Cookie policy
Last updated 27 September 2026. Heldly is operated by Niall Patterson, trading as Heldly. Contact hello@heldlypay.com about cookies or privacy.
Your choices
Essential cookies support the service you request. Optional navigation storage and visitor analytics are off until you accept each category. Use the Cookie settings button on this Cookie policy page to accept, reject or change optional preferences. Rejecting optional cookies does not prevent bookings or payments. Your choice applies to this browser.
Account access — essential
heldly_access is an HttpOnly first-party cookie used by Heldly to authenticate requests to Supabase. Its lifetime follows the authentication session, normally one hour. heldly_refresh is an HttpOnly first-party cookie used to renew the session, lasting up to 30 days and renewed on session refresh. These use SameSite=Lax and Secure on HTTPS. Signing out clears them.
Cookie choice — essential
heldly_cookie_choice records whether you accepted or rejected optional navigation preferences and analytics, and the choice version, for 180 days. It does not contain your account identity. After expiry, clearing cookies or a change of choice version, we ask again.
Navigation layout — optional
sidebar_state remembers whether your sidebar is open or closed for seven days from a change. Heldly only reads or writes this preference when you allow navigation preferences. Rejecting or withdrawing permission deletes the cookie; you can still open and close the sidebar during your visit.
Private demonstration sessions
In a separately enabled sandbox, heldly_demo is an HttpOnly first-party cookie linking the browser to its demonstration workspace for up to 30 days. It is not required for production accounts.
Analytics, advertising and external services
With analytics consent, heldly_visitor stores a random browser identifier for 30 days and heldly_visit groups visits for 30 minutes of inactivity. We record general page types, referral website hostnames, device/browser/operating system categories, screen-size bands and approximate countries where a trusted IP lookup is available. Full IP addresses are used transiently for local country lookup only; they are not saved in analytics or sent to a geolocation service. No precise location, account identity, form entries, private link tokens or payment details are collected. Supabase holds these records for up to 90 days plus the daily deletion interval. Withdrawal stops new collection and deletes analytics cookies. We respect Do Not Track and Global Privacy Control. There are no advertising trackers. Payments and payout onboarding open Stripe-hosted pages, whose cookies and controls are governed by Stripe’s cookie policy at stripe.com/cookie-settings. Your Heldly choice does not change preferences on another domain. Analytics is operated by Heldly using its existing hosting and database providers; it does not identify you across other websites.
Browser controls and personal information
You can also block or delete cookies in your browser. Blocking essential cookies may prevent sign-in; deleting the choice cookie resets your preference. Read the Privacy page for information about account data and your rights, or email hello@heldlypay.com.