Cookies
Three cookies, all ours, all necessary
MyStayDays sets three cookies: one to keep you signed in, one to keep you signed in between visits — set only if you ask for that at sign-in — and one to remember what you chose about cookies. There is no analytics, no advertising, and nothing loaded from another company's servers. Every cookie below is listed with what it does, who sets it and how long it lasts.
Change your cookie settings at any time — the link is in the footer of every page as well.
Essential always on
Needed for the site to work at all: keeping you signed in — including between visits, if you ask for that at sign-in — protecting forms against forgery, and remembering this cookie choice. These cannot be switched off, because switching them off would mean you could not sign in.
| Name | Purpose | Set by | First or third party | How long it lasts |
|---|---|---|---|---|
mysd_session |
Identifies your signed-in session, and carries the token that protects every form on this site against being submitted by another website on your behalf. It holds a random identifier and nothing else — no name, no email, no travel. | MyStayDays | First-party | Until you sign out, close the browser, or spend 2 hours doing nothing |
mysd_consent |
Remembers the choice you made about cookies, and which version of this policy you made it against. Without it you would be asked again on every page, and a refusal would never stick. | MyStayDays | First-party | 6 months |
mysd_remember |
Set only if you tick "Keep me signed in", and only then. It holds a random token — no name, no email, no password — which lets this browser start a new signed-in session without asking you to type your password again. Signing out deletes it, and changing your password stops it working everywhere at once. | MyStayDays | First-party | 30 days, or until you sign out |
Analytics
Measuring which pages get used, so the product can be improved. We do not do this today and set no analytics cookies at all — this switch is here so that the answer is already recorded if we ever start.
Nothing in this category is in use. There is no cookie of this kind on this site and no script that could set one. That is not only a promise: the browser is sent a Content-Security-Policy that permits files from this site and refuses everything else, so a third-party tracker could not load here even if one were added by mistake.
Marketing
Advertising, retargeting and campaign tracking. We do not do this either, and there is no third-party script on this site that could — the browser is instructed to refuse anything loaded from another company.
Nothing in this category is in use. There is no cookie of this kind on this site and no script that could set one. That is not only a promise: the browser is sent a Content-Security-Policy that permits files from this site and refuses everything else, so a third-party tracker could not load here even if one were added by mistake.
Why we ask, when everything is necessary anyway
The rules that require consent are about cookies that are not necessary for a service you asked for — analytics, advertising, cross-site profiling. Both of ours are necessary, so strictly speaking neither needs your permission, and refusing them would mean you could not sign in.
We ask anyway, for two reasons. The first is that "trust us, they are all necessary" is exactly what a site with a tracking pixel would also say, and you have no way to tell the two apart without being shown the list. The second is that the switches are real: if analytics is ever added here, the answer you gave is already recorded and will be honoured from the first page load rather than after somebody remembers to check.
So the banner appears once, it does not cover the page, it does not follow you around, and refusing takes exactly one click — the same as accepting. It never comes back unless what we use cookies for materially changes, in which case it asks again and this page says what changed.
How these cookies are protected
- HttpOnly. Neither cookie can be read by JavaScript, so a script that ever found its way onto a page could not steal your session or read your choice.
- SameSite. Another website cannot cause your browser to send them, which is what stops a link elsewhere acting on your account.
- Secure, over HTTPS. They never travel in the clear.
- No personal data in either. The session cookie holds a random identifier; the consent cookie holds a version number and up to three fixed words. Neither contains your name, your email address or anything about your travel.
Changing your mind, or refusing outright
Cookie settings is linked from the footer of every page, signed in or not, and changes take effect immediately.
Every browser can also refuse or delete cookies for a site, and you are free to do that here. The public pages — this one, the upgrade page, the questions — work perfectly well without them. Signing in will not, because signing in is the thing the session cookie does.
Anything else you would like to know about this is welcome — the contact form reaches a person. There is more about what we store, and for how long, in the privacy policy.