Cookie Policy

Cookies are small text files that a website stores on your device when you visit it. Similar technologies — like local storage — do the same basic job: they let a site remember information about your visit, such as whether you're signed in or how you like a page to look. Cookies don't, by themselves, identify you by name, but they can be used to recognize your browser across visits.

Cookies and similar storage used for our website and related functions fall into the following categories. The technologies present depend on the page, requested function, and deployment configuration; this does not mean every category is set for every visitor.

• Strictly necessary. Where needed for a requested function, these maintain a signed-in session, support security, or route a request reliably. A technology is not strictly necessary merely because it is useful to us. Your browser can block storage, but blocking storage genuinely needed for a requested function may prevent that function from working.
• Functional / preference. These remember choices you make so we don't have to ask again — for example, a theme preference on a surface that offers that choice. Preference storage may use local storage rather than a cookie. Its treatment depends on its actual purpose and applicable law; preferences must not be grouped with essential security simply to avoid a required choice.
• Analytics. The website includes Google Analytics when configured, and a separate Vercel Web Analytics integration, to understand site usage and performance. Aggregate reports or reduced IP information do not, by themselves, establish that all underlying data is anonymous or that consent is unnecessary. The applicable settings, data fields, retention, and choices must be assessed for each integration. Analytics is not used to build an advertising profile of you.

We do not use advertising or tracking cookies for cross-site ad targeting, and we do not sell or share cookie data with ad networks.

The inventory must distinguish browser storage from information sent with a request. Authentication or security storage, preference storage, Google Analytics, and Vercel Web Analytics do not necessarily use the same identifiers or retention periods. Blocking cookies also does not necessarily prevent ordinary server logs or all measurements covered by our Privacy Policy.

• Session and security storage: Relevant only where a requested account or site function uses it. The final inventory must identify the specific key, purpose, provider, and whether it expires with a session or persists.
• Preference storage: May remain on the device until its configured expiry, replacement, or removal through browser site-data controls. A fixed theme on a public page should not be described as a user-selected preference.
• Google Analytics: Its loader runs when the deployment is configured with a measurement identifier. Actual cookie names, domains, lifetimes, and analytics retention must be checked against the deployed configuration; this draft does not invent a verified list or a universal expiry period.
• Vercel Web Analytics: This is a separate site integration. Its collected information and applicable controls need to be covered even where its measurement does not depend on an analytics cookie.

Publication review required: Before this revision is adopted, the inventory must record each relevant technology, provider, purpose, data category, domain, lifetime, and consent/exemption basis, including what happens when a visitor refuses or withdraws a choice. Device-storage expiry and deletion of information already received by a provider are separate issues; data-retention and rights requests are addressed in our Privacy Policy.

Most browsers let you view, block, or delete cookies through their settings. You can generally set your browser to refuse all cookies, accept only certain cookies, or alert you when a cookie is being set. Because this is controlled by your browser, the exact steps vary — check your browser's help documentation for how to manage cookies.

This draft proposes respecting Global Privacy Control (GPC) and Do Not Track (DNT) for non-essential functional and analytics storage. This proposed commitment requires a working mechanism before adoption. Any applicable legal duty to honor GPC already applies to the processing it covers; it does not wait for adoption of this draft. DNT is a separate browser preference and does not, by itself, have the same legal effect as GPC. Publishing this statement neither changes an integration's behavior nor resolves a missing required control.

Current implementation limitation: The public website does not currently provide an on-site cookie consent/preference centre, and its Google Analytics loader does not itself check a consent choice, GPC, or DNT before loading when configured. Resolving and testing these gaps is a release requirement for this draft, not a feature this revision claims to have implemented. Your rights and any legal duty to recognize applicable signals are not waived by this limitation.

Please note that blocking strictly necessary cookies may break core site functionality, such as staying signed in or completing a form. Clearing cookies may not clear local storage or information already held by a service provider; review your browser's broader site-data controls as well. Browser and device settings may need to be managed separately for each device or profile.

You may also send a manual privacy request to johnny@tourist-sos.com, including an objection to a particular use or a request to withdraw a consent on which processing relies. Email is not an instant browser-level blocking control or a substitute for obtaining consent before collection where required. We must explain the scope and outcome of a request under our Privacy Policy.

Where applicable law requires prior consent for storage or access on your device, the relevant technology must remain inactive until valid consent is obtained. Consent must be informed, specific, and freely given; continuing to browse or accepting general terms is not a substitute. Required refusal and withdrawal options must be accessible and must actually affect the relevant collection.

Some jurisdictions allow limited exemptions for strictly necessary functions or qualifying statistical or preference purposes. Those exemptions have conditions and are not a blanket exemption for every analytics or functional tool. Any required information, safeguards, and simple means of objecting still apply. A reduced IP address, a vendor's reputation, or a general statement about improving the service is not enough to establish an exemption.

Withdrawal of consent does not retrospectively invalidate processing that was lawful beforehand, but future consent-based storage or processing must stop as required by law. Deletion of existing provider-held records is assessed separately under the Privacy Policy. A material change to a technology's purpose must be assessed before it is enabled, including whether a fresh permission is required.

We may update this Cookie Policy from time to time — for example, if we start using a new cookie category or a new analytics tool. The “Effective” date at the top of this page reflects the latest adopted version. Material changes must follow the notice requirements in our Privacy Policy and any separately applicable consent rules. This draft retains the existing date pending approval; it does not make a new tracking purpose effective merely by publishing revised wording.

This Cookie Policy should be read alongside our Privacy Policy, which explains more broadly what information we collect and how we use it. If you have questions about this policy or how we use cookies, email johnny@tourist-sos.com.