Cookie Policy
Version 2, effective Oct 9, 2026
Cookies are small files a website stores in your browser. Browser storage (local storage and session storage) works in a similar way. This policy covers both. Some of this data is necessary for the site to work at all. Other data we store or send only with your consent.
Necessary
The site does not work without them. They keep you signed in, keep your cart and remember your choice in the cookie bar. They are always stored, because the service cannot be provided without them. The legal basis is performance of a contract, or legitimate interest.
Cookies
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
dxf_session | Forgmatic | Sign-in. Confirms that it is you. | 3 hours, renewed while you use the site |
dxf_refresh | Forgmatic | Renews your sign-in so you don't have to sign in again. | 7 days, 90 days with "Stay signed in" |
dxf_cart_session | Forgmatic | Your cart and uploaded parts when you are not signed in. | 30 days |
dxf_magic_link_mfa, dxf_google_mfa, dxf_2fa_bootstrap | Forgmatic | Sign-in with two-factor authentication in progress. | 5 minutes |
dxf_google_flow, dxf_oidc_flow, dxf_saml_flow | Forgmatic | Sign-in with a Google or company account in progress. | 10 minutes |
dxf_passkey_reg, dxf_passkey_auth | Forgmatic | Passkey registration or sign-in in progress. | 5 minutes |
dxf_step_up, dxf_step_up_email | Forgmatic | Identity check before a sensitive account change, such as changing your email or deleting your account. | 5 and 10 minutes |
dxf_terminal, dxf_terminal_claim | Forgmatic | Only on a shop-floor tablet: pairing and sign-in of the workshop terminal. | 180 days, pairing up to 15 minutes |
__vdpl | Forgmatic (Vercel hosting) | After a new version of the site is released, keeps an open page on the version it was loaded from, so it doesn't break. | until you close the browser |
__stripe_mid, __stripe_sid | Stripe | Payment fraud prevention. Only on the card verification page during shop sign-up. | 1 year, 30 minutes |
The sign-up form is protected from bots by Cloudflare Turnstile. It runs in a frame served from a Cloudflare domain and stores no cookie on this site's domain. Cloudflare processes the data needed for the check as our processor.
Browser storage
| Key | Purpose | Lifetime |
|---|---|---|
dxf_cookie_consent_v2 | Your choice in the cookie bar. | until you change it or clear browser data |
forgmatic.i18n.languages.v1 | The list of languages the site is offered in. The language you pick is not stored. It is part of the page address (/cs/, /en/). | until you clear browser data |
forgmatic.vatDisplay | Showing prices with or without VAT in a business customer's cart. | until you clear browser data |
checkout-draft-v1 (session storage) | Details you have started filling in at checkout. | until you close the tab |
forgmatic.tryout.draft | The shop setup wizard you have started. | 30 days |
forgmatic.storefront-trial | A trial purchase the shop's operator invited you to make. | 24 hours |
forgmatic.guest-session | Your cart in a configurator embedded on another website, where cookies don't work. | 30 days |
forgmatic_chunk_reload_at (session storage) | A one-time page reload after a new version of the site is released. | until you close the tab |
dxf:session-refreshed-at, forgmatic.active_org_slug | After sign-in: renewing the sign-in across tabs and the selected organization. | until you clear browser data |
forgmatic.theme, forgmatic.accent and other admin keys | After sign-in: the look and layout of the admin. | until you clear browser data |
Analytics
Today this category contains only error reporting from your browser to Sentry. When an error occurs on a page, your browser sends Sentry a description of the error, the page address, the browser and device type, your IP address and a technical record of what led up to the error (for example, loaded addresses and clicks). For 10% of visits it also sends page load timing. We do not send your name, email or form contents.
Sentry stores no cookie in your browser. We run it only with your consent. Until you give it, the Sentry code is not loaded into your browser at all. If you withdraw consent, reporting stops right away. Sentry stores the data in the European Union (Germany).
We always monitor errors on our servers, regardless of this choice. That does not happen in your browser and involves no cookies. It is described in the Privacy Policy.
Marketing
Today this category covers only matching a visit to the link in our sales email. When we send your company an offer, the link carries a short code (?p=…). The code contains no personal data. It only points to your company's record in our outreach list.
With your consent, we store the code in your browser and match your visit to a shop, or your sign-up, to your company's record. That tells us the message reached you.
Browser storage
| Key | Purpose | Lifetime |
|---|---|---|
forgmatic.personal-code | The code from the link in our email. Matches your visit or sign-up to your company's record. | 60 days |
We store the code and match the visit only with your consent. Without it, nothing is stored in your browser and no visit is reported. The one exception is a sign-up opened straight from the link: the code is in the page address and is sent with the sign-up form, so the new shop is matched to our offer. If you withdraw consent, we delete the stored code right away. We use no other marketing cookies or advertising services.
Managing your consent
A bar appears on your first visit where you make your choice. The default is to decline. No analytics or marketing cookies are stored until you enable them yourself. You can change or withdraw your choice at any time with the "Cookie settings" link in the site footer.
You can also delete or block cookies and site data directly in your browser. If you block necessary cookies, parts of the site will stop working.
Record of consent
We keep a record of consent being given and withdrawn so we can show when and in what scope it was given. The record contains the time, the categories, the version of this policy, a truncated IP address and the browser type, and for a signed-in user also their account. It does not contain what you browsed on the site.