What we set
Three kinds: what the site needs to work, which is always on; analytics; and advertising. If you are in the EEA, the UK or Switzerland — or we cannot tell where you are — analytics and advertising stay off until you say yes in the banner. Everywhere else they are on by default, and you can switch either off at any time in Cookie settings, in the footer of every page.
- Necessary — always on. A session that keeps you signed in, which ends when you sign out. Your theme, currency and home airport, so you are not asked again. Roughly where your connection comes from — the country and nearest city, rounded to about 10 km, worked out by our own server from your IP address — so we can pick a currency and your nearest departure airport, and know whether to ask about cookies. You can change the airport on any deals board. Your cookie choice itself, for 13 months. All stored in your browser; none of it is used for advertising.
- Analytics — Google Analytics 4. Its cookies (
_gaand_ga_…, up to two years) count visits, the pages viewed, the page you came from, device type, approximate location, and events such as a search, a sign-up or a booking — so we can see which pages work. With it, our own record of the tagged link that brought you here (the campaign tags and the ad click ID), kept in your browser for 90 days and sent with a booking so we know which campaign it came from. Only with analytics consent where the law asks for it. - Advertising — Google Ads. Its cookies (
_gcl_au,_gcl_awand similar, 90 days, plus Google’s own on google.com and doubleclick.net) tell us whether an ad led to a sign-up or a booking, and let us show our ads to people who have visited (remarketing). With enhanced conversions, when you sign up or book, your email address is sent as a SHA-256 hash — scrambled one way — so Google can match it to an ad without receiving the address itself. - Advertising — Meta Pixel and Conversions API (Facebook and Instagram). The pixel’s cookies (
_fbp, 90 days, and_fbcwhen you arrive from a Meta ad) do the same job on Meta, with the same hashed email. When you book, our server also sends Meta that booking directly — its value and currency, a booking reference, your hashed email, your IP address and browser type — so a blocked script does not lose it. Only if you allowed advertising, and never for a test booking.
What we do not do
No fingerprinting. No card details, names or phone numbers in any of it. Nothing for analytics or advertising before you say yes, where the law asks us to wait. We sell no advertising space on the site and run no ad network.
What your browser keeps locally
Your recent searches, your theme, and any map you built before signing up live in your browser’s local storage so you do not lose them. Clearing your browser data clears them.
A checkout in progress — the room you picked, the dates and the details you typed — is held in session storage until the booking finishes. It has to be: the payment step hands you to our partner and back, and without it the booking would not survive the return trip. It is gone when you close the tab, and it never contains a card number.
Controlling cookies
Cookie settings, in the footer of every page, reopens the banner: switch analytics or advertising on or off, and save. Open Cookie settings now. A change applies straight away; cookies Google or Meta have already set expire on their own schedule, or you can delete them in your browser.
Every major browser also lets you see, block and delete cookies, and clear local storage — usually under Settings, then Privacy. Blocking the session cookie will sign you out and prevent you signing back in; everything else is safe to block, and the site will simply forget your preferences.
We honour the Global Privacy Control signal. When your browser sends it, advertising stays off — whatever else is stored, and even if you clicked Accept all.