Cookie policy
Last updated 22 July 2026
Adverts pay for this site, so you’ll see them either way — but you decide whether they’re based on you. Say no and they’re chosen from the page you’re on, not from a profile of you. Beyond that there’s no analytics following you around the internet and no third-party pixels on page view. The list below is the whole list.
Strictly necessary — always on
These make the site work. The law lets us set them without asking, because without them there’s nothing to consent to: you couldn’t stay signed in, and we couldn’t remember that you told us no.
| Cookie | What it does | How long it lasts |
|---|---|---|
authjs.session-token | Keeps you signed in as you move between pages. Only set if you sign in with Google. | 30 days, or until you sign out |
authjs.csrf-token | A security token that stops another website submitting forms on this site as you. | The browser session |
mdo_consent | Remembers your cookie choices, so we honour them and only ask once. | About 6 months |
mdo:saved (local storage) | Not strictly a cookie — your favourites list, held in your own browser so it survives a refresh even without an account. | Until you clear it |
Non-essential — only with your say-so
These are the ones you get a choice about. We don’t open a banner the moment you arrive to ask: the advertising question comes from Google’s own consent box, and we ask about affiliate tracking at the point it would actually happen — when you click through to book — so you can see what you’re agreeing to. Analytics is off unless you turn it on below.
| Cookie | What it does | How long it lasts |
|---|---|---|
Affiliate partner tracking | Set by booking platforms such as Lovetovisit or Picniq when you click through, so they know the visit came from us and we earn a small commission. It never changes the price you pay. Only fires if you accept. | Set by the partner, typically 30 days |
Google AdSense advertising | Set by Google to tailor adverts to you and cap how often you see the same one. Google asks about these itself, in its own consent box — we never set them on its behalf. Adverts still appear if you decline; they're just chosen from the page you're reading rather than from a profile of you. | Set by Google, typically up to 13 months |
Google Analytics (_ga, _ga_*) | Set by Google Analytics to count visits and see which pages are worth writing more of. Only fires if you accept. Decline and the measurement still runs without cookies: we get an anonymous count, but nothing is stored on your device and you aren't recognised between visits. | Set by Google, up to 2 years |
Nothing fires before you agree. UK law (PECR) requires priorconsent for non-essential cookies, so affiliate tracking stays switched off until you actively accept it — not switched on until you object. If you haven’t been asked yet, or you said no, our booking links still work perfectly: you just go straight to the partner and we don’t get the credit.
Change your mind
Any time, in one click, in either direction. Withdrawing is as easy as giving it.
Opens the cookie panel with your current settings loaded.
You can also clear or block cookies in your browser settings. If you block everything, the site still works — you just won’t be able to stay signed in, and we’ll ask about cookies again on your next visit because we can’t remember that we asked.
More on what we do with data generally in our privacy notice, and more on the commission model in our affiliate disclosure.