For guest accounts, Leestays uses authentication cookies such as sb-access-token and sb-refresh-token to keep users signed in, restore sessions, and protect account pages.

These cookies are set during login, registration, Google sign-in callback, token refresh, and cleared during logout.

These authentication cookies are configured with HttpOnly, SameSite=Lax, path=/, and secure delivery in production environments.

The admin dashboard uses a dedicated session cookie named leestays_admin_session to authenticate internal users and control access to admin routes.

This cookie is HttpOnly, SameSite=Lax, scoped to the site path, and currently uses a session lifetime of up to 7 days unless cleared earlier.

The admin system may store a preference cookie named leestays_seo_redirects to persist configured redirect rules used by the internal proxy layer.

This cookie is operational rather than advertising-related and is used to preserve redirect behavior chosen inside admin settings.

In addition to cookies, Leestays uses browser localStorage for certain non-cookie data such as admin settings drafts, Google Sheets sync state, SEO script drafts, AI key preferences, and similar browser-side convenience data.

These items are stored on the device browser rather than as HTTP cookies, but they still act as browser storage and should be understood as part of our client-side persistence behavior.

When guests use embedded or loaded third-party services such as Google Maps or Razorpay Checkout, those providers may set or read their own cookies according to their own policies.

Leestays also uses embedded map and media surfaces that may connect the browser to external providers when those components are loaded.

If a guest allows analytics, Meta Pixel may set or read _fbp and _fbc identifiers and connect to Meta services. Leestays may also send matching website conversion events through the Meta Conversions API.

The leestays_meta_consent cookie stores whether the visitor selected Allow analytics or Essential only. It lasts for up to 180 days unless cleared earlier.

After permission is granted, Leestays measures page views, property views, call or WhatsApp link clicks, checkout starts, saved booking requests, and verified payment outcomes. Browser and server copies of the same conversion share an event identifier so Meta can deduplicate them.

Leestays does not treat a WhatsApp link click as proof that a conversation or sale occurred. Later qualified-lead, actual-message, or confirmed-booking outcomes are sent only from authorized operational systems with an appropriate data-use decision.

Users can clear cookies and local storage through their browser settings, although doing so may sign them out or remove saved preferences.

If you disable essential authentication cookies, account login and protected-area access may stop working correctly.

Selecting Essential only keeps optional Meta analytics disabled. Clearing the leestays_meta_consent cookie causes the site to ask for the preference again on a later visit.