Skip to main content
PalapaVibez

Legal Center

Policies, plain and complete

Every promise we make and every limit on what we’ll be responsible for, written out in one place. Use the menu below to jump straight to what you need.

Tracking transparency

Cookie Policy

Effective May 27, 2026Updated July 10, 2026

In plain language

We use a small set of cookies to keep you signed in, remember your currency and language, and (only with your consent) measure traffic and advertising. Self-hosted Umami is cookie-less and runs without consent. You can change your choice from the footer link any time.

This Cookie Policy explains how PalapaVibez LLC uses cookies and similar tracking technologies on palapavibez.com and shop.palapavibez.com.

When you first visit, a cookie-consent banner asks for your permission before any non-essential cookies are set. You can change your preferences at any time via the cookie settings link in our footer. Strictly necessary cookies are set automatically as they are required for the site to function.

1. What are cookies

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device on subsequent visits and remember information about your preferences or actions.

2. What we use

Strictly Necessary

Essential for the website to function and cannot be disabled. Set in response to actions you take such as logging in, making a booking, or setting privacy preferences.

Cookie namePurposeDuration
next-auth.session-tokenKeeps you logged in to your accountSession
pv.sessionMaintains your active sessionSession
pvt_regionDetects your region (EU/US) for cookie-consent preferences1 day
pvt_cookie_consentStores your cookie-consent preferences (localStorage)Persistent
pvt_ad_consentRecords your advertising-consent choice so our server honours it (e.g. the Meta Conversions API)1 year
Functional

Allow the website to remember choices you make (currency preference, detected airport) and provide enhanced features.

Cookie namePurposeDuration
user_currencyRemembers your selected display currency30 days
user_locationCaches your detected airport for faster page loads1 day
Analytics

We run two analytics tools side-by-side: Umami (self-hosted, cookie-less, runs without consent) and Google Analytics 4 (cookie-based, only loaded after you give consent via the cookie banner). Declining the Analytics category disables GA4 entirely.

Cookie namePurposeDuration
(none — Umami)Umami is cookie-less and self-hosted; no cookies setN/A
_gaGoogle Analytics 4 — distinguishes unique visitors (consent required)13 months
_ga_*Google Analytics 4 — session state (consent required)13 months
Advertising

Set by the Meta (Facebook) Pixel to measure the performance of our ads. It loads only after you accept the advertising/analytics category via the cookie banner; declining keeps it off. (Completed bookings are also reported to Meta server-side via its Conversions API using hashed identifiers — that happens on our server, not through a cookie.)

Cookie namePurposeDuration
_fbpMeta Pixel — identifies the browser for ad measurement (consent required)3 months
_fbcMeta Pixel — stores the ad click ID when you arrive from a Meta ad (consent required)3 months
Preference

Store non-essential preferences such as your last search parameters to make your experience more convenient.

Cookie namePurposeDuration
last_searchRemembers your last hotel search7 days

3. Third-party cookies

Some cookies are set by third-party services we use:

  • NextAuth.js — authentication and session management (always required).
  • Google (Sign-in + GA4) — if you sign in with Google, Google sets cookies on its own domain to complete the OAuth flow. Google Analytics 4 is only loaded after you give analytics consent.
  • Meta (Facebook) — with your consent, the Meta Pixel sets first-party _fbp/_fbccookies and sends page-view and event data to Meta for advertising measurement. It loads only after you accept the advertising/analytics category. Completed bookings are also reported server-side via Meta’s Conversions API (hashed identifiers, no cookie).
  • Stripe — secure payment processing for shop purchases. Stripe may set its own cookies to prevent fraud and process payments.
  • LiteAPI — hotel booking and embedded hotel payment widget. May set cookies during the hotel-payment step.
  • Travelpayouts / Aviasales — flight metasearch widget on the Flights page.
  • Chatwoot (self-hosted) — live chat widget. Sets a small cookie to preserve your chat conversation if you reload the page.
  • Umami Analytics (self-hosted) — privacy-first, cookie-less website usage statistics. No cookies, no personal data.
  • BugSink (self-hosted) — error tracking and diagnostics. Self-hosted on our servers; does not share data with third parties. May log IP addresses and browser information when errors occur.

These third parties have their own privacy and cookie policies, which we encourage you to review.

4. Managing cookies

You can control cookies through your browser settings. Most browsers let you:

  • View what cookies have been set and delete them individually.
  • Block all cookies or cookies from specific websites.
  • Set preferences for certain types of cookies.

Disabling strictly necessary cookies may affect the functionality of our website and prevent you from completing bookings.

Browser cookie guides: Chrome · Firefox · Safari · Edge

You can change your consent at any time via the cookie settings link in our footer. Declining the Analytics/Advertising category disables Google Analytics 4 and the Meta (Facebook) Pixel entirely; Umami remains active because it is cookie-less and does not collect personal data.

5. Changes

We may update this Cookie Policy from time to time. Material changes are tracked on the policy changelog.

6. Contact

Cookie questions: [email protected].