months |
All three are set with SameSite=Lax, and with Secure on any site served
over HTTPS.
On _tfy_ih, the scrambled value: it is produced with a one-way function
and a secret unique to your account. It cannot be reversed into an email
address, and the same person visiting a different company's site using this
platform produces a completely different value — so the two can never be
matched up.
These cookies are the only place these values are kept. Earlier versions also wrote a copy into the browser's local storage; that copy was never read back, so it was removed rather than left sitting on visitors' devices.
Why they last 13 months
Long enough to recognise a returning visitor across a full year plus a month, which is what makes year-on-year comparisons work. It also matches how long anonymous visit data is kept before deletion — there's no point holding an identifier for a visitor whose data has already gone.
Subdomains
The cookies are set on your registrable domain, so example.com,
www.example.com and shop.example.com all see the same visitor. Someone
moving between your main site and your shop isn't counted twice.
We work out the right domain automatically. If your setup is unusual, it can be set explicitly — see Installing the script.
What we don't do
- No fingerprinting. We don't identify people from their device, screen size, fonts, or behaviour.
- No third-party cookies. Nothing that can track someone across other websites.
- No cross-site tracking. Different customers of this platform never share visitor identities, even for the same person.
- No selling or sharing data. Your visitor data is yours.
- No capturing what people type. Only an email address or phone number, and only when they submit a form — see below.
What's captured from forms
Only two things: an email address and a phone number. Everything else a visitor types — names, messages, order details, payment fields — is discarded in the browser and never sent.
By default this happens only when someone actually submits the form. Capturing as they type is available but switched off, deliberately: an address someone typed and then thought better of is not something they chose to give you.
Two kinds of field are always skipped
Passwords. Never captured — not when the field is a normal password box, and not when your form has a "show password" toggle that turns it into ordinary text. The check looks at the field's name and its autocomplete setting too, so revealing a password cannot expose it to us.
Someone else's contact details. Fields that ask for a third party — refer-a-friend, gift recipient, invite a colleague, CC/BCC — are skipped, so the person being referred never becomes the identity attached to the visitor doing the referring. If a form has both, the visitor's own field is the one used.
Both checks work on whole words, so ordinary fields like passenger_email or
preferred_email still work normally.
Sensitive values in web addresses
Page addresses are recorded, because which pages people visit is the whole
point. But an address can carry things that shouldn't be stored — a
password-reset link is ?token=…, and a search form that submits with GET can
put an email address straight into the URL.
Where a parameter's name says its value is sensitive — token, code,
key, secret, session, auth, signature, password, email, phone
and similar — the value is replaced before anything is sent, in both the
page address and the referring address. The parameter name is kept, so you can
still see that a page had a token on it, just never what it was.
Ordinary parameters, including all your utm_* campaign tags, are untouched.
A note on Safari
Safari deletes cookies set this way after 7 days. Safari visitors will often look like new visitors after a week, which will make your visitor counts run higher and your returning-visitor rate lower than reality.
This affects every analytics tool, not just this one, and there's no workaround we can honestly offer. We'd rather you knew than wondered why the numbers look odd.
Is this GDPR compliant?
Compliance depends on how you use it, not on the tool alone — so the honest answer is "it can be, and here's what it gives you":
- Do-not-track is always respected. If a visitor's browser asks not to be tracked, nothing is sent. That's on by default and can't be switched off.
- Nothing is stored before consent when you've wired up consent — no cookies, no identifiers. See Consent.
- Data stays in your account. No sharing, no onward sale.
- Anonymous visit data is deleted after 13 months automatically.
- Deletion requests for an identified person can be honoured — their visits are attached to their contact record and go with it.
What you still need to decide: whether your jurisdiction requires consent before setting these cookies, and what your privacy policy says. That's a conversation for your legal advisor, and this page has the detail they'll ask for.
Telling your visitors
If you keep a cookie list in your privacy policy, the table above is what to put in it. A plain-language version:
We use cookies to recognise returning visitors and to understand which pages people find useful. If you contact us, we link that browsing to your enquiry so we can respond helpfully. These cookies are set by us, are not shared with other companies, and cannot track you on other websites.