Cookie Policy

• Supabase stores your authentication session in browser local storage so you can stay signed in. Signing out clears the persisted session. These are browser-managed session records, not HttpOnly authentication cookies.
• henedo-sid, session identifier (stored in your browser’s session storage; not a cookie) sent on authenticated API calls via the X-Session-Id header. Required for heartbeat and session validation.

• Google Analytics measures page views and product events after you choose “Accept analytics”. It can set cookies such as _ga and _ga_*.
• If you decline or have not chosen, Henedo does not initialize Google Analytics. Accepting analytics is optional and is not required to use your vault.
• We store your choice under henedo:cookie-consent-v1. With consent, campaign attribution may also be stored under henedo:utm-first-touch-v1.
• The implementation does not include Plausible, Facebook Pixel or LinkedIn Insight Tag.

Changing your preference clears the saved choice and campaign attribution, then reloads this page so the analytics script stops and the consent banner appears again. Existing browser cookies can also be removed through your browser’s site-data controls.

Henedo uses browser IndexedDB to store your device-bound Account Secret Key (ASK), protected by WebAuthn PRF where available. This is not a cookie. The readable key stays on your device; encrypted recovery material is stored with your account. If you clear site data, you will need to re-activate your device via the recovery flow.

Questions: privacy@henedo.com.