Cookie Statement

The short version

• fondfully.com sets no cookies of its own, stores nothing in your browser, and has no analytics, no ads and no tracking.
• The claim form on gift brief pages uses Cloudflare Turnstile to keep bots out.
• Cloudflare, which delivers and protects our site, may set a strictly necessary security cookie if it needs to check for automated traffic.
• Our admin console, which isn't public, uses Cloudflare Access session cookies for our team.
• Because none of this is used to track you, we don't show a cookie banner.

1. Our website

Our website, fondfully.com, includes our home page, the user manual, our legal pages, the account deletion page, the pages that finish an email verification or a password reset, and gift brief pages. It:

• sets no cookies of its own, and doesn't use your browser's local storage or similar technologies;
• doesn't use analytics, advertising, social media or other third-party tracking scripts; and
• serves its fonts, images and scripts itself, so opening our pages doesn't contact other companies' servers, except for the Turnstile check described below.

Gift brief pages work without cookies. A brief is decrypted in your browser with the key in the link, and the key is never sent to us. The verification and password reset links carry their code after the "#", which browsers don't send to servers. The pages send it to our servers only when you confirm, then clear it from the address bar, and keep nothing in your browser.

2. Cloudflare Turnstile on gift brief pages

When you open the form to claim an idea on a gift brief page, Cloudflare Turnstile checks that a person, not a bot, is making the claim. Turnstile doesn't load until you open the form, and most of the time the check happens in the background without a puzzle.

To make the check, Turnstile loads in a small frame from Cloudflare's servers and processes technical information about your browser and connection, such as your IP address, browser characteristics and signals about how the page is being used. It doesn't set cookies on fondfully.com. Cloudflare uses this information to run the check and to improve its bot detection, and says it doesn't use it to identify, profile or target anyone, or for advertising. We receive only whether the check passed. Cloudflare's Turnstile privacy addendum explains more.

We use Turnstile because it's strictly necessary to protect gift briefs and the people who share them from abuse.

3. Security cookies set by Cloudflare

Our site is delivered and protected by Cloudflare. If traffic looks automated, or during an attack, Cloudflare may ask your browser to pass a quick check. If it does, it sets a strictly necessary cookie called cf_clearance, which remembers that your browser passed, so you aren't asked again straight away. It usually lasts 30 minutes. If we turn on more of Cloudflare's bot protection, Cloudflare may also set similar short-lived security cookies, such as __cf_bm, which helps tell people from bots and expires after 30 minutes.

These cookies are used only for security. They aren't used to track you across websites or for advertising. See Cloudflare's cookie policy for details.

4. The admin console

Our admin console, at admin.fondfully.com, is used only by the Fondfully team. It's protected by Cloudflare Access, which sets session cookies (such as CF_Authorization) after an authorized team member signs in. It isn't open to the public, and these cookies are never set when you visit fondfully.com.

5. The apps

The Fondfully apps don't use cookies to track you, and contain no third-party analytics, advertising or tracking software. Their connections to our servers don't use cookies, and link previews are fetched without cookies.

• When you open a product link from the app, it opens in your browser, where the store's website may set its own cookies under its own policy. If you've turned on "Support Fondfully when you shop", the store may use cookies to credit your purchase to our affiliate tag; see our Affiliate Disclosure.
• When you sign in with Google on iPhone, or connect Google Drive, Google's sign-in page opens in a secure browser window, where Google may use its own cookies (for example, to remember that you're already signed in to Google) under Google's privacy policy. We don't receive those cookies.

6. Your choices

Because the only cookies on fondfully.com are strictly necessary for security, we don't show a cookie banner. You can block or delete cookies in your browser's settings at any time. If you block Cloudflare's security cookies, you may see extra checks, and the claim form may not work.

Our website works the same whether or not your browser sends a "Do Not Track" or Global Privacy Control signal, because it doesn't track you either way. Our Privacy Policy explains how we treat these signals.

7. Changes and contact

If we ever change how cookies are used on fondfully.com, we'll update this statement first, and ask for your consent where the law requires it. Questions: privacy@fondfully.com. Our Privacy Policy has more about how we handle personal information.