Cookie policy
Last updated November 5, 2026
This policy lists the cookies and similar browser storage that Trfyx uses in three places: on websites that install the Trfyx tracking script, in the Trfyx dashboard, and on this website. It adds to our privacy policy.
Cookies are small text files that a website stores in your browser. Local storage and session storage are similar browser features. Session storage is cleared when you close the tab.
1. On websites that use the tracking script
These are first-party cookies: they are set on the website's own domain, not on a Trfyx domain, and they can't be used to follow people across websites owned by different customers. The website owner chooses which script to install, and is responsible for asking for consent where the law requires it.
Standard script
| Name | Type | Purpose | Duration |
|---|---|---|---|
df_visitor_id | Cookie | Random ID that recognises a returning visitor, so they are counted once and purchases can be attributed to the visit that led to them | 1 year |
df_visitor_first_seen | Cookie | Date of the visitor's first visit | 1 year |
df_visitor_session_count | Cookie | Number of visits, to tell new and returning visitors apart | 1 year |
df_session_id | Cookie | Groups pageviews into one visit | 30 minutes after the last activity |
df_pageview_state, df_heatmap_token, df_*_sent_* | Session storage | Measure time on page, load heatmap overlays, and avoid recording the same purchase twice | Until the tab is closed |
df_ignore | Local storage | Only read, never written by the script. When set to true, the browser is excluded from tracking | Until removed |
If the website owner turns on session recording, the recorder also keeps a short-lived buffer in session storage. When a website spans several domains, the script may briefly add _dfvid, _dfsid, _dfvfs and _dfvsn parameters to links between them. It removes them from the address bar as soon as the next page loads.
Cookieless script
The cookieless script sets no cookies. It keeps trfyx_session_id, trfyx_visitor_id and trfyx_pageview_state in session storage, which is cleared when the tab closes. Returning visitors are recognised on our servers with an anonymous ID that changes every day, as explained in our privacy policy.
2. In the Trfyx dashboard
| Name | Type | Purpose | Duration |
|---|---|---|---|
better-auth.* (prefixed with __Secure- over HTTPS) | Cookie (strictly necessary) | Keep you signed in and protect your session | Until you sign out or the session expires |
appsumo_license | Cookie (strictly necessary) | Link an AppSumo licence to your account while you redeem it | Until redemption completes |
| Cloudflare Turnstile | Cookies and browser signals (strictly necessary) | Tell people from bots on the sign-up and sign-in pages | Short-lived |
df_* | Cookies (analytics) | We measure use of the dashboard with Trfyx. See section 1 | Up to 1 year |
| Preferences | Local and session storage | Remember your theme, onboarding progress, selected funnels and similar settings | Until removed |
3. On this website
| Name | Type | Purpose | Duration |
|---|---|---|---|
df_* | Cookies (analytics) | We measure visits to this website with Trfyx. See section 1 | Up to 1 year |
_ga, _ga_* | Cookies (analytics) | Set by Google Analytics when it is enabled on this website, to measure traffic. Google's privacy policy applies | Up to 2 years |
theme | Local storage | Remember whether you chose light or dark mode | Until removed |
We don't use advertising cookies, and we don't let advertising networks set cookies on our websites.
4. Managing cookies
- You can block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop you from signing in to the dashboard.
- On websites that use Trfyx, ask the website owner about the choices they offer. Opting out with their consent tool, or blocking cookies for their domain, stops the Trfyx cookies.
- To opt out of Google Analytics on any website, you can use Google's opt-out browser add-on.
5. Contact
Questions about cookies: [email protected].