Cookiepolicy

This Cookie Policy is drawn up in English, and the English text is the only authentic version. A Bulgarian translation is provided for convenience; in the event of any discrepancy, the English text prevails. Neither that translation nor any other, including an automatic translation by your browser, has legal effect of its own. This does not derogate from any mandatory rule of law on the language in which information must be provided to you.

Ostany: use of cookies

Version: 1.1

Date of publication: [date]

Date of entry into force: [date]

---

This Cookie Policy explains what cookies and similar technologies Ostany uses on this website, why we use them, how long they last and how you can control them. It supplements and should be read together with our Privacy Policy.

It is drawn up in accordance with Article 5(3) of Directive 2002/58/EC (the ePrivacy Directive) as implemented in Bulgaria by Article 4a of the E-Commerce Act (Zakon za elektronnata targoviya), and with Regulation (EU) 2016/679 (GDPR).

---

1. What cookies are

A cookie is a small text file that a website asks your browser to store on your device. It lets the site recognise your browser on later requests (for example, to keep you signed in as you move between pages). "Similar technologies" (such as your browser's local or session storage) work in a comparable way. In this Policy we refer to all of them as "cookies".

Cookies can be first-party (set by the website you are visiting; here, Ostany) or third-party (set by another domain). They can last only for the current browsing session (session cookies, deleted when you close the browser) or for a set period (persistent cookies).

---

2. Do we ask for your consent?

Apart from the one optional choice described below, Ostany uses only cookies and similar technologies that are strictly necessary to provide the service you ask for: signing up (including keeping your acceptance of our Guest Terms until your account is created), signing in, staying signed in, transacting securely, showing the site in the language you chose and remembering your cookie choice. Under Article 5(3) of the ePrivacy Directive and Article 4a(4), point 2, of the Bulgarian E-Commerce Act, these are exempt from the prior-consent requirement, because they are necessary for a service you have explicitly requested.

We do not use analytics, advertising, social-media or other tracking cookies, pixels or similar technologies, and we do not follow you across other websites.

The one thing we ask your consent for: Google Maps on listing and trip pages. We ask for your consent for one purpose only: letting the interactive Google map load by itself on listing pages and on the pages of your trips, as the map section of the page comes into view or close to it (see section 4). On your first visit, a banner at the bottom of the screen asks you to choose between "Allow" and "Only necessary". Both options are equally easy to choose: they have the same size and appearance, and nothing is selected in advance. Until you choose, and if you choose "Only necessary", nothing optional is loaded: a listing page shows a picture of the map and the page of your trip a "Show map" button, and the interactive map loads only when you click one of them or the map's full-screen button (section 4). Scrolling, closing the page or ignoring the banner is not consent; the banner simply stays until you choose. We store your choice in the cookie ostany_consent (section 3) so that we do not ask you on every page; it contains only your choice, not an identifier, and after six months we ask you again. You can change your choice or withdraw your consent at any time, as easily as you gave it, with "Cookie settings" in the footer at the bottom of our pages. Withdrawing your consent does not affect the lawfulness of anything that happened before you withdrew it.

The sign-in cookie ostany_access has one further use, which we explain openly in section 3: while you are signed in, it links the Listings you view and the searches you make to your account for personalised recommendations. You can switch that off at any time in Account settings, under Privacy, using the "Personalised recommendations" switch; switching it off also deletes that stored history.

If we ever introduce any other cookie or similar technology that is not exempt (for example, for analytics), we will first update this Policy and ask for your prior, freely given consent for it, before that technology is used.

---

3. The cookies we use

All of the cookies below are first-party: they are set by the Ostany domain and sent only to it. Most of them are limited to our own site (SameSite=Lax). Some of the cookies used when you sign in or sign up with Apple (authjs.state and authjs.nonce, and ostany_oauth_terms and ostany_oauth_apple_name) are marked SameSite=None instead, because Apple returns you to our site with a form sent from Apple's page, and your browser does not send a SameSite=Lax cookie with such a form. This means only that your browser also sends these cookies to Ostany with requests that come from another site (such as Apple's form); they are still sent only to Ostany and always carry the Secure attribute. Our site is served only over an encrypted HTTPS connection, and in production the sign-in and security cookies also carry the Secure attribute, so they are never sent over an unencrypted connection. A cookie marked HttpOnly cannot be read by JavaScript, which protects it against theft by malicious scripts. The last row of the table is not a cookie but an entry in your browser's session storage.

Cookie	Purpose	Category	Retention
`ostany_access`	Holds your short-lived session token so you stay signed in as you use the site. While you are signed in, it is also used to link the Listings you view and the searches you make to your account for personalised recommendations; you can switch this off in Account settings, under Privacy, using the "Personalised recommendations" switch (see purpose M of the [Privacy Policy](/legal/privacy-policy)). `HttpOnly`.	Strictly necessary (sign-in); personalised recommendations: see the Privacy Policy	15 minutes
`ostany_refresh`	Lets us renew your session in the background so you are not logged out unexpectedly, and lets us show this device in your list of signed-in devices. `HttpOnly`.	Strictly necessary	30 days
`ostany_rfb`	Set only if renewing your session in the background has failed. It briefly pauses further renewal attempts, which protects your account and our servers. `HttpOnly`.	Strictly necessary	60 seconds
`authjs.session-token` (and its `__Secure-` variant)	Used only when you sign in with Google or Apple, to carry the result of that sign-in over to your Ostany session. `HttpOnly`.	Strictly necessary	Normally a few seconds (deleted once sign-in with Google or Apple completes); at most 7 days
`authjs.csrf-token` (and its `__Host-` variant)	Security token that protects the sign-in process against cross-site request forgery (CSRF).	Strictly necessary	Session
`authjs.callback-url` (and its `__Secure-` variant)	Remembers which page to return you to after you complete sign-in.	Strictly necessary	Session
`authjs.pkce.code_verifier`, `authjs.state` and `authjs.nonce` (and their `__Secure-` variants)	Set only when you sign in with Google or Apple. They protect that sign-in against interception and replay. `HttpOnly`.	Strictly necessary	Deleted when sign-in completes; at most 15 minutes
`ostany_oauth_terms`	Set only when you sign up with Google or Apple on our sign-up page and tick the box accepting our [Guest Terms](/legal/terms-guests). Google and Apple cannot carry your acceptance through their sign-in, so this cookie keeps it until you return from them, and we then record it with your new account. It holds the version number of the Guest Terms you accepted, a fingerprint of that text (its SHA-256 hash), the language of the page, which of the two providers you chose and the time when it expires; it contains no identifier. It is signed with a key that only our servers hold, so that we reject it if it has been altered or forged, and it can serve only one sign-up. If you already have an account, it is not used and is deleted. `HttpOnly`; for a sign-up with Apple also `SameSite=None` and `Secure` (see above).	Strictly necessary	Deleted when sign-in with Google or Apple completes; at most 15 minutes
`ostany_oauth_refused`	Set only if you try to create an account with Google or Apple and we do not have your acceptance of our Guest Terms from our sign-up page (for example, because you used the Google or Apple button on the sign-in page), or if the Guest Terms changed after you accepted them. In that case the sign-up is not completed, and this cookie tells the next page why, so that it takes you to the sign-up page to accept the current Guest Terms instead of showing a general sign-in error. It contains only that reason, no identifier. It is deleted as soon as that page has read it. `HttpOnly`.	Strictly necessary	Normally a few seconds; at most 60 seconds
`ostany_oauth_apple_name`	Set only if your first sign-up with Apple cannot be completed (for example, because our Guest Terms were not accepted on our sign-up page) and Apple shared your name with us in that sign-up. Apple gives us your first and last name only the first time you allow Ostany to use your Apple account; this cookie keeps the name Apple shared, so that your account gets your name, and not only your email address, when you then complete the sign-up. It holds that name, the identifier Apple has assigned to your Apple account for Ostany and the time when it expires. These are encrypted with a key that only our servers hold, so that they cannot be read outside them, and we reject the cookie if it has been altered. It is used only for that same Apple account and is deleted when you complete the sign-up with it. `HttpOnly`, `SameSite=None` and `Secure` (see above).	Strictly necessary	30 minutes from the sign-up that could not be completed; deleted earlier when you complete the sign-up with the same Apple account
`ostany_signup`	Set only when you sign up with an email address and a password, until you enter the code we email you. It holds a random sign-up token and the email address you are signing up with, so that only this browser can finish that sign-up. It is deleted when the sign-up is finished or can no longer be finished. `HttpOnly`.	Strictly necessary	2 hours from the last time you submitted the sign-up form; deleted earlier when the sign-up is finished
`ostany_signup_terms`	Set together with `ostany_signup`, and only when you sign up with an email address and a password and tick the box accepting our [Guest Terms](/legal/terms-guests). Your account is created only when you enter the code we email you, so this cookie keeps your acceptance until then, and we then record it with your new account. It holds the version number of the Guest Terms you accepted, a fingerprint of that text (its SHA-256 hash), the language of the page and the email address you are signing up with, so that the acceptance serves only that sign-up. It is deleted when the sign-up is finished. `HttpOnly`.	Strictly necessary	2 hours from the last time you submitted the sign-up form; deleted earlier when the sign-up is finished
`OSTANY_LOCALE`	Remembers the interface language you chose. It is set only when you choose a language (for example in the language switcher or in your account's language settings), or when you sign in with Google or Apple (it then takes the language saved in your account). It is not `HttpOnly`, because the page needs to know your language.	Strictly necessary (stores the language you chose)	1 year from the last time you chose a language or signed in
`ostany_consent`	Remembers your cookie choice: whether you allowed the interactive Google map to load by itself on listing and trip pages ("Allow") or not ("Only necessary"), so that the banner does not ask you again on every page (see section 2). It contains only that choice and a version number, no identifier. It is set only when you choose in the banner. It is not `HttpOnly`, because the page needs to read your choice.	Strictly necessary (stores the choice you made)	6 months from the last time you chose
`ostany_cal_state`	Staff only. Protects the step in which an Ostany administrator connects a Google Calendar. It is never set for guests or Hosts. `HttpOnly`.	Strictly necessary	10 minutes
`ostany.wizard.dir` (session storage, not a cookie)	Hosts only, in the listing creation wizard: remembers whether you moved forward or back between steps, so that the next step is shown with the right transition.	Strictly necessary	Deleted as soon as the next step has read it, and in any case when you close the browser tab

If you never start signing up or signing in, none of these cookies is set, except OSTANY_LOCALE if you choose a language and ostany_consent once you make a choice in the cookie banner. The cookies for signing up and signing in are set only in the course of the sign-up or sign-in they serve, even if it is not completed: ostany_signup and ostany_signup_terms while a sign-up with an email address and a password is waiting for its code, and the cookies for signing up or signing in with Google or Apple (including ostany_oauth_refused and ostany_oauth_apple_name). A signed-out visitor can browse Listings without them.

---

4. Third-party services

We do not embed third-party advertising or analytics, and no third party sets cookies on the Ostany site. Some features do, however, connect your browser to other providers. Google and Apple (sign-in), Mollie (payments), Didit (identity verification) and Google (maps) act under their own cookie and privacy policies and are responsible for their own processing; UploadThing is our processor. More on each of them is in the Privacy Policy.

• Maps (Google Maps): on a listing page we show the location of the Property on a Google map, and on the page of your trip the location of the Property you booked. What your browser loads there depends on your choice in the cookie banner (section 2). If you allowed it ("Allow"), the interactive Google map loads by itself when the map section of the page comes into view or close to it, for example as you scroll down (on a tall screen this can be as soon as the page opens); no map picture is loaded. If you chose "Only necessary", or have not chosen yet, a listing page shows a picture of the map around the Property instead. Your browser loads this picture directly from Google (the Google Maps Static API), as Google's terms require, when the map section of the page comes into view or close to it. With that request your browser sends Google your IP address, the information browsers send with any request (such as the browser type and language settings) and the address of the Ostany website (not of the page you are on), and the request itself contains the location shown on the map (the location of the Property as shown in the Listing: its approximate location, unless the Host has chosen to show the exact one). It is an image, not a program: it runs no Google code on our site and cannot set cookies on the Ostany site. We show it on the basis of our legitimate interest in showing you where the Property is (Article 6(1)(f) GDPR; see the Privacy Policy, sections 3.3, 4.1 and 5). The page of your trip shows no picture, only a "Show map" button and the map's full-screen button. In that case the interactive map loads on a listing page only when you click the map picture, or "Show map" where no picture is shown, and on the page of your trip only when you click "Show map"; on both pages it also loads when you click the map's full-screen button, first in full screen and then, once you close that view, in the map section of the page (after any of these clicks, also on other listing and trip pages you open in the same browser tab, until you reload the page or close the tab). Whatever you chose, an interactive Google map also loads when you open the map view in search, and, for Hosts, on pages where the map is the tool they are using (the map for placing the Property and the map in the preview of their own Listing). When an interactive map loads, your browser connects to Google's servers and sends Google your IP address, information about your browser and device, and the address of the Ostany page you are on; Google Maps also loads fonts from Google. Google (Google Ireland Limited and Google LLC) receives the data from the map picture and from the interactive map as an independent controller for its own purposes, under the Google Privacy Policy. In our tests the interactive Google map did not set cookies or store data on your device. Apart from the map picture, your browser does not contact Google for maps until an interactive map is loaded. If you withdraw your consent while a listing or trip page is open, the interactive map on it is replaced by the picture or by the "Show map" button; the Google code it had already loaded stays in that page until you reload it or leave.

• Sign in with Google / Apple: only if you choose to sign in with Google or Apple, those providers may set cookies on their own domains to authenticate you. Governed by Google's and Apple's respective privacy policies.

• Payments (Mollie): card and other payment steps are completed only on Mollie's own secure payment pages, which may set cookies strictly necessary to process the payment and prevent fraud. Governed by Mollie's cookie and privacy policy.

• Identity verification (Didit): only when you start identity verification, you are taken to Didit's verification service, which may set cookies on its own domain to carry out the verification. Governed by Didit's cookie and privacy policy.

• Image storage (UploadThing): photos are stored with, and some are delivered from, our file-storage provider UploadThing, which acts as our processor; it does not set cookies on the Ostany site.

---

5. How to control and delete cookies

On the site itself you can change your choice about Google Maps on listing and trip pages, or withdraw your consent, at any time with "Cookie settings" in the footer at the bottom of our pages (see section 2); the other cookies we use are strictly necessary and cannot be switched off there (personalised recommendations are switched off in Account settings, under Privacy, using the "Personalised recommendations" switch, see section 2). You can also view, block or delete cookies at any time through your browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data

• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data

• Safari: Settings → Privacy

• Microsoft Edge: Settings → Cookies and site permissions

Please note: our session cookies are required for the site to function. If you block or delete them, you will be signed out and will not be able to sign in, message a host or complete a booking. If you delete OSTANY_LOCALE, the site uses the language in the page address or, failing that, the language of your browser. If you delete ostany_consent, the banner asks for your choice again, and until you choose, listing pages show the map picture and trip pages the "Show map" button.

---

6. Do Not Track

Ostany does not track you across other websites and does not build advertising profiles, so a browser "Do Not Track" signal has no additional effect on the cookies described above.

---

7. Changes to this Policy

We may update this Cookie Policy to reflect changes in the technologies we use or in the law. The current version, together with its version number and effective date, is always available at /legal/cookies-policy. Material changes will be announced by the usual means before they take effect.

---

8. Contact

Questions about this Policy or about cookies can be sent to the controller and the data-protection contact identified in our Privacy Policy: [data protection / privacy contact email].