← Back to Solis
Solis
School Management Platform
Cookie Policy · Last updated: 13 October 2026

1. About this policy

This Cookie Policy explains the small pieces of information Solis stores in your web browser, what each one is for, and how long it lasts. It sits alongside the Privacy Policy, which explains how Solis handles personal information more generally.

If you have any question about this policy, please contact hello@solisapp.co.uk.

2. The short version

  • Solis stores information in your browser only to sign you in, to keep certain steps secure, and to remember a few on-screen choices on your own device.
  • Solis does not use advertising cookies or tracking cookies, and does not use any analytics service.
  • Solis does not sell personal information to advertisers.
  • The public legal pages (this page, the Privacy Policy and the Terms of Use) and the public event ticket pages do not set any cookies or browser storage of their own.

3. Cookies, session storage and local storage

Solis uses four kinds of browser storage. All of them belong to the Solis web address and can only be read by Solis pages.

  • Cookies are small pieces of text your browser sends back to Solis with each request. Every cookie Solis sets is marked so that scripts on the page cannot read it, and on the live service the sign-in and security cookies are only ever sent over an encrypted connection.
  • Session storage is kept by your browser for a single tab and is cleared automatically when that tab or window is closed. It is not sent to Solis automatically.
  • Local storage is kept by your browser on this device until it is cleared. It is not sent to Solis automatically, and Solis uses it only for on-screen preferences.
  • Cache storage is used by a small background script (a “service worker”) that the staff app and the parent portal install so that pages load faster and an offline notice can be shown. It keeps copies of Solis's own design files, scripts and icons and of the public libraries listed in section 5. It never stores pages containing school, pupil, parent or staff information.

The categories used below mean:

  • Strictly necessary — needed to sign you in and provide the service you have asked for.
  • Security — needed to protect a specific step, such as connecting an accounting system, against forged requests.
  • Functional — remembers an on-screen choice or your place on a page, on your own device, so the service works the way you left it.

4. What Solis stores

Everything listed in this section is set by Solis itself.

Cookies

NameCategoryPurposeDuration
sb_access_token Strictly necessary Keeps you signed in to the staff app or the parent portal. Holds a short-lived sign-in token issued by Solis's authentication provider (Supabase). Until you close your browser, or up to 1 hour at a time if you chose “Keep me signed in”; renewed automatically while you use Solis; deleted when you sign out
sb_refresh_token Strictly necessary Lets Solis renew your sign-in without asking for your password again. Signing out also cancels it with the authentication provider. Until you close your browser (and at most 12 hours), or up to 14 days from sign-in if you chose “Keep me signed in”; deleted when you sign out
sb_session_meta Strictly necessary (security) A tamper-proof marker recording whether you chose “Keep me signed in” for this sign-in, so Solis can enforce the right time limit. Holds no personal information. Same as sb_refresh_token
sb_last_activity Strictly necessary (security) School and platform administrators only. A tamper-proof record of when you last used Solis, so an administrator’s sign-in ends after 30 minutes without activity. Holds only that time and a reference to your current sign-in. Until you close your browser; renewed while you use Solis; deleted when you sign out or are signed out
qbo_oauth_state Security Only set when a school administrator connects QuickBooks. Confirms that the reply coming back from QuickBooks belongs to the connection that administrator started. 5 minutes; deleted when the connection step finishes
xero_oauth_state Security The same protection, only when a school administrator connects Xero. 10 minutes; deleted when the connection step finishes
freeagent_oauth_state Security The same protection, only when a school administrator connects FreeAgent. 10 minutes; deleted when the connection step finishes
mpa_invoice_month Functional Staff only. Remembers which billing month you last chose on the Invoices page for a monthly-billed term, so it stays selected when you open an invoice and come back. 90 days

Solis's internal development and test environments also use two cookies for testing different user roles (mpa_dev_role and mpa_dev_staff_id). Those features are switched off on the live service, so these cookies are never set there.

Session storage (cleared when you close the tab)

NameCategoryPurposeDuration
mpaScrollY:… (followed by the page address) Functional Staff app and parent portal. Returns you to the same place on a page after you save a form. Removed as soon as the page reloads; otherwise until the tab is closed
mpaFilterScroll:… (followed by the page address) Functional Staff app. Keeps your place on a list after you filter, sort or change page. Removed as soon as the page reloads; otherwise until the tab is closed
mpaDirtyCarry Functional Staff app and parent portal. When a page has more than one form and you save one of them, temporarily keeps what you had typed into the others (never passwords or files) so it is not lost, and puts it back when the page reloads. Removed when restored; ignored after 30 minutes; cleared when the tab is closed
askClaudeHistory:… and askClaudeTokens:… (followed by a coded reference to the signed-in user and which assistant is open) Functional Staff app. Keeps your conversation with an in-app AI assistant (and a running count of its usage) while the tab is open, so it survives moving between pages. The earlier conversation is sent back with your next question so the assistant has context. Any other user's conversation is deleted automatically when a page loads, and every conversation is deleted when the sign-in page is shown. Until the tab is closed, you sign out, or you clear the conversation
mpa-tt-day:… (followed by a term reference) Functional Staff app. Remembers which day you were looking at on the Timetable. Until the tab is closed
help-nav-collapsed Functional Staff app. Remembers whether you collapsed the User Guide's chapter list. Until the tab is closed
wt.home Functional Solis's own operator console only. Remembers the chosen sort order of the schools list. Until the tab is closed
solis-demo-form Functional Solis website, Book a demo form. Keeps what you typed into the form when you send it, so that if the form comes back asking you to correct something, you do not have to type it all again. Until the tab is closed
solis-tags Functional Solis website. Only when the link that brought you to the website carries a campaign tag: remembers that tag while you move between the website's pages, so that if you then ask about Solis, your enquiry records which link you came from (see "Enquiries about Solis" in the Privacy Policy). Until the tab is closed

Local storage (kept on this device until cleared)

NameCategoryPurposeDuration
mpa-collapse:… (followed by a page and section name, never a pupil or staff identifier) Functional Staff app. Remembers which sections of detail pages (for example a class or pupil page) you opened or closed. Until cleared
mpa-classes-list-collapse:… (followed by a group name) Functional Staff app. Remembers which groups on the Classes list you opened or closed. Until cleared
mpa-disc-open-… (followed by a discipline reference) Functional Staff app. Remembers which discipline cards you opened or closed in Settings. Until cleared
mpa_plan_panel_open Functional Staff app. Remembers whether you opened or closed the class-plan panel on the attendance page. Until cleared
mpa-tt-tab Functional Staff app. Remembers which Timetable tab you last used. Until cleared
timetableDrawer.students Functional Staff app. Remembers whether you opened or closed the pupils list in the Timetable's class panel. Until cleared
mpa-install-dismissed Functional Staff app. Remembers that you closed the “install the Solis app” banner, so it is not shown again. Until cleared
mpa-visit-count Functional Staff app. A simple count, kept only on this device, of how many Solis pages have been opened, used only to decide when to offer the “install the Solis app” banner (from the third page onwards). It is never sent to Solis or anyone else. It stops counting once the banner has been closed or the install prompt answered, and is not used when Solis is opened as an installed app. Until cleared

Cache storage

NameCategoryPurposeDuration
mpa-static-… (followed by a version number) Functional Staff app and parent portal. Copies of Solis's design files, scripts, icons and offline notice, and of the public libraries in section 5, so pages load faster. Contains no school, pupil, parent or staff information. Until Solis releases a new version (older copies are then deleted automatically) or you clear site data

5. Files loaded from other providers

To display pages, Solis asks your browser to load some widely used public design and script libraries, and a typeface, directly from these providers:

  • jsDelivr (cdn.jsdelivr.net) — the Bootstrap design library and its icons, on every Solis page including this one; and, on certain staff pages only, libraries for formatting text, drawing charts, scanning ticket QR codes and reordering lists
  • unpkg (unpkg.com) — two libraries that make staff-app pages interactive (htmx and Alpine.js), staff app only
  • Google Fonts (fonts.googleapis.com and fonts.gstatic.com) — the Plus Jakarta Sans typeface, on most pages

When your browser fetches these files, the provider receives the technical details that come with any web request, such as your IP address and browser type, and handles them under its own privacy policy. Solis does not use these providers for advertising, tracking or analytics, and the libraries, as Solis uses them, do not create cookies or browser storage of their own.

6. Other websites you may visit from Solis

  • Card payments. When you pay an invoice or buy event tickets by card, you are taken to a payment page hosted by Stripe on Stripe's own website. Stripe may set its own cookies on its pages, under Stripe's own policies. Solis does not load Stripe's scripts on Solis pages.
  • Accounting connections. When a school administrator connects QuickBooks, Xero or FreeAgent, they sign in on that provider's own website, which may set its own cookies under its own policies.
  • Maps and calendars. Links such as directions to a venue or adding an event to a calendar open another provider's website or app only when you choose to follow them.

7. Managing and clearing storage

  • Signing out deletes the sign-in cookies. Closing a tab clears its session storage.
  • You can delete everything Solis has stored by clearing the site data (cookies and site data) for the Solis web address in your browser's settings. This also removes the cached copies and the service worker.
  • You can block cookies in your browser, but Solis needs its sign-in cookies, so you will not be able to sign in while they are blocked. Blocking session or local storage means Solis will simply not remember your on-screen choices.

8. Changes and contact

This Cookie Policy may be updated from time to time as Solis develops. If you have any question about it, please contact hello@solisapp.co.uk.

Privacy Policy·Terms of Use and End-User Licence Agreement
← Back to Solis