Privacy

No tracking cookies: cookies only when you sign in. Anonymous daily counts. The paste-in tools run in your browser. Here is everything else, and who handles it.

Version 2026-11-07.

Sign-in cookies only, no ad tracking

Forthsay runs no advertising or third-party scripts, except Cloudflare Turnstile on the free brand check, which tells people from bots. Every other script is served from forthsay.com.

Cookies are set only when you sign in: fs_s holds your sign-in (30 days, renewed while you use it, unreadable by scripts), fs_in tells the page you are signed in, and fs_oauth lives for ten minutes while a Google sign-in is in progress. Signing out removes them. Browsing, the free tools and the free brand check set no cookies.

Anonymous counts

To know which pages and tools help people, Forthsay keeps daily totals: page views, the page you arrived on, the kind of site that sent you (a search engine, an AI assistant, another site, or one of our own ads), how many visitors stayed a while, how often each tool showed a result, and how many free checks, checkouts and sales there were.

To count visitors without tracking cookies, our server makes a one-way code from your IP address and browser name with a secret mixed with the date, so the code changes every day and cannot be turned back. It is deleted after two days. Your IP address itself is not stored. The counts never include a domain, brand, page address or answer you entered. If your browser sends Global Privacy Control or Do Not Track, nothing is counted.

Free tools

The answer grader, the facts file builder, the change checker, the crawler log verifier and the GA4 filter run in your browser: what you paste is not sent to us. The page tools (bot view, raw HTML, robots, first screen, schema and hidden prompt checks) send the address you type to our server, which fetches that one page and returns the result; we keep nothing.

The free brand check sends us the domain, brand name and category you type. We send the four questions to the AI vendors below and keep the check and its answers for 30 days, so you can come back to the report link and so one domain is checked at most once in 30 days. We also keep a daily one-way code of your IP address for that day’s limit.

Accounts

For an account we store your email address, a salted, slow hash of your password (never the password itself) or, with Google sign-in, the account number Google gives us for you, plus a hash of each sign-in so it can be ended. From Google we receive only your email address and that number. When you pay, we store your plan, its Whop membership and payment IDs, and whether it is active.

For a plan we store: your sites, questions, rivals, facts file, change markers, every answer collected for you, and a log of changes. Your API key is not stored; it is checked by signature.

Delete your account from the app once no plan is running. That removes your sites, answers and sign-in at once.

Who else handles data

Questions (never your email or key) go to OpenAI, Anthropic, Google and Perplexity through their APIs to get answers. Their API terms apply; none of them is asked to keep a chat history for us. Google also handles Google sign-in if you use it. Whop handles payments and keeps your name, email and payment details under its own privacy policy. Cloudflare hosts the site and stores the data.