Cookie policy

This site stores almost nothing on your device. There is no advertising, no profiling, and no third-party tracking cookie anywhere on greekislandstreets.com. Everything listed below is either something you asked for, or a security check.

pm_lang — cookie, set by us, only once you pick a language, so the site opens in it next time. Purpose: your own preference. Duration: 12 months. Exempt from consent because you asked for it.

pm_stay — browser storage, set by us, only if you tap “Save my place” to remember your accommodation. It never leaves your device and is not sent to us. Duration: until you clear it. Exempt from consent because you asked for it.

pm_tl — browser storage, set by us, only while you are actively navigating and only if a walk trace could not be uploaded straight away (a dead spot in the alleys). It holds that one batch of anonymous positions until the connection returns, then clears itself. Nothing is written if your browser sends a Global Privacy Control signal.

__cf_bm and similar — set by Cloudflare when it has to check a request is not automated. Purpose: security. Duration: up to 30 minutes. Provider: Cloudflare, Inc.

That is the complete list for visitors. Signing in to the staff admin area also sets a session cookie, which is strictly necessary and ends when you sign out.

We count how many people open a page using Google Analytics 4 running at Cloudflare's edge (Cloudflare Zaraz). It runs server-side: your browser downloads no Google code, and no cookie, identifier or other data is stored on your device. To count the visit, the page sends the address of the page, the page it was opened from, your browser language, screen size and time-zone offset. Your IP address is masked before anything reaches Google. We can see that a page was opened, roughly which country from, and which buttons get pressed. We cannot see who you are, we build no profiles, and we do not track you across other sites.

Because no cookie or identifier is set and nothing is stored on your device, we treat this as outside the cookie-consent rule in ePrivacy Art. 5(3) and rely on our legitimate interest in knowing whether the service works (GDPR Art. 6(1)(f)). We know the European Data Protection Board reads that rule broadly (Guidelines 2/2023) and we keep this arrangement under review. You can object at any time at [email protected].

How long: event-level data is kept 2 months and user-level data 14 months in Google Analytics, after which Google deletes it.