Cookies
Last updated: 29 September 2026
Browsing this site sets no cookies. There is no analytics script, no advertising pixel and no tracking tag on any page. The few cookies that exist are set by Stripe on the payment page, only when you pay, to prevent fraud; everything else the site keeps is in your own browser's storage and exists only because you signed in or chose something.
Why there is no consent banner
The law asks for consent before a site stores or reads anything on your device, except what is strictly necessary for a service you asked for (Article 5(3) of the ePrivacy Directive, and in Italy the Garante's cookie guidelines of June 2021). Everything on this page is of that kind: keeping you signed in, remembering a theme you picked, and letting Stripe check a payment for fraud. Nothing measures you, profiles you or follows you to other sites, so there is nothing to consent to and no banner to dismiss.
Cookies
Set only on the checkout page, and only by Stripe's payment form:
| Name | Set by | Lasts | What it is for |
|---|---|---|---|
__stripe_mid | Stripe, on holysn.com | 1 year | Fraud prevention: recognises the device across payments |
__stripe_sid | Stripe, on holysn.com | 30 minutes | Fraud prevention: ties together the steps of one payment |
m | Stripe, on m.stripe.com | About 13 months | Fraud prevention on Stripe's own domain |
__cf_bm | hCaptcha, on hcaptcha.com | 30 minutes | Telling people from bots during the payment's fraud check |
Stripe describes these in its own cookie policy. They are not set when you only browse the site.
Storage in your browser
localStorage and sessionStorage are not cookies: they are never attached to a request, so they
never reach our server by themselves. They stay on the device where they were set.
| Key | Where | What it holds | When |
|---|---|---|---|
holysn-site-auth | localStorage | Your sign-in session | While you are signed in; removed when you sign out |
holysn-account-hint | localStorage | The name, plan and picture the header shows, so it does not flicker while the session loads | While you are signed in; removed when you sign out |
holysn-theme | localStorage | light or dark | Only when you press the theme switch in the footer; choosing System removes it |
holysn-oauth-pending | sessionStorage | That a sign-in with Google, Microsoft or GitHub is under way | Only during that sign-in; gone when the tab closes |
holysn-upgrade-after-sign-in | sessionStorage | That you asked for Pro before signing in, so the checkout follows | Only until you are signed in; gone when the tab closes |
holysn-billing-view | sessionStorage | The last read of your subscription, so Billing does not ask twice | Gone when the tab closes |
What else leaves the browser
- Signing in, and your account. What you type goes to Supabase, which runs the accounts. The privacy policy says what is kept.
- Paying. The payment form is Stripe's. It loads its typeface from Google Fonts, which sees your IP address when it does.
- The ordinary server log of a web request. Serving a page means the server sees the request for it. Those logs are short-lived and are not used to build a profile of anyone.
The extension is a separate thing
This page is about the website. What the browser extension stores on your machine, and what it sends when you use the assistant or the credential vault, is set out in the privacy policy.
If this changes
Adding analytics or advertising would mean cookies, or something that behaves like them, that need your consent, and a banner that asks for it before anything is set. If that day comes, this page changes first and says which tool, what it stores and for how long.