Cookie Policy
Draft: not yet legally reviewed
This document is a working draft and has not yet been reviewed by a travel-trade solicitor. It is published here for transparency only and does not yet represent the final terms of any booking.
There is no cookie banner on this site, and that is deliberate. We do not use advertising cookies, we do not use Google Analytics, and nothing here follows you to other websites. Everything we store on your device is either required for the site to work or is a setting you chose yourself, and under UK GDPR and PECR neither needs consent. We would rather remove the tracking than ask you to dismiss a box about it.
A banner is not something we have decided we can do without: it is wired to the tracking, so if the tracking is ever switched on the banner switches on with it, in the same change. Until you have pressed Accept, the code that would send anything does not run.
Signing in is the one thing that adds cookies. Three of the entries below appear only if you create an account, and none of them if you do not. They keep you signed in, which is the thing you asked for by signing in, so they are strictly necessary and need no consent. If you choose Continue with Google rather than the email link, Google learns that you signed in here and when. The email link involves nobody but us and the company that carries the mail.
What we store on your device
The list is complete. Browser storage counts the same as cookies in law, so local storage is in here too.
| Name | Purpose | Type | Lasts |
|---|---|---|---|
| NEXT_LOCALE | Remembers which language you chose, so the site opens in it. | Cookie · strictly necessary | 1 year |
| zn-theme | Remembers whether you picked light or dark mode. Only written after you use the toggle. | Local storage · your preference | Until you clear it |
| zn-basket | Holds what you have put in the shop basket, so it survives a refresh. Product codes and quantities only, no prices and nothing about you. | Local storage · strictly necessary | Until you check out or clear it |
| Cloudflare Turnstile | Bot check when you submit a form, so the inbox is not filled with spam. | Cookie · strictly necessary | The length of the check |
| sb-…-auth-token | Keeps you signed in to your account. Set by Supabase, who provide the sign-in, only once you actually sign in. Nothing sets it if you never do. Signing out removes it. | Cookie · strictly necessary | Until you sign out, or it expires |
| sb-…-auth-token-code-verifier | A short-lived value used while you are signing in with Google, so the site can confirm the reply came back from the sign-in you started. Deleted the moment sign-in finishes. | Cookie · strictly necessary | Minutes |
| __Host-zx_admin | Signs the site owner in to the internal operations dashboard. Never set for a visitor; listed for completeness because the rules cover anything written to a device. | Cookie · strictly necessary | 8 hours |
| zn-consent | Remembers your answer if we ever ask about page-view counting, including a no. Written only when you press one of the buttons. Page-view counting is switched off at present, so nothing asks and nothing writes this. | Local storage · strictly necessary | Until you clear it |
Things we deliberately do not do
- No third-party analytics. Our visitor numbers come from Netlify, which counts requests at the server from the web logs. It sets no cookies and runs no script in your browser, so there is nothing for you to opt out of.
- Maps do not load by themselves. Google Maps would see your IP address and set its own cookies, so our maps show a placeholder until you tap to load one. If you never tap, Google is never told you were here.
- Weather comes through us, not from you. The live weather is fetched by our server and passed on, so the weather provider never sees your device or your IP address.
- We are not counting page views at all right now. The site has the ability to count which pages get read, and it is switched off. Nothing is sent from your browser and the address that would receive it is not there, so there is nothing collected and unused sitting anywhere. If we ever turn it on, a bar appears at the bottom of the page first and nothing is recorded until you press Accept. Ignoring the bar, or pressing Decline, both mean nothing is sent.
- Do Not Track is honoured. If your browser sends a Do Not Track or Global Privacy Control signal, you will not be asked at all, and nothing will be counted even if the setting above changes.
Clearing what is stored
Your browser settings will clear all of it. Doing so resets your language and theme choices and empties the basket; nothing else is affected, because nothing else is kept on your device.
If we ever add anything that does need consent, a banner will appear and this page will change with it. Questions: privacy@zannextravels.com.