Privacy Policy
CockpitForge is a small UK business selling flight-simulator checklist & kneeboard packs, apparel and 3D-printed cockpit accessories. This page explains, in plain terms, what personal data we collect and why.
When you place an order
To process and deliver an order we collect your name, email address and — for physical items — your delivery address, along with what you bought. The lawful basis is performance of our contract with you. We keep order records for six years after the end of the tax year the order falls in, which is what UK tax and accounting rules require, then delete them.
Payment
Payments are taken securely by Stripe and PayPal. You enter your card or PayPal details on their secure checkout — we never receive or store your full card number. They act as data controllers/processors for the payment itself under their own privacy policies.
Delivery & fulfilment
- Digital packs are delivered as a download link — no personal data leaves us beyond your email for the receipt/link.
- 3D-printed accessories are made and posted by us; we use your address only to ship your order.
- Apparel is printed to order by our print partner Printify, who receive your name and delivery address solely to print and ship your shirt.
Email we send you
Order confirmations and, if you opt in, our mailing list are delivered by Resend, acting on our instructions.
Your account
An account is optional. When you sign in we email a one-time link to your address; we keep your email, when the account was opened and last used, and your active sign-in sessions (stored as scrambled codes, not readable ones, with the type of device and browser so you can see where you're signed in). Your account page shows the orders placed with that email, your Logbook points and your referral progress, which we already hold for your orders. Points are earned on posted orders and approved reviews and customer cockpit posts, and kept as a simple list of entries against your email. When your points reach a reward, or your pilot rating goes up, we email you; the unsubscribe link in those emails turns them off.
You can close your account from your account page at any time. That deletes the account and your sign-ins; your orders stay on record because the law requires us to keep sales records. To have your points and everything else about you erased, email [email protected].
Reviews and customer cockpits
If you leave a review or post your setup on our Customer cockpits page, we keep what you send: your words, the name you choose to show, your photos and, if you give it, your order number (it's how we mark a post as a verified buyer, and a review must match a real order). We use it to show your review or post on cockpitforge.com, and nothing appears until we've checked it. Your lawful basis is your consent, which you give with the tick box when you post. Photos are re-saved when they arrive, which removes the hidden location and camera details phones add. The name you choose is shown publicly; your email and order number never are. If you also tick the optional box to let us share your photos on our Instagram, TikTok and Facebook accounts, we may post them there, credited to the name you chose. You can withdraw that at any time by emailing us: we'll stop using them and delete our posts that show them. To have a review or post taken down, or its photos deleted, email [email protected] and we'll remove it.
Our mailing list
If you sign up, we send occasional emails about new products, offers and useful flight-sim freebies. In plain terms:
- What we collect: your email address only.
- Lawful basis: your consent, via double opt-in — after you sign up we email a confirmation link, and you're only added once you click it. If you tick the newsletter box when signing in to your account, the sign-in link we email does the same job: you're added when you click it, and not before. The box is never ticked for you.
- Storage & sharing: held on our own server; never sold, rented or shared; no third-party advertising or tracking.
- Unsubscribing: one click in any email removes you immediately.
Cookies & the website
The first time you visit, a banner asks whether you'll accept measurement cookies. Until you press Accept, none are set — Google's tags run in a cookieless mode that reports anonymous, aggregated visit counts only. Press Decline and they stay off; we also delete any measurement cookies already in your browser.
You can change your mind at any time using the Cookie settings link at the bottom of every page. Withdrawing is as easy as accepting was.
If you use an ad blocker or a privacy extension, it may block Google's scripts or hide our banner. That's fine — it means the measurement cookies below are never set, whether or not you ever see the banner. If the Cookie settings link doesn't open anything, your extension is hiding it, and nothing is being recorded either way.
What each cookie does
| Cookie | Set by | What it's for | Expires |
|---|---|---|---|
| Only after you accept | |||
_ga, _ga_<id> | Google Analytics | Counts visits and tells a returning browser from a new one, so we can see which pages are useful. We never receive your name or address through it. | 2 years |
_gcl_au | Google Ads | Records that a visit came from one of our adverts, so we can tell which adverts lead to an order and stop paying for the ones that don't. | 90 days |
| Always on — the site can't work without these, so they don't need consent | |||
cf-cart, cf-theme, cf-consent | Us | Your basket, your light/dark choice and your answer to the cookie banner. These are browser storage, not cookies, and are never sent to our server. | Until you clear them |
cfnotrack | Us | Set only if you visit /notrack, to keep your own visits out
of our figures. | 2 years |
cf_acct | Us | Set only when you sign in to your account, to keep you signed in. It holds a random session number, nothing else. | 30 days, or when you sign out |
__cf_bm and similar | Cloudflare | Tells real visitors from bots and keeps the site up. | 30 minutes |
Stripe and PayPal set their own cookies on their own checkout pages, covered by their privacy policies linked above. Your basket is stored in your own browser and never reaches us until you check out. The site is served through Cloudflare, which processes standard request data (such as your IP address) to deliver the page and protect against abuse.
Analytics & advertising
With your consent we use Google Analytics 4 and Google Ads conversion measurement. Both are configured with Google Consent Mode v2, which is what keeps them switched off until you accept. We use them to count visits, see which pages and products people look at, and match an order back to the advert that brought it — not to build a profile of you or to sell anything to anyone else. The lawful basis is your consent, and Google acts as our processor. Aggregated figures may be transferred to Google servers outside the UK under its standard contractual clauses.
Our internal TikTok tool
Separately from the shop, we operate a private internal tool that connects to the TikTok API using
our own business account to upload our own marketing videos into our
own TikTok drafts for review before publishing. It is used only by the business owner, is
not available to the public, requests only user.info.basic and video.upload,
does not read or store any other TikTok user's data, and never posts on its own. Access tokens are
stored on our own server and can be revoked at any time from TikTok's settings.
Your rights
Under UK GDPR you can ask what data we hold about you, ask us to correct or delete it, or object to how we use it. Contact us at [email protected] and we'll respond within one month.
If you're not happy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this policy changes, the "last updated" date above changes with it.