Cookie Policy
Last updated: 2026-08-03
What are cookies?
Cookies are small text files stored on your device by websites you visit. They help sites keep you signed in, remember preferences, and (on many sites) measure usage or show ads. FormHeron uses cookies only for authentication.
What we use
FormHeron sets strictly necessary first-party cookies so signed-in customers can use the dashboard. We do not set analytics cookies (no Google Analytics, Hotjar, or similar), marketing pixels (no Meta, Google Ads, Reddit Ads), or preference/theme cookies.
Anonymous marketing pages (home, docs, blog, pricing) do not set tracking cookies. Session cookies appear only after you sign in via magic link.
In production, cookie names are prefixed with __Secure- (for example __Secure-better-auth.session_token). Attributes: HttpOnly, Secure (production), SameSite=Lax.
Cookie inventory
| Cookie name | Type | Purpose | Duration | How to opt out |
|---|---|---|---|---|
better-auth.session_token | Essential | Keeps you signed in after magic-link authentication so the dashboard can load your account. | 30 days (absolute expiry; rotated on sign-in) | Sign out, or clear site cookies in your browser. Required for signed-in use; cannot be disabled while using the dashboard. |
better-auth.session_data | Essential | Short-lived cache of session metadata so the server does not re-read the database on every request. | 5 minutes | Sign out or clear site cookies. Required for signed-in use; cannot be disabled while using the dashboard. |
Third-party cookies
FormHeron does not embed third-party analytics or ad tags that set cookies on our domain. Related services may set their own cookies when you use those features:
- Cloudflare Turnstile (optional, on your forms): if you enable Turnstile with your own keys, Cloudflare may set cookies under
challenges.cloudflare.comduring the challenge. See Cloudflare's privacy policy. Captcha analytics stay in your Cloudflare account. - Dodo Payments(billing checkout): when you upgrade or manage a paid plan, you leave FormHeron for Dodo's checkout. Dodo may set cookies on its domain under its own policy as Merchant of Record.
Full list of infrastructure providers: Sub-processors.
Consent and notice
Because FormHeron uses only strictly necessary cookies for the service to work (authentication), we do not show an interactive cookie consent banner with accept/reject categories. EU ePrivacy rules treat strictly necessary cookies as exempt from prior consent when they are required to provide a service the user requests (here: staying signed in).
If we ever add non-essential cookies (analytics, advertising, or non-essential functional tracking), we will add a consent mechanism that is as easy to reject as to accept, and we will update this page.
How to manage cookies
- Sign out from the FormHeron dashboard to end the server session and clear session cookies where the app can.
- Browser settings — clear or block cookies for
formheron.com: - Mobile: use site settings or browser cookie controls in iOS Safari or Android Chrome for this domain.
- Effect of disabling: blocking essential session cookies will sign you out and prevent use of the dashboard. Public pages remain usable.
Do Not Track (DNT)
FormHeron does not currently respond to browser Do Not Track signals. There is no uniform industry standard for DNT, and we do not run third-party tracking cookies that DNT would typically control. Our only first-party cookies are essential for authentication.
Updates
We may update this Cookie Policy when our cookie use changes. The "Last updated" date at the top will change. Material changes will also be reflected in the Privacy Policy.
Contact
FormHeron is operated by an individual in India. Questions: [email protected]. Related: Privacy Policy.
This page describes current product behaviour for transparency. It is not legal advice. Jurisdiction-specific obligations (including ePrivacy, GDPR, CCPA/CPRA, and India's DPDP Act) may require formal legal review for your situation.