IPForge

Draft — not yet in force. Two values are still being settled: the operator's registered legal name and the governing law. They are shown as PENDING below rather than guessed. Until they are filled in, these documents describe how IPForge works and what it undertakes, but no effective date is claimed for them.

IPForge legal · Updated 2026-09-23

Cookie Notice

ipforge.xyz sets four cookies. Three are strictly necessary — without them you cannot sign in or submit a form safely. One is not: it records which campaign or site sent you, and it is listed here as what it is rather than filed under “essential”.

There are no advertising cookies, no third-party analytics, and no trackers from anyone else on this site.

1. The cookies

authjs.session-token

Keeps you signed in to the dashboard. Set when you sign in, read on every dashboard request, deleted when you sign out.

Until you sign out, and at most 30 days. · Strictly necessary

authjs.csrf-token · authjs.callback-url

Protects the sign-in form against cross-site submission and remembers where to return you after signing in.

The sign-in flow only. · Strictly necessary

delivery_action_csrf

Protects the confirmation page of a delivery test against cross-site submission. Set only if you open such a page.

15 minutes. · Strictly necessary

ff_attr

Records how you first arrived at the marketing pages — the campaign or referring site, if there was one — so that if you later create an account we know which channel brought you. It is read once, at signup.

1 year. · Not strictly necessary — marketing attribution

2. A tracked link sets no cookie at all

This notice is about ipforge.xyz itself. When someone opens a link, landing page or tracking image created in a workspace, no cookie is set and nothing is written to their browser storage. The measurement is made from the request and from signals the browser is asked for at that moment; a repeat visit within 24 hours is recognized by a hash of those signals, not by anything left on the device.

What is collected instead is listed in full in the Privacy Policy, Part B. It is more, not less, than a cookie would tell you — which is exactly why it is written out there in detail.

3. Refusing them

Every browser can block or clear cookies for a single domain. Blocking the three necessary ones means you cannot sign in — everything else still works. Blocking ff_attr costs you nothing at all; the only consequence is that we do not learn which campaign brought you.

There is no consent banner on this site today. If that is the wrong answer for where you are, tell us at admin@ipforge.xyz — the attribution cookie is the only one a banner would be about.