Legal · Cookies
Cookie Policy
A short, plain-language list of every cookie this site uses, what it does, how long it lives, and how to change your mind.
1. What is a cookie?
A cookie is a small text file a website stores in your browser. Cookies are used to remember preferences, keep you signed in, or measure how people use a site. EU law treats “cookies” broadly to include any technique that reads or writes information on your device — including localStorage, sessionStorage, and the like.
2. Our approach
We use as few cookies as we can. We never use advertising or cross-site tracking cookies. The only optional cookies on this Site are for self-hosted analytics, which we ask consent for before setting.
3. Cookies we use
Strictly necessary (always on — no consent required)
| Name | Purpose | Duration | Type |
|---|---|---|---|
PHPSESSID |
Server session — needed for forms, CSRF protection, flash messages. | Session (until browser closes) | First-party |
td_consent |
Remembers your choices on this banner so we don’t ask again. | 180 days | First-party |
td_sid |
Short-lived session ID for analytics — only set if you accept analytics. | 30 minutes (sliding) | First-party |
Analytics (only with your consent)
| What | Purpose | Data stored |
|---|---|---|
| Self-hosted page-view log | Helps us understand which pages help guests, which devices to test on, and where to focus improvements. Aggregate only — never used for advertising. | URL, timestamp, anonymous session ID, SHA-256 hash of your IP, country code, device type, browser/OS family. Raw IPs are never stored. |
| ipwho.is country lookup | One-time HTTPS call to translate your IP to a country, then cached for 30 days against the hash. Disabled if you reject analytics. | Only the IP is sent during the call; nothing is stored on ipwho.is’s side as part of normal use. |
Marketing (only with your consent)
We do not run ads on this site, and we do not embed Facebook Pixel, Google Ads, TikTok Pixel, or similar tracking scripts. The only third-party content that falls in the “Marketing” category is the Viator tour widget embedded on the Excursions page.
| What | Purpose | Data sent / cookies set |
|---|---|---|
Viator partner widget (viator.com/orion/partner/widget.js) |
Displays Viator tours we recommend, with live availability and prices, and tracks affiliate referrals so Viator can attribute bookings to us. | Your IP address and user-agent are sent to Viator on page load. Viator sets affiliate-attribution and tracking cookies under the viator.com domain. See Viator’s Privacy Policy and Cookie Statement. |
The Viator widget is not loaded unless you give marketing consent. If you don’t, the Excursions page shows a placeholder with a “Load tours” button. Clicking that button is itself an act of consent for the marketing category.
4. Third-party content
We load a small number of resources from third parties to keep the site fast:
- Google Fonts — serves the “Fraunces” and “Inter” web fonts via fonts.googleapis.com and fonts.gstatic.com. Google may collect your IP as part of serving the font file. Their Privacy Policy applies.
If you book through the “Book on Booking.com” button, you are taken to Booking.com, which sets its own cookies under its own policy. This Site does not transmit any of your data to Booking.com.
The Excursions page embeds Viator’s partner widget — see the Marketing section above for the details, the data sent, and how consent is requested. If you do not give marketing consent, no request is made to viator.com from that page; you can still visit viator.com directly in a new tab on your own initiative.
5. How to change or withdraw consent
- Click the 🍪 button at the bottom-left of any page, or here, to re-open the banner.
- You can also clear cookies for this Site in your browser settings to reset all choices.
- Withdrawing consent does not affect the lawfulness of processing that happened before you withdrew.
6. Contact
Questions about cookies or any other privacy matter: see the Privacy Policy for contact details and your rights under GDPR.