Tracking transparency
Cookie Policy
In plain language
We use a small set of cookies and browser storage to keep you signed in, protect forms and payments, and remember your currency. Google Analytics and the Meta Pixel measure visits and ads: in the EU, EEA and UK only after you accept; elsewhere they are on by default and you can switch them off from "Manage Cookies" in the footer. Our own Umami statistics are cookie-less.
This Cookie Policy explains how PalapaVibez LLC uses cookies, browser storage and similar technologies on palapavibez.com, and the choices you have.
When you first visit, a banner sets out your choice. If you are in the EU, EEA or UK — or we cannot tell where you are — Google Analytics and Meta Pixel cookies stay off until you click “Accept all”. Everywhere else they are on by default and the banner lets you opt out. Strictly necessary cookies are always set, because the site does not work without them. You can change your choice at any time with “Manage Cookies” in the footer.
2. Cookies we use
Strictly necessary
The site cannot work without these: signing in, protecting forms and payments, and quoting hotel rates for your country. They cannot be switched off from the banner.
| Name | Set by | Purpose | How long | Before you choose? |
|---|---|---|---|---|
pv.session | PalapaVibez | Keeps you signed in | 7 days, renewed while you use the site | Only when you sign in |
pv.csrf, pv.callback | PalapaVibez | Protects the sign-in form and returns you to the right page | Until you close the browser | Yes |
__Secure-next-auth.state, __Secure-next-auth.pkce.code_verifier | PalapaVibez | Secures sign-in with Google | About 15 minutes | Only during Google sign-in |
pvt_tos_accept, pvt_marketing_opt_in | PalapaVibez | Carries the boxes you ticked at sign-up through a Google or email-link sign-up | 30 minutes | Only when you tick them |
pvt_region | PalapaVibez | Decides which cookie banner applies to you (EU, EEA and UK, or elsewhere) | 1 day | Yes |
pvt_country | PalapaVibez | Your country, which hotels use to quote the right rate | 1 day | Yes |
pvt_ad_consent | PalapaVibez | Records your analytics and advertising choice so our server honours it too | 1 year | Yes — set to "on" by default outside the EU, EEA and UK |
__stripe_mid, __stripe_sid | Stripe (inside the hotel payment form) | Fraud prevention on card payments | Up to 1 year / 30 minutes | Only on the hotel payment step |
__cf_bm | Cloudflare | Tells people from bots; may be set if Cloudflare bot protection runs on a request | 30 minutes | Yes |
Functional
These remember choices so the site behaves the way you set it. Nothing here is used for advertising.
| Name | Set by | Purpose | How long | Before you choose? |
|---|---|---|---|---|
pvt_currency | PalapaVibez | Your display currency | 30 days; 1 year once you choose one | Yes |
pvt_geo, pvt_language | PalapaVibez | Your approximate city, time zone and language, for dates and defaults | 1 day / 30 days | Yes |
pv.anon | PalapaVibez | A random number for the "people viewing now" count; contains no personal data | 30 days | Yes |
tpwl_currency | PalapaVibez and Travelpayouts | Shows flight fares in your currency | 1 year | Only on the Flights page |
Analytics
Umami, our own statistics tool, is self-hosted and sets no cookies. Google Analytics 4 counts visits and sessions with the cookies below.
| Name | Set by | Purpose | How long | Before you choose? |
|---|---|---|---|---|
(none) | Umami, self-hosted | Cookie-less page statistics | — | Yes (no cookies are set) |
_ga, _ga_<id> | Google Analytics: tells visitors and sessions apart | 13 months | EU, EEA and UK: no. Elsewhere: yes |
Advertising
The Meta (Facebook and Instagram) Pixel measures how our ads perform. Completed hotel bookings are also reported to Meta from our server through its Conversions API, using hashed identifiers, and only while pvt_ad_consent is on.
| Name | Set by | Purpose | How long | Before you choose? |
|---|---|---|---|---|
_fbp | Meta | Meta Pixel: recognises the browser for ad measurement | 90 days | EU, EEA and UK: no. Elsewhere: yes |
_fbc | Meta | Meta Pixel: keeps the ad click ID when you arrive from a Meta ad | 90 days | EU, EEA and UK: no. Elsewhere: yes |
3. Browser storage
These stay on your device. None of them is used for advertising, and none is shared with another company.
| Name | Purpose | How long |
|---|---|---|
pvt_cookie_consent | Your cookie choice | Until you clear it or use "Manage Cookies" |
preferredCurrency | Your chosen currency | Until you clear it |
pvt_recent_hotels | Up to 12 hotels you viewed recently, for the "recently viewed" list | 30 days per hotel |
Dismissed-banner flags | So a banner you closed stays closed | Until you clear them |
pvt_last_hotel_search, map position, exchange-rate cache | Restores your hotel search during a visit | Until you close the tab |
Booking details during payment | Carries your booking and guest names through the payment step; deleted when the booking completes | Until you close the tab |
4. Third parties
- Google — sign-in with Google (Google’s own cookies, on google.com) and Google Analytics 4. The Analytics script loads for every visitor, but with Google Consent Mode set to “denied” it stores no cookies and sends Google only cookieless signals until analytics is allowed.
- Meta — the Meta Pixel loads only once analytics and advertising are allowed. Completed hotel bookings are also reported from our server through Meta’s Conversions API, using hashed identifiers, only while that choice is on.
- Cloudflare — Turnstile checks our forms for bots. Cloudflare states it does not use cookies for this, but it does read browser and device signals.
- LiteAPI — the hotel assistant chat and the hotel payment form. The payment form runs on Stripe, which may set the fraud-prevention cookies listed above.
- Stripe Checkout (tours) — you pay for a tour on Stripe’s own site, so no Stripe cookie is set on ours.
- Travelpayouts / Aviasales — the flight search on the Flights page may set its own cookies to remember your settings and to credit us when you book with an airline or travel agency.
- Umami and BugSink — self-hosted on our own servers and cookie-less. BugSink records your IP address and browser details when an error happens, so we can fix it.
These companies have their own privacy and cookie policies. For how we use the information these tools collect, see our Privacy Policy.
5. Your choices
Manage Cookies. Use “Manage Cookies” in the footer at any time. It clears your saved choice, switches off our server-side ad reporting, and shows the banner again so you can choose. Turning off analytics and advertising stops Google Analytics cookies and the Meta Pixel. Umami keeps running because it sets no cookies and collects no personal data.
Opt-outs from the companies themselves. Google Analytics opt-out add-on · Meta ad preferences · NAI opt-out · DAA opt-out. These work per browser and per device.
Your browser. Most browsers let you see, delete and block cookies: Chrome · Firefox · Safari · Edge. Blocking strictly necessary cookies may sign you out or stop a booking from completing.
6. Changes
We update this policy when the cookies we use change. Material changes are recorded on the policy changelog.
7. Contact
Cookie questions: [email protected].