The short version
- Four cookies are strictly necessary — they keep you logged in, remember your language, hold your cookie choice, and prove a guest entered the right check-in code.
- Analytics cookies load only if you accept them, and never before.
- We run no advertising cookies and no cross-site ad trackers, on our site or on any guest page.
- You can change your choice at any time from the link in the footer.
This summary is a reading aid and is not part of the agreement. Where it differs from the text below, the text below is what applies.
Contents+
A cookie is a small file a site stores in your browser. This policy covers cookies and the similar technologies a browser offers — localStorage and sessionStorage — which we treat the same way. It sits alongside the Privacy Policy, which explains what we do with the data itself.
Strictly necessary cookies
These are set without asking, because the service does not work without them. They carry no advertising identifier and are never shared.
| Cookie | What it does | How long |
|---|---|---|
hostbnb_session | A signed token that keeps a host signed in. HttpOnly, so page scripts cannot read it. | Session length, then expires |
hostbnb_stay_<property> | Proof that a guest typed the correct check-in code for that property, so the protected parts of the guide stay open without retyping it. HttpOnly. | 30 days |
hostbnb_locale | The language you picked, so pages keep loading in it. | 1 year |
hostbnb_consent | Your answer to the cookie banner. Without it we would have to ask again on every page. | 6 months |
Analytics cookies — only if you say yes
These help us see which features get used and where people get stuck. Nothing loads until you accept: the analytics script is not fetched, no identifier is created, and no event is sent.
| Cookie | Set by | What it does | How long |
|---|---|---|---|
ph_* | PostHog | A pseudonymous device identifier and the state the analytics SDK needs, so repeat visits from one browser are counted once. Requests go to a first-party /ingest path on this domain, not to a third-party host. | Up to 1 year |
Anonymous visitors on a public guest page never get an analytics person profile — a profile is created only for a host who has signed in. Session recording is off, and would mask the contents of every input field if it were ever switched on.
What we don't do
- No advertising cookies, no retargeting pixels, no ad-network tags.
- No cross-site tracking, and no selling or sharing of browsing data for behavioural advertising.
- No third-party trackers injected into the guest pages hosts publish. A host's guest page carries the same cookies described here, and nothing else.
Cookies set by others
A few things on the site are served by someone else, and they set their own cookies under their own policies:
- Stripe — on the checkout and billing screens, for payment processing and fraud prevention.
- Google Maps — where a map is embedded on a guest page.
- Viator — only once you click through to book a tour, at which point you are on Viator's own site.
Changing your mind
Use the Cookie settings link in the footer of any page. Declining analytics costs nothing: every feature works exactly the same either way.
You can also clear or block cookies in your browser settings. Blocking the strictly necessary ones will sign you out and will make check-in-code-protected guide sections ask for the code on every visit.
We honour the Global Privacy Control signal. If your browser sends one, we treat it as a decision to decline analytics cookies and do not ask again.
Questions
Write to privacy@hostbnb.example.com. If we add or change a cookie, we update this page and the effective date at the top.