Features / Consent
Your visitors already answered. We read that answer.
Our form runs on your site, next to whatever you already use to ask people about cookies. So we add no banner of our own, we read the answer yours recorded, and we act on the privacy setting a visitor's browser sends whether or not you run a banner at all. Consent is included on every plan.
What happens on your site
Five things, each of them something you can check against us today.
-
We add no banner to your site
Our form runs on your page, so a second cookie prompt beside the one you already have would ask your visitor the same question twice and record two different answers. We never add one. Whatever you use to ask the question stays the thing that asks it.
-
We read the answer your own banner saved
Tell us where your cookie tool keeps a visitor's answer and we read it before counting anything. If you run Google Tag Manager, or a cookie tool that works with Google's consent settings, there is nothing to look up: pick that option and we read the answer it already publishes. Otherwise you name the cookie, and your cookie tool's help pages have that name.
Where you set it: Counting visitors, in a form's settings
-
A visitor's own browser setting is honoured with no setup
Some people turn on a privacy setting that asks every site not to sell or share what it learns about them. Global Privacy Control is the one California treats as a binding opt-out, and Do Not Track is its older sibling. Both reach us on their own, so we act on them whether or not you have set anything up, and whether or not your site has a cookie banner at all.
-
We keep less of the address
When we count a visit, we shorten the visitor's network address before storing it, keeping enough to tell two people apart and not enough to point at one. The country and city come from the network your visitor connected through, not from our stored copy, so you keep the geography without us keeping the person. If they sent a privacy signal, the place goes out with the address.
-
Your dashboard says what will happen, before anyone arrives
Open a form and it tells you which answer we read, what gets counted, and what stops a count. A visitor who says no is the one case a chart cannot show you, because a visit that was not counted leaves nothing behind, so the form says in advance what would happen instead of leaving you to wonder why a number looks low.
Where you set it: The form's overview, under Popup view counting
What a no actually changes
Nothing your visitor can see. The form still opens, they can still fill it in, and what they send you still arrives. What stops is the popup's counting: how often it opened, how often somebody filled it in, and how often somebody closed it. If somebody changes their mind while your page is open, the counting stops there and then.
When this comes up
Four situations people bring to us, and what happens in each.
You run forms on client sites you do not own
Every client runs a different cookie tool, and some run none at all. Where the answer lives is a setting on each form, so one client's cookie and another client's Google consent settings are both read correctly, and you change nothing on their site. There is no banner of ours for them to approve.
You are in the EU or the UK and somebody has asked what this embed does
The answer is short enough to send on. The popup keeps one entry in the visitor's own browser recording when they last saw it, so it does not reopen on every page, and that entry never reaches us. Our form script sets no cookies of its own on any site. What reaches us is three counts: the popup opened, somebody filled it in, somebody closed it. Our privacy notice states the same list in the formal wording.
You have visitors in California
Global Privacy Control is a setting the visitor turns on once in their browser, and California treats it as a binding request to opt out. It arrives with the request whether or not your site asks anybody anything, so we act on it with nothing configured: where our own code reads it first the count is never sent, and where the count reaches us anyway the address, the browser details and the place are dropped before anything is stored. A banner that said yes does not override it.
A buyer's security review wants to know what is kept, and for how long
Counts are kept for 365 days and then deleted by a job that runs every night. You can shorten that to as little as 7 days in your account settings, and the shorter period applies to every form you own. What is kept is the network portion of the address, with the last part cut off, alongside the country, region and city, which are worked out before the request reaches us.
For developers
Four sources, consulted in this order, first recognised answer wins: a
dotted path on window (a function at the end
of the path is called), Google Consent Mode, a cookie, then a
localStorage key. Consent Mode is read off
the dataLayer consent queue, taking the last
default or update
command that carries the key; it reads
analytics_storage unless you name another,
so the advertising keys are selectable without being the default.
The optional category field handles a value holding several permissions: an object, the unquoted shape some tools write into cookies, or a list of granted category ids, where being absent from the list is a no.
Global Privacy Control is read as
navigator.globalPrivacyControl in the page
and as the Sec-GPC request header on our endpoints;
Do Not Track arrives as DNT. Both only
ever deny: a false or absent value means the visitor expressed no
preference, so it falls through to the sources above. A denial from
either outranks a banner that granted.
The reader is part of the embed you already load, it makes no request
of its own, it writes no cookie and no
localStorage key, and nothing in it throws,
so it cannot delay first paint. Opening the popup is never gated, and neither
is the on-device cap that stops a visitor seeing the same popup repeatedly.
The analytics beacon is the one layer the answer governs.
Stored addresses are cut to the network portion, a
/24 for IPv4 and a
/48 for IPv6. Country, region and city come
from the edge headers, which are resolved before the request reaches us,
so no geolocation lookup runs against our stored copy. Under
Sec-GPC or DNT
the address, the user agent and the place are all dropped and the event
still records, so you keep the count.
Popups guide, for opening a popup from your own code.
Start building for free
Create your first form in minutes. 500 free submissions a month, no card required.
Get started