Cookie and local storage policy

1. Strictly necessary technologies

The Bookfilo session cookie (its technical name is configurable) identifies the authenticated session; it is HttpOnly, SameSite=Lax and normally expires after 120 minutes of inactivity. XSRF-TOKEN enables the browser to protect requests against CSRF forgery and follows the session lifetime.

bookfilo_oauth_browser securely links the browser to Google/Apple sign-in; it is HttpOnly, restricted to the OAuth route and expires after 10 minutes. The associated exchange code expires after 90 seconds and is consumed only once.

bookfilo_legal_consent_v2 (localStorage) records the decision, version, categories and date, including refusal, to respect your choice and avoid continually displaying the dialog. Authenticated user interface data is held only temporarily in page memory and is securely reloaded from the server session.

2. User-requested functional preferences

preferred_locale remembers the selected language for 12 months; theme (localStorage) remembers the light, dark or system theme until changed/deleted; local favourites remember identifiers of properties selected by visitors until removed or browser data is cleared.

These storage mechanisms fulfil user-requested actions or preferences and are not used for advertising. You can clear them through browser settings; you lose only the associated preference or local list.

2a. Internal visit counting

baap_visit_ping:* keys (sessionStorage) prevent repeat counting of a page on the current day and disappear when the browser session closes. Internal counting also uses server-side pseudonymous identifiers for statistics and ranking. In the current service these mechanisms operate independently of the Google Analytics choice. Statistical purpose or pseudonymisation does not automatically make them strictly necessary; legitimate interests do not replace consent required by law for device storage or access.

3. Optional analytics — Google Analytics

Optional analytics includes Google Analytics and PostHog, when configured. Masked PostHog session replay has a separate choice that also requires analytics consent. The Google script does not load before consent. When enabled, we send visited pages and interaction events; analytics_storage is set to “granted”, while ad_storage, ad_user_data and ad_personalization remain “denied”. Google Signals and ad-personalisation signals are disabled.

Google may set identifiers such as _ga for periods determined by the service and its configuration (usually up to 2 years). Current details: https://policies.google.com/technologies/cookies. Bookfilo may separately retain the optional technical data described in the Privacy Policy.

4. What we do not use in the current version

We do not activate Bookfilo behavioural marketing, retargeting or data-sale cookies and do not display switches for functions that do not exist. Social-network links are simple links; content from those services is not automatically embedded in the page.

Functional maps and location — Mapbox

Mapbox supplies the core map and location functions of Bookfilo. Maps initialise automatically on pages that use them, without separate optional consent, and there is no Mapbox off switch in Cookie preferences. Choosing “Necessary only” or withdrawing analytics consent does not stop these functions.

api.mapbox.com delivers map resources and events.mapbox.com receives usage/billing events with your IP address, browser information and related identifiers. Optional performance metrics are disabled, but usage/billing and style-load events remain active.

Mapbox GL JS uses localStorage keys with the prefix mapbox.eventData, including mapbox.eventData.uuid and mapbox.eventData.uuidTimestamp, for events and billing identifiers. The SDK rotates the identifier after approximately 24 hours; keys may persist between visits until updated by the SDK or cleared in your browser. You can clear them through browser settings; subsequent map use may recreate them.

Address/place searches use the Mapbox API to provide the requested function. Data, retention and possible USA transfers are described in our Privacy Policy and at https://www.mapbox.com/legal/privacy.

5. Choice, refusal and withdrawal

You may accept all optional tools, reject optional services or configure analytics and session replay separately in the consent dialog. Accept and reject buttons are offered at the same level. Core functions, including Mapbox, remain active regardless of your analytics choice.

You may reopen the dialog at any time through “Cookie preferences” in the footer. Withdrawal stops future optional analytics collection but does not automatically delete data already transmitted; for that data, you may exercise the rights in the Privacy Policy. You can manually clear cookies and local storage in your browser, in which case we will ask for your choice again.

6. Contact

For questions about these technologies or exercising your rights: [email protected]. The list may be updated when we introduce or remove a technology; any new non-essential category will remain disabled until consent.

PostHog — analytics and masked session replay

When configured and only after a renewed analytics choice, PostHog measures searches, property views, submitted enquiries and host onboarding steps. We send pseudonymous browser and session identifiers and, for eligible signed-in accounts, the internal account ID. Events contain only page categories, locale, device category, result counts, public property IDs and field or error codes. We do not send names, emails, messages, entered values, raw URLs, booking signatures or tokens. PostHog also receives connection data needed for delivery, including the IP address; IP-based analytics enrichment is disabled.

Session replay requires separate permission and analytics consent. When enabled in configuration, we select 20% of eligible sessions. Public discovery and property pages and the first 3 onboarding steps are eligible; authentication, account, private booking, payment, billing, support and administration screens are excluded. Text, inputs and data-bearing attributes are masked, and images and sensitive elements are blocked. We do not capture network request contents, headers, console logs or canvas.

We use an EU PostHog Cloud project in Frankfurt. PostHog, Inc. provides the service: https://posthog.com/privacy and https://posthog.com/dpa. On the initial free plan, events are retained for 1 year and recordings for 1 month. Access to dashboards and recordings is intended for the team improving the product; administrative and configured internal accounts are excluded from collection.

PostHog uses localStorage for pseudonymous identifiers and sessionStorage for session management, only after consent. Withdrawal stops collection and replay and clears PostHog browser persistence; logout or an account change resets identity. A Google Analytics choice from version 2 does not activate PostHog: we request a new version 3 decision in bookfilo_legal_consent_v2. Withdrawal does not automatically delete data already sent; contact us to exercise the rights described in the privacy policy.