Cookie Policy

1. Categories

Strictly necessary (always on)

Required for sign-in, session continuity, CSRF protection, and basic abuse prevention. Cannot be disabled.

• better-auth.session_token — your authenticated session.
• bookify_consent_v1— remembers your choice so we don't re-prompt every page.
• bk_did— a long-lived (12-month), random device identifier set on the public booking endpoints. We use it only as an axis of our rate-limiting (alongside IP address) so a bot can't flood a host's booking page just by changing networks. The value is a random opaque string — it does not identify you personally and is not shared with any third party.

Analytics (opt-in)

Aggregate usage so we can fix friction points. Currently off in v1. When enabled in a future release we will document the exact tool here and re-prompt for consent.

Marketing (opt-in)

Personalized content and campaign measurement. Currently off in v1. Same disclosure process as analytics if we add this later.

2. Managing your choices

• The banner appears on first visit and re-prompts every 12 months.
• Change your choice anytime via Cookie settings — or by clearing site cookies in your browser.
• Browser-level Do-Not-Track and Global-Privacy-Control signals are honored.

3. Third-party cookies on integration providers

When you sign in via Google or GitHub OAuth, those providers may set their own cookies on their respective domains. They're governed by the provider's privacy policy, not ours.