Cookie notice
DocFig sets a security cookie for its forms and one first-party cookie that counts returning visitors. There are no advertising cookies and nothing from other companies. Visitor counting can be turned off below.
Cookies set by DocFig
| Name | Purpose | Duration |
|---|---|---|
| df_s | Strictly necessary. Holds a random security token that stops other websites from submitting forms or uploads in your name. | Until you close the browser |
| df_vid | Visitor counting. A random ID, created on your first visit, that lets DocFig count how many visitors come back on a later day. It contains nothing about you and is not shared with anyone. Turn it off below. | 13 months from your first visit |
| df_optout | Strictly necessary once you turn counting off: remembers that choice so no visitor ID is set again. | 13 months |
All three DocFig cookies are first-party cookies, marked Secure, HttpOnly and SameSite=Lax: they are only sent to docfig.com, only over HTTPS, cannot be read by scripts, and are not sent with requests started by other sites.
How the visitor ID is used
On the server, the ID is turned into a keyed hash and stored with only two dates: the first day and the last day it was seen. That is enough to count new and returning visitors per day. No IP address, browser details, page history or file content is linked to it, and a record not seen for 13 months is deleted. DocFig does not use fingerprinting or any third-party tracker.
Visitor counting settings
Visitor counting is on in this browser. Turning it off deletes the df_vid cookie and its record on the server, and sets df_optout so no new ID is created.
Global Privacy Control and Do Not Track are honoured automatically. Turning counting off does not affect the converter.
Daily totals without any cookie
Separately, the server counts page views and visitors as daily totals using a hash that changes every day and is deleted when the day ends. This uses no cookie and stores no IP address, and it still runs when visitor counting is off, so the totals stay complete without identifying anyone.
Cookies that may be set by Cloudflare
The site is served through Cloudflare. If Cloudflare needs to check that a visitor is not automated traffic, it may show a security check and set a short-lived cookie such as cf_clearance to remember that the check was passed. This is strictly necessary and is not used for tracking.
Changes
If DocFig ever adds a cookie, it will be listed here first. Last updated 10 October 2026.