Cookie & Local Storage Policy
Effective: [EFFECTIVE DATE] · Version 1.0
How SP-Heavy uses cookies and browser storage across the dashboard, the hosted checkout, and our documentation.
1. Summary
We use very little. There is no advertising, no cross-site tracking, and no third-party marketing pixel on any SP-Heavy surface. What we store is what a payment dashboard needs to keep you signed in safely.
2. What we store
Strictly necessary — no consent required
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
sph_refresh | HTTP cookie (httpOnly, Secure, SameSite) | Keeps you signed in to the dashboard. It is an opaque, rotating session token — it holds no personal data, and JavaScript cannot read it. | [REFRESH_TOKEN_TTL_DAYS] days |
| Access token | In-memory only | Authorises API calls during your session. Deliberately never written to localStorage, so it cannot be stolen by a script. | Until the tab closes |
| Theme preference | localStorage | Remembers light/dark mode. | Until cleared |
| API credentials (dashboard) | localStorage | If you choose to store test API keys in the dashboard for convenience. Optional — you control this, and can disconnect at any time. | Until you disconnect |
The refresh cookie is essential: without it you would be signed out on every page load. It is set only after you sign in.
Analytics
[IF YOU ADD ANALYTICS, LIST IT HERE AND OBTAIN CONSENT BEFORE SETTING IT. As shipped, the platform sets no analytics cookies.]
3. Hosted checkout
The hosted checkout page sets no cookies. A payer can complete a payment without anything being stored in their browser.
4. Managing cookies
You can clear or block cookies in your browser settings. Blocking the strictly necessary cookie means you will not be able to stay signed in to the dashboard — the service will not work.
Because we set no tracking or advertising cookies, there is nothing to opt out of beyond the above.
5. Do Not Track
We do not track users across sites, so there is nothing for a Do Not Track signal to disable. We honour it by design.
6. Changes
If we introduce analytics or any non-essential storage, we will update this policy and obtain consent before setting it.
Questions: [PRIVACY EMAIL] · See also the Privacy Policy.