Legal
Cookies and storage
Updated
Why there is no banner
Every cookie stms sets before you interact with anything is strictly necessary for the site to run, or is storage you directly chose (a theme toggle, a cart). Under ePrivacy Article 5(3), storage that is strictly necessary or that the visitor has requested does not require consent, so there is nothing to ask permission for. The moment analytics or a marketing identifier is added, that stops being true and a banner returns. This is a constraint the site is built to, not an oversight.
The list below is every cookie and every browser storage key the site uses. A visitor who only reads pages has none of them. The site runs no analytics and no advertising or tracking script.
Paddle, which takes payment, and Cloudflare, which sits in front of the site, are separate companies. Paddle’s storage is in the table. Cloudflare sets no cookie on ordinary page loads. If it ever sets a security cookie of its own, for example to check that a visitor is not a bot, its own policy governs that cookie.
What is stored
| name | type | purpose | duration |
|---|---|---|---|
__Host-stms_session | httpOnly cookie (Secure, SameSite=Lax) | keeps you signed in: strictly necessary, and set only when you sign in, create an account or reset a password. Never set for a visitor who has not. On a copy of the site served without https it is named stms_session instead | 2 hours after you last did anything, and 24 hours at most from signing in |
stms.cart | localStorage | the plugins you added to your cart, so they are still there when you come back. It stays in your browser and is not sent to us until you start checkout | until you empty the cart or clear site data |
stms-theme | localStorage | remembers the light/dark choice you made with the theme control on the tools page, the one page that still has one | until you clear site data |
stms-dash-theme | localStorage | remembers the light/dark choice on the administrator pages. Only set if you use the theme control there, so a visitor never has it | until you clear site data |
| Paddle's checkout storage | cookies and localStorage, set by Paddle | runs the payment form: Paddle’s script is loaded, and its storage set, only once you click buy and the checkout opens | governed by Paddle's own cookie policy, not this one |
Trader identity
Connect
One app for your stms plugins. In development for macOS and Windows; get notified when it is ready.
Get release updates