Legal
What we store
Last updated: 20 September 2026
Almost no cookies
Read this index without signing in and no cookie is set at all, not for measurement, not for advertising, not for anything. What is used instead is your browser's own storage, for the four things listed below.
Two cookies exist, and only once you create an account or sign in: one keeps you signed in, one guards a sign-in through Google while it is happening. Both are first-party, both are set so that no script on the page can read them, and neither carries anything about you beyond the fact that it is your session. Sign out and the first one is gone.
The complete list
| Name | Type | Purpose | Life | Category |
|---|---|---|---|---|
| sg-consent | Local storage | Remembers the privacy choices you made, so you are not asked on every page. Holds the three on/off values, a version number and the time you chose. | Until you clear it or the categories change | Strictly necessary |
| sg-shortlist | Local storage | The houses you have kept with the key, as a list of short names and the time you kept each one. Written only when you press the key. It never leaves your browser, we cannot read it, and there is no account behind it. | Until you remove them or clear your browser data | Strictly necessary |
| sg-session | Cookie | Keeps you signed in. Holds the tokens your browser needs to prove it is your account, and nothing about you. Written only when you sign in, and set so that no script on the page can read it. | 30 days, or until you sign out | Strictly necessary |
| sg-pkce | Cookie | Only during a sign-in through Google: a one-time random value that proves the browser which started the sign-in is the one finishing it. Deleted the moment you come back. | 5 minutes | Strictly necessary |
| sg-visit / sg-visit-step | Session storage | A random number that ties the pages of one visit together, and the position within that visit. Written only if you allow measurement, and deleted the moment you withdraw it. | Until the tab is closed | Analytics (optional) |
Requests to other companies
While you read a page, your browser contacts this domain and nothing else. Fonts are served from here, not from Google. There is no CDN, no tag manager and no third-party script.
There are exactly two exceptions, and each needs an action from you:
- Esri (United States) draws the map on a hotel page and receives your IP address when it does. Only if you allowed maps when you were asked, or if you press “Show map” on the hotel page itself. That button says so before you press it, and it turns on nothing else. Otherwise no map is drawn and the address is shown as text.
- Google, only if you press "Continue with Google" to sign in. Nothing from Google runs on these pages: there is no Google script, no font and no button loaded from their servers, so nothing reaches them while you read. The first contact happens after that click, when your browser is sent to their sign-in page.
Changing your mind
Withdrawing is one click, from any page. Turning measurement off also deletes the visit number listed above straight away, rather than leaving it behind.
The reasoning behind each category, and the legal bases, are in the privacy policy.