Cookie Policy
What cookies Ostany uses, why, and how you can control them.
This is the English version. In the event of any discrepancy with the Bulgarian version, the Bulgarian version shall prevail.
Ostany — use of cookies
Version: 1.0
Date of publication: [date]
Date of entry into force: [date]
This Cookie Policy explains what cookies and similar technologies Ostany uses on this website, why we use them, how long they last and how you can control them. It supplements and should be read together with our Privacy Policy.
It is drawn up in accordance with Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) as implemented by the Bulgarian Electronic Communications Act (Zakon za elektronnite saobshteniya) and with Regulation (EU) 2016/679 (GDPR).
1. What cookies are
A cookie is a small text file that a website asks your browser to store on your device. It lets the site recognise your browser on later requests — for example, to keep you signed in as you move between pages. "Similar technologies" (such as your browser's local storage) work in a comparable way. In this Policy we refer to all of them as "cookies".
Cookies can be first-party (set by the website you are visiting — here, Ostany) or third-party (set by another domain). They can last only for the current browsing session (session cookies, deleted when you close the browser) or for a set period (persistent cookies).
2. Do we ask for your consent?
Ostany uses only strictly necessary cookies — cookies that are essential for the website to work and for you to sign in, stay signed in and transact securely. Under Article 5(3) of the ePrivacy Directive and the Bulgarian Electronic Communications Act, strictly necessary cookies are exempt from the prior-consent requirement, because you cannot use the service you asked for without them.
We do not use analytics, advertising, profiling, social-media or other tracking cookies. For that reason we do not show a cookie consent banner and there is nothing on our side for you to opt into or out of.
If we ever introduce non-essential cookies (for example, analytics), we will first ask for your prior, freely given consent through a consent tool, and this Policy will be updated before those cookies are used.
3. The cookies we use
All of the cookies below are first-party — set by the Ostany domain. In production they are sent only over an encrypted HTTPS connection (Secure), are limited to our own site (SameSite=Lax), and — where marked HttpOnly — cannot be read by JavaScript, which protects them against theft by malicious scripts.
| Cookie | Purpose | Category | Retention |
| `ostany_access` | Holds your short-lived session token so you stay signed in as you use the site. `HttpOnly`. | Strictly necessary | 15 minutes |
| `ostany_refresh` | Lets us renew your session in the background so you are not logged out unexpectedly. `HttpOnly`. | Strictly necessary | 30 days |
| `authjs.session-token` (and its `__Secure-` variant) | Maintains your authenticated session, including sign-in with Google or Apple. `HttpOnly`. | Strictly necessary | Up to 7 days |
| `authjs.csrf-token` (and its `__Host-` variant) | Security token that protects the sign-in process against cross-site request forgery (CSRF). | Strictly necessary | Session |
| `authjs.callback-url` (and its `__Secure-` variant) | Remembers which page to return you to after you complete sign-in. | Strictly necessary | Session |
If you never sign in, most of these cookies are never set — a signed-out visitor can browse listings without them.
4. Third-party services
We do not embed third-party advertising or analytics, and no third party sets tracking cookies through Ostany. However, some steps hand you over to trusted providers that run in their own environment and under their own cookie and privacy policies. These providers are also our processors under the Privacy Policy.
Sign in with Google / Apple — if you choose social login, Google or Apple may set cookies on their own domains to authenticate you. Governed by Google's and Apple's respective privacy policies.
Payments (Mollie) — card and other payment steps are completed in Mollie's secure environment, which may set cookies strictly necessary to process the payment and prevent fraud. Governed by Mollie's cookie and privacy policy.
Image storage (UploadThing) — photos you upload are stored with our file-storage provider; it does not set cookies on the Ostany site.
5. How to control and delete cookies
Because Ostany uses only strictly necessary cookies, there is nothing to switch off on the site itself. You can still view, block or delete cookies at any time through your browser settings:
Google Chrome — Settings → Privacy and security → Cookies and other site data
Mozilla Firefox — Settings → Privacy & Security → Cookies and Site Data
Safari — Settings → Privacy
Microsoft Edge — Settings → Cookies and site permissions
Please note: our session cookies are required for the site to function. If you block or delete them, you will be signed out and will not be able to sign in, message a host or complete a booking.
6. Do Not Track
Ostany does not track you across other websites and does not build advertising profiles, so a browser "Do Not Track" signal has no additional effect on the cookies described above.
7. Changes to this Policy
We may update this Cookie Policy to reflect changes in the technologies we use or in the law. The current version, together with its version number and effective date, is always available at /legal/cookies-policy. Material changes will be announced by the usual means before they take effect.
8. Contact
Questions about this Policy or about cookies can be sent to the controller and the data-protection contact identified in our Privacy Policy — [data protection / privacy contact email].