Security

Adding a script to your site is a decision about trust. Here is exactly what ours does.

Your key is safe in your page source

Anyone can right click and see your key, as with every embed. It is not a password. It only works on the domain you registered and its subdomains. On any other site it returns nothing. It cannot open your account, change your settings or see your stats.

What the script does

• Loads with async, so it never holds up your page.
• Makes one request to our server for today's greeting, sending your key, the date and the browser language.
• Reads your colours, fonts and logo in the browser to match your design. None of this leaves the browser.
• Stores a small "already seen" note in the visitor's browser, so the greeting shows once.
• While a holiday runs, it adds a closable ribbon, light effects, a small mark on your logo and a holiday favicon. You can turn each one off.

What it never does

• Set cookies.
• Read forms, passwords, card fields or anything typed into your site.
• Send your page content or customer data to us.
• Load ad, tracking or other third-party scripts. Fonts and images come from our own server.
• Appear on cart, checkout or sign-in pages.

If we go down

Your site carries on. If our server cannot be reached, no greeting shows and nothing breaks.

Strict sites

If your site uses a Content Security Policy, allow holidoodle.dev in script-src, style-src, font-src, img-src and connect-src. Without that, your browser blocks the script and your site stays as it is.

Your account

• Passwords are stored as salted hashes, never as text.
• Sign-in attempts are limited.
• All traffic uses HTTPS.
• Payments go through Polar. We never see your card.

Found a problem?

Write to emrahsinekli@gmail.com. We read every report.