Legal

Cookie policy

Last updated July 2026

What this page covers

  • What a cookie is, in plain English.
  • The one optional choice we ask you to make, and how to change it any time.
  • Every cookie we set, what it does, and how long it lasts.
  • What we deliberately do not use.

About 4 minutes to read.

What is a cookie?

A cookie is a small piece of information a website asks your browser to remember between pages. Some are necessary: without them you would have to sign in again on every screen. Others, such as analytics cookies, are optional. This page lists every cookie Formclock uses, and lets you control the optional one.

Analytics, and the one choice we ask you to make

Two things measure how the site is doing, and they are very different.

Vercel Web Analytics runs on every visit and is first-party and cookieless: it counts page views. It sets nothing on your device and cannot identify you or follow you across other sites, so there is nothing to consent to.

Google Analytics is optional and off until you say otherwise. On the marketing site we show a small banner with Accept and Decline. If you Decline, or ignore it, Google Analytics never loads and sets no cookies. If you Accept, it loads with IP anonymisation and Google's Consent Mode, and sets the cookies listed below. You can change or withdraw your choice any time with the Cookie preferences link in the footer, which reopens this banner.

Cookies we set

Every cookie, what it is for, who sets it, whether scripts can read it, and when it expires.

CookieWhat it is forSet byScript-readableExpires
fc_consentRemembers whether you accepted or declined analytics, so we do not ask on every page. Set only once you choose.The consent bannerYes1 year
fc_orgWhich workspace you are working in. Necessary.Formclock serverNo1 year
fc_actorWhich employee you are acting as. In production it is only honoured alongside a real signed-in session, so it cannot be used to impersonate anyone. Necessary.Formclock serverNo1 year
fc_signup_intentRemembers you clicked sign up rather than sign in, so returning from Google lands you in the right place. Necessary.Formclock serverNo10 minutes
sidebar_stateRemembers whether you collapsed the navigation. A preference, and the interface reads it.The interfaceYes1 week
Auth.js sign-inYour sign-in session, a CSRF token, and a callback URL. Strictly necessary: without them you cannot sign in, and the CSRF token helps stop somebody submitting a form as you.Auth.js, our sign-in libraryNoSession cookie: 7 days
_ga and _ga_IDSet by Google Analytics to count a visit once rather than twice. Only ever written if you accept the banner.Google Analytics (opt-in)YesUp to 2 years

Stored in your browser, but not cookies

Your email address, if you have signed in before, so the sign-in screen can offer it back to you instead of making you type it again. It never leaves your browser except when you sign in.

A random device identifier on a shared clock-in tablet, which lets us rate-limit PIN attempts per device rather than per workspace. It identifies the tablet, not the person.

Your theme preference, and whether you dismissed the setup checklist.

All of these are held in your browser's local storage, and clearing your browser data removes them.

What we do not use

No advertising or remarketing pixels. No Facebook, LinkedIn or X tracking. No session recording or heatmaps. No PostHog, Mixpanel or Segment. No support chat widget. Google Analytics runs in Consent Mode with every advertising signal switched off, so even when you accept it, it is measurement only and feeds no ad network.

Google Analytics is never placed on the page until your consent cookie says yes, so declining means it does not load at all. On top of that, our content security policy blocks the browser from contacting any third party except the analytics hosts named on this page, so nothing else can be added quietly by accident.

Contact

Questions about cookies or your data: privacy@formclock.com.