Cookies & similar technologies

Last updated: October 21, 2026

This policy explains how Visby uses cookies and similar technologies on www.visbytravel.com and related web surfaces. The Visby mobile app relies primarily on OS permissions and secure local storage, not browser cookies. See also our Privacy Policy.

1. Categories

• Essential: required to run the site (security, load balancing, hotel partner login / OAuth session cookies via our auth provider). These cannot be switched off if you use those features.
• Visit counts (no cookies): every visit sends a first-party page-view event to our own server, which adds the approximate city and country from your IP address, your device type, browser and operating system, and a visitor code made from a one-way hash of your IP address and browser with a random key we replace every day. We never store your IP address, nothing is saved on your device, and one day’s codes can’t be linked to the next.
• Analytics (optional): when optional cookies are allowed, a random visitor id in localStorage lets us recognise returning visitors, and a tab session id in sessionStorage keeps one visit together.
• Advertising / measurement (optional): Google Ads tag (AW-18369508166) to measure campaigns and signup conversions. Loaded only after you accept optional cookies. Not loaded inside hotel embed iframes.

2. What we store

• Optional-cookie consent — localStorage key remembering Accept / Reject for first-party analytics and Google Ads.
• Analytics visitor id — random localStorage id, only when analytics is allowed; removed if you later reject.
• Analytics session id — short-lived sessionStorage id for the browser tab when analytics is allowed.
• Trip recap viewer id — random localStorage id that tells a trip’s owner when someone comes back to their shared recap page, only when optional cookies are allowed (and never with Do Not Track or Global Privacy Control). Without it, your visit to a recap is counted without an id.
• Auth cookies — set by Supabase Auth for hotel partner sign-in (PKCE / session), essential for that flow.
• UI preferences — e.g. dismissing a waitlist or mobile prompt.
• Google Ads cookies — set by Google for campaign measurement / conversion.

3. Your choices

On first visit, we ask whether to allow optional cookies (the lasting analytics id and Google Ads). You can Accept or Decline. Declining leaves essential cookies only — the Ads tag is not loaded and nothing for analytics is stored on your device; your visit is still counted without cookies as described above. Ad click ids from Google Ads links (gclid) are only used once you accept.

You can change your mind anytime with Cookie settings at the bottom of every page: it removes the optional ids and Google Ads cookies from this browser and asks again. Open cookie settings now.

4. Third parties

We load the Google Ads tag (gtag.js) only after optional-cookie consent, for campaign measurement and signup conversions. We do not load Meta Pixel or similar non-Google advertising tags on the marketing site. Service providers that power hosting and auth may set their own essential cookies — see Subprocessors.

5. Contact

Questions: hello@visbytravel.com · Privacy request form