Cookies

Forklist uses two cookies on the website and three in the apps. All of them are necessary and none tracks you. The notice the website shows on your first visit says the same.

Last updated 6 November 2026

The cookies

That is all of them. The app needs the first to know who you are and the second to sign you in safely. The Android and iPhone apps need the third to show their own sign-in page.

What there is not

• No analytics cookies. No Google Analytics, no Plausible and nothing like them.
• No advertising or tracking cookies, and no third party setting cookies through this app.
• No session recording and no heatmaps.
• No cross-site tracking. Nothing here follows you to other sites, and nothing from other sites follows you here.

Why the notice says so little

Consent is needed only for cookies that are not necessary, and Forklist has none, so the notice has one button, Got it, which closes it. The notice says what is stored so you don't have to come looking for this page.

Pressing Got it saves one entry in your browser’s local storage, cookie_consent, so the notice does not come back. It never leaves your device. If you clear your site data, the notice comes back.

Settings, and where they are kept

Your settings are not cookies. Signed out, they stay in this browser and go nowhere. Signed in, most of them are saved to your account, so they follow you to every device you sign in on. Signing out takes those off this browser, so the next person here starts from the defaults.

Those are your theme and light or dark choice, your pin colours and what For you weighs if you are on Forklist Plus, reduce motion, text size, miles or kilometres, whether the app opens on the map or the list, which cards Home shows and in what order, your default sort and audience, how you sort each list, category filters, your passport style and cover, your delivery app, which city suggestions you have dismissed, whether your position keeps up as you walk, who can send you a friend request, and the notification and privacy switches in Settings. They are in Download my data, and deleting your account deletes them.

These stay on this device either way: cookie_consent, a random id this browser made for itself, a display name you set before signing in, which places you have upvoted, whether the bottom sheet is open, and whether a group's About panel is shown and which of its sections are open. The account id of whoever last signed in here stays too, so the next person does not inherit their settings. The random id is sent with requests so the server can tell browsers apart, and is never accepted in place of an account. Adding a spot, upvoting and reporting all need you to be signed in, so votes are counted by account, not by browser. Signing out clears the name, the upvotes and the id, and the app's offline copy of your map, so the next person on this browser starts with none of it.

Opening a link or an invite while you are signed out keeps where it goes in this browser until you have signed in, then opens it and forgets it. It lasts only as long as the tab.

If you are signed out while writing a note, the note, the place you picked and who it is for stay in this tab. When you sign back in to the same account, they open again in the Add sheet and the tab forgets them. Signing in as someone else, signing out or closing the tab forgets them too. They never leave this browser.

Eight things are not settings. In the phone app only, Forklist keeps a note that it has asked your phone about notifications, so it asks once, and the address your phone was given to receive them. That address is sent to the server, because notifications cannot reach your phone without it. Signing out deletes the address. Once you open Forklist Plus on a phone, it also keeps a note of which account did, so RevenueCat starts with the app and can finish a purchase the store is still waiting on. Signing in on a phone briefly stores a one-time sign-in verifier, which is used once, then removed, and never sent anywhere. The Android app keeps a note that the rating card has been asked for, so it asks once, and until then a count of places you have marked been, up to five. It also keeps the version of an update you turned down, so it does not offer that one again. A note that you have seen the walkthrough keeps it from opening twice. These four stay on the phone.

In the Android and iPhone apps, Forklist also keeps a copy on the phone: the places on your map with the notes you can read and their scores, your profile, the nicknames you gave friends, your settings, and any place you added with no signal, until you send it. It is there so screens open at once, and so your profile and settings are there with no signal. It holds nothing Google gives Forklist but a place's id, and a pin Google gave for at most 30 days. With no signal, how the app looks and the text size change at once and reach your account when the signal returns. A setting that changes what Forklist does for you, such as who sees your notes or what reaches you as a notification, waits until you are back online, and the app says so. Signing out, signing out everywhere, deleting your account or signing in as someone else empties it; a sign-out made on another device empties it the next time the app reaches Forklist. A free account's copy holds up to 1,000 places. With Forklist Plus it also holds your lists, the crawls you are on and up to 1,000 of the photos you added yourself, with no 1,000-place limit, and when Plus ends what is already there stays, except a photo you remove. None of it goes into a backup.

With nudges on with the app closed, a Forklist Plus perk, each phone keeps a list of places to watch, outside the browser: a place id and a pin for each, with no name or note, where the phone was when it last picked them, and the key the phone signs in with when it reports one. None of it goes into a backup, and on an iPhone the key is kept in the Keychain. It never leaves the phone except as the one place it matched, and turning the switch off or signing out empties it.

Clearing your site data removes all of this along with the cookies. Your account, pins and notes are on the server, and so are the settings you saved while signed in, so they come back when you sign in. Anything that has not reached the server yet is lost, such as settings you chose while signed out, a note waiting in this tab, or a place you added in the app with no signal.

On an Android phone, the widgets on your home screen keep their own copy, outside the browser: the key they sign in with, the random id above, where you last opened the app, whether a widget follows you, and the last thing they showed, so they can draw with no signal. The key is stored encrypted, with a key that never leaves the phone, and none of it goes into a backup. Signing out deletes all of it except whether a widget follows you.

Turning them off

You can block cookies in any browser. If you block the first two, you cannot sign in. The app still shows a map, but it cannot tell who you are, so nothing shared with you appears.