Legal
Cookie Notice
Every cookie and piece of browser storage hootform sets, and why.
Last updated 20 October 2026
hootform uses only what it needs to work, plus a few preferences you set yourself. There are no analytics, advertising or tracking cookies on hootform's website, dashboard or forms, which is why we don't ask you to accept any.
What hootform stores in your browser
| Name | Kind | Where | What for | How long |
|---|---|---|---|---|
hf_<form id> |
Cookie | A form's pages | Lets a respondent come back to an unfinished response | 30 days, or until the response is submitted |
hfp_<form id> |
Cookie | A password-protected form's pages | Remembers that the respondent entered the form's password | 7 days |
hootform-theme |
localStorage | hootform's website and docs | Light or dark mode, when chosen with the switch | Until cleared |
hootform_auth |
localStorage | The dashboard | Keeps an editor signed in | Until signing out; a sign-in expires after 7 days |
hootform_last_org |
localStorage | The dashboard | Opens the organization last used | Until cleared |
hootform_theme |
localStorage | The dashboard | Light, dark or system theme | Until cleared |
hootform_preview_device |
localStorage | The dashboard | Whether the builder previews a phone or a desktop | Until cleared |
hootform-oauth |
sessionStorage | The dashboard | Checks that a return from Google belongs to the sign-in or connection started here | Until the tab closes, or the return from Google |
Both cookies are only sent to the one form they belong to, can't be read by scripts on the page, and only hold a random token: the answers themselves stay on our servers. When a form is embedded on another website, the same cookies are set for the frame, partitioned to that website so they can't follow you elsewhere.
Other services
Fonts, scripts and pictures uploaded to hootform are served by hootform itself. A few things on some pages come from another company, which receives your IP address and may set its own storage:
- Cloudflare Turnstile checks that you aren't a bot when you sign in, try the demo, or start some forms.
- Videos and pictures an editor adds to a form load from where they're hosted, such as YouTube, Vimeo, Loom or Unsplash. YouTube videos use YouTube's privacy-enhanced mode.
The Subprocessors page lists these services with links to their privacy policies.
Clearing them
You can delete cookies and site storage in your browser's settings at any time. If you clear a form's cookie, you can't resume an unfinished response there; if you clear the dashboard's storage, you'll need to sign in again.