Cookie Policy
Last updated 2026-11-08. Version 2026-11-08-5.
This document exists in English, Portuguese and Spanish. If the versions differ, the English text prevails, unless mandatory consumer or data protection law where you live gives you the benefit of the version in your own language.
1. What this policy covers
This policy lists the cookies and browser storage that the holder of CNPJ 59.611.478/0001-09, operating as NotHoly, uses on notholy.com. The API and docs.notholy.com set no cookies of their own.
The CLI keeps your key in the system keychain or, if none is available, in ~/.notholy/credentials with 600 permissions. The VS Code extension uses the editor's secret storage.
2. Categories
- Necessary: sign-in, security and remembering your cookie choice. The site depends on them, so they do not need consent.
- Preferences (optional): interface state such as closed announcements and the chat sidebar. Set only if you accept them, except that a session cookie remembers a closed announcement until the end of the visit.
- Analytics (optional): records which link or campaign brought you to the site. Set only if you accept them.
We use no advertising cookies, no tracking pixels and no third-party analytics scripts. If a link you followed carried a gclid or fbclid tag, the analytics cookie stores that text and nothing is sent to an advertising network.
3. Cookies we set
Cookies whose name starts with __Secure- are sent only over HTTPS. Sign-in cookies cannot be read by page scripts.
| Name | Purpose | Duration | Category |
|---|---|---|---|
| nh_consent | Your cookie choice: document version, date and the optional categories you accepted | 1 year | Necessary |
| __Secure-nh.session_token | Keeps you signed in | 14 days, renewed with use | Necessary |
| __Secure-nh.dont_remember | Sign-in without "remember me" | Session | Necessary |
| __Secure-nh.email_code | Identifies the email code challenge at sign-in | 10 minutes | Necessary |
| __Secure-nh.trusted_device | Skips the email code on this device | 30 days | Necessary |
| __Secure-nh.two_factor | Pending two-factor step | Minutes | Necessary |
| __Secure-nh.trust_device | Two-factor trust for this device, if you choose it | 30 days | Necessary |
| __Secure-nh.better-auth-passkey | Passkey challenge | Minutes | Necessary |
| nh_share_<hash> | Pass for a password-protected shared conversation | Until the link expires | Necessary |
| nh_ann_closed | Announcements you closed | Session cookie without Preferences, 1 year with them | Preferences |
| nh_att | First link or campaign that brought you: utm tags, ref, gclid, fbclid, landing path, referring host. Saved to your account when you sign up | 90 days | Analytics |
| nh_att_last | Last tagged link that brought you | 90 days | Analytics |
4. Browser storage
These keys stay in your browser and are not sent to us by themselves.
Article 5(3) of the ePrivacy Directive applies to this storage too. nh.survey.later, nh.consent.later, nh.chat.unlock and nh_playground_key are written only after you act and last as long as the tab, so they are necessary for something you asked for and need no consent.
| Key | Store | Purpose |
|---|---|---|
| nh-chat-sidebar | localStorage | Chat sidebar state, if you accept preferences |
| nh-admin-folded | localStorage | Admin navigation, staff only, if preferences are accepted |
| nh.survey.later | sessionStorage | "Answer later" on the survey |
| nh.consent.later | sessionStorage | Consent question put off for this tab |
| nh.chat.unlock | sessionStorage | Access tokens for locked chats |
| nh_playground_key | sessionStorage (docs) | The API key you type in the docs playground |
5. Third parties
Stripe sets its own cookies only on checkout.stripe.com, after we redirect you to pay. We load no Stripe script on our pages.
On the sign-in, sign-up, password reset and abuse report pages, Cloudflare Turnstile runs in a frame from challenges.cloudflare.com to check for bots. It is necessary for security. Each of these companies has its own policy for what it sets on its own domain.
6. Legal basis
Necessary cookies are exempt from consent under Article 5(3) of the ePrivacy Directive, and rest on contract performance and legitimate interests (GDPR Art. 6(1)(b) and (f), LGPD Art. 7, V and IX).
Optional cookies rest on your consent (GDPR Art. 6(1)(a) and LGPD Art. 7, I). We keep your choice in a necessary cookie and, when you have an account, record it with your account.
7. How to change your choice
Use the cookie settings control on the site, or the button below. You can change your choice whenever you want, and rejecting optional cookies does not limit the services. From the moment you withdraw consent, we stop setting those cookies. Turning Analytics off also deletes the nh_att and nh_att_last cookies and erases the attribution saved with your account.
You can also block or delete cookies in your browser. Blocking necessary cookies stops sign-in from working.
8. Changes and contact
The version and date at the top of this page identify the text in force. If we add a cookie that needs consent, we ask you again. Questions go to [email protected].
Ask anything your scope allows.
Create an account, add credits from $10 and ask the first question in the chat or the terminal.
- 1/3
Create the account
Individual or company. You can switch to a company later without losing balance or keys.
IndividualCompany - 2/3
Add credits
By card, from $10. Pay per token, no subscription.
$10.00minimum deposit - 3/3
Ask
In the chat, or install the CLI and run notholy login in your terminal.
$ notholy login