Cookies
Last updated September 13, 2026
This is the whole list — not a sample. If you open your browser’s storage panel on this site, what you find should match the table below. If it does not, that is a bug and we want to hear about it.
The short version
Five cookies, all of them ours, all of them necessary: two keep you signed in, one remembers the early-access password while FollowForge is closed to the public, one exists for a few minutes while you connect a Google account, and one remembers the choice you make on this page. Nothing here follows you to other websites, and nothing here is shared with an advertising network — we do not use one.
The two optional things we ask about set no cookies at all. Crash reports and page counts are sent without any cookie, identifier or storage. We ask anyway, because the honest question is whether you want that data sent — not whether we technically had to ask.
Every cookie we set
| Name | What it does | How long |
|---|---|---|
sb-…-auth-tokenFollowForge (via Supabase) | Keeps you signed in. Without it every page load would ask for your password again. Set by our authentication provider; may be split across two cookies when the token is large. | Up to 1 year, refreshed as you use the app |
sb-…-auth-token-code-verifierFollowForge (via Supabase) | A one-time value that proves the sign-in you complete is the sign-in you started. It is what stops someone else finishing your login. | Minutes — deleted as soon as you are signed in |
ff_site_accessFollowForge | Remembers that you entered the early-access password, so FollowForge does not ask again on every page. It holds a signature and nothing about you, and it only exists while FollowForge is closed to the public. | 30 days |
ff_google_oauthFollowForge | Only exists while you connect a Google account. It proves the permission Google hands back is the one you asked for from this browser, which is what stops someone else attaching their Google account to yours. Encrypted; nothing in it is readable. | 10 minutes at most — deleted as soon as the connection finishes |
ff_consentFollowForge | Remembers the choice you made on this page, so you are not asked again on every visit. Holds a version number, two yes/no values and the date you chose. Nothing that identifies you. | 6 months, then we ask again |
All five are essential. FollowForge cannot sign you in, connect Google, or remember your choice without them, which is why they are not offered as a choice.
The two optional things
Crash reports. When a page fails to render, your browser can send us the error message, the technical stack behind it, and the path of the page it happened on. No cookie is set and nothing identifies you. Off unless you turn it on.
Page counts. A counter for each page, each day. There is no visitor id, no session, no device fingerprint and no per-visit record — the server increments a number and forgets. That means these counts cannot be broken down into an individual’s behaviour later, by us or by anyone who obtained the database. Off unless you turn it on.
Both refuse to send anything until consent is recorded, and the server checks that as well as the browser — so a stale page cannot keep sending after you change your mind.
What we do not do
No advertising cookies. No tracking pixels. No social media embeds. No third-party analytics service. No cross-site tracking of any kind, because nothing on this site is loaded from another company’s domain.
If you use a paid plan in future, Stripe sets its own cookies on Stripe’s checkout pages while you are on them. Those are Stripe’s, governed by Stripe’s policy, and they are not set on this domain.
Changing your mind
Your choice is stored for six months, then we ask again. You can change it whenever you like:
You can also delete cookies in your browser settings at any time. Deleting the sign-in cookies logs you out; deleting the consent cookie means we ask again on your next visit.
Questions
See also our Privacy Policy and Terms of Service.