Cookie and browser-storage policy

Necessary authentication and security

NextAuth session, CSRF, callback and temporary sign-in cookies protect authentication and return you to the requested page. Production authentication cookies use secure browser prefixes. Their lifetime depends on the sign-in flow and session settings. Blocking necessary cookies can prevent account features from working.

Guest usage identifiers and server-side counters help apply browsing limits and protect availability. They are not advertising profiles.

Preferences and your trip

Language and theme choices are kept in browser cookies or local storage. The guest itinerary uses session storage named um:guest-journey, including the stops and notes you choose. It is a browser-session draft rather than an account backup. Local preferences persist until you clear or replace them; session data normally ends when that session ends.

Consent record

um_cookie_consent in local storage records category choices and the time of selection. The um_consent_v1 cookie records the same optional categories for up to one year. Necessary only rejects optional analytics, marketing and personalisation. The banner stays visible until you explicitly save a choice.

You can change the choice using Cookie settings below or in the footer. Clearing browser storage removes the saved choice and the banner can appear again.

Optional categories

Analytics measures use only when the feature is enabled and you consent. Marketing covers optional advertising or campaign tracking. Personalisation covers optional features beyond the preferences or saved trip you request. The initial launch configuration disables analytics and advertising; no optional provider is activated merely because its category is accepted.

If new optional providers are introduced, this page and the consent interface must be updated before their tracking is activated. Refusing optional categories does not prevent ordinary browsing.

External content and browser controls

Photographs and fallback maps may be requested from external hosts to render the page. Sharing and external booking links open another provider only when you use them. Those providers’ storage and privacy practices are described in their own policies.

Your browser can show, block or delete cookies and storage. Deleting storage may remove your language choice, consent record and unsaved guest trip. It does not itself delete an account stored on our servers.