Cookies and browser storage

sh-auth (Local storage)

Your sign-in session, kept by Supabase's sign-in library. Signing up, asking for a password reset or a new confirmation link, and signing in with Google also keep short entries whose names start with “sh-auth-” and end with “code-verifier”. Google sign-in removes its entry when it finishes; the others stay until you sign out.

Kept until: You sign out (this also removes the code entries), or clear your browser's storage.

sh-theme (Local storage)

Whether you chose the light or the dark theme. When you are signed in, the theme kept with your account is copied here too, so your next visit starts in it.

Kept until: You clear your browser's storage.

sh-tab (Session storage)

The last page you opened in the app, so a reload keeps it.

Kept until: You close the tab.

sh-disclaimer-ack (Local storage)

That you have read the disclaimer banner, so it is not shown again.

Kept until: You clear your browser's storage.

sh-reports-reload (Session storage)

Stops the engineering reports from reloading more than once after StrikeHike is updated.

Kept until: You close the tab.

sh-auth-next (Session storage)

The page to return to after signing in with Google.

Kept until: Sign-in finishes.

sh-pending-add (Session storage)

The symbol you chose to add to a watchlist before signing in, so the add can finish once you have signed in.

Kept until: The add finishes after you sign in, or you close the tab.

sh-dashboard-view (Local storage)

Whether the dashboard shows all symbols or one watchlist, while you are not signed in. When you are signed in, this choice is kept with your account instead.

Kept until: You clear your browser's storage.

sh-onboarding-skipped (Local storage)

That you chose “Skip for now” when asked to pick what you follow after creating an account, so that page is not shown again on this device.

Kept until: You clear your browser's storage.

These items stay on your device. Only the sign-in session is used to prove who you are when you use your account. Your watchlists and preferences are not kept here: when you are signed in they are kept with your account (see the Privacy Notice).

• Sign-in forms show a Cloudflare Turnstile bot check. It runs inside a frame from Cloudflare (challenges.cloudflare.com), and Cloudflare controls what that frame stores; StrikeHike cannot read it.
• If you choose “Continue with Google”, you go to Google’s own pages, where Google’s cookies and policies apply.
• Fonts load from Google Fonts.

Because every item above is needed for the site to work, there is nothing to opt in to. If StrikeHike ever adds storage that is not essential, it will ask you first. You can clear these items at any time in your browser’s settings; signing out removes the sign-in session. The Privacy Notice explains how account data is handled.

Questions about this page, privacy requests and complaints: [Privacy and grievance contact: to be confirmed by the owner]