Archived version — 2026-06-01
This is the 2026-06-01 version recorded on your booking. It shows our current live Cookie Policy — the live page and this archived link stay in step, and documents whose exact wording is version-pinned (such as the Refund Policy) keep their own dated snapshot. The current live Cookie Policy is at /legal/cookies.
Cookie Policy
Effective from 2026-06-01
Cookie Policy
Last updated: 24 October 2026
We use a small set of cookies and equivalent storage. This page explains what each one does and how to change your preferences. Under PECR / UK-GDPR, only strictly-necessary cookies are loaded without your consent.
Strictly necessary
| Name | Purpose | Lifetime |
|---|---|---|
| __Secure-authjs.session-token or authjs.session-token | Keeps you signed in. A large session is split into numbered parts (.0, .1 and so on) | Cookie · 7 days |
| __Host-authjs.csrf-token or authjs.csrf-token | Protects signing in and out against cross-site request forgery | Session cookie |
| __Secure-authjs.callback-url or authjs.callback-url | Remembers the page to take you back to after you sign in | Session cookie |
| __Secure-authjs.pkce.code_verifier or authjs.pkce.code_verifier | Secures the hand-over while you sign in with Google | Cookie · 15 minutes (only while you sign in with Google) |
Preferences (consent required)
| Name | Purpose | Lifetime |
|---|---|---|
| lh_currency | Remembers your selected display currency | localStorage · until you clear it |
| lh_cookie_consent | Stores your cookie choices on this very page | localStorage · until you clear it |
| lh_view | Remembers grid vs map view on the home page | localStorage · until you clear it |
| lh_last_search | Remembers your last home-page search (city, check-in, check-out, guests) so a fresh visit lands on the same query | localStorage · until you clear it |
| lh_last_location | Legacy: city only — superseded by lh_last_search but kept for older tabs | localStorage · until you clear it |
| skipgc | Admin accounts only: tells our visitor counter (GoatCounter) not to count the site owner. Never set for visitors | localStorage · until you sign out |
| lhInternal | Admin accounts only: marks this device as ours so our staff are left out of Google Analytics. Never set for visitors | localStorage · until you sign out |
| lh_booking_resume_v1 | Saves your mid-booking rate selection if you redirect to buy a pass mid-flow | sessionStorage · 30 minutes or until tab closed |
Payment (set by Stripe during checkout)
When you buy a pass or book a hotel, Stripe-hosted Checkout sets its own cookies on the stripe.com domain for fraud prevention and to keep your session alive on their form. These are set by Stripe, not by us; see Stripe's cookie policy for the full list.
Analytics
We use Goatcounter for basic page-view counts. It does not set any cookies, does not build a profile of you across visits or sites, and does not require consent under UK PECR for that reason. Goatcounter records the page URL, the referring page, your user-agent string and a one-way hash of your IP address that is rotated every 8 hours and never retained beyond that window. See the privacy policy for the full description.
With your consent (the Analytics toggle above), we also load Google Analytics 4, which does set cookies. We use it to understand the booking journey (search → hotel view → booking) and to measure which campaigns bring guests who go on to book. IP addresses are anonymised. Nothing loads until you accept; if you decline, no Google Analytics cookies are set.
| Name | Purpose | Lifetime |
|---|---|---|
| _ga | Google Analytics — distinguishes returning visitors | Cookie · 2 years (only with analytics consent) |
| _ga_* | Google Analytics 4 — per-property session state | Cookie · 2 years (only with analytics consent) |
Advertising (consent required)
We advertise on Google. With your consent (the Advertising toggle, which works only with Analytics on), Google Analytics tells Google Ads when a visit that came from one of our adverts goes on to search or book, so we can see which adverts are worth paying for. We do not retarget you with adverts elsewhere and we build no advertising profile of you. If you decline, the advert click is not linked to what you do here.
| Name | Purpose | Lifetime |
|---|---|---|
| _gcl_au | Google Ads conversion linker — links a visit to the advert click that brought it | Cookie · 90 days (only with advertising consent) |
Signing in with Google (optional)
If you have accepted the Preferences toggle above, we may show Google’s one-tap sign-in prompt when you go to book a room — never when you are simply reading. Showing it loads a script from Google Identity Services and allows Google to set its own cookies on accounts.google.com, under Google’s cookie policy rather than ours. We receive only the signed token Google issues — your email address, name and profile picture — and only if you choose to continue. Google may learn that you visited this site.
Decline the Preferences toggle and the prompt never appears and no Google sign-in script is loaded. You can still sign in with the ordinary “Continue with Google” button, or with an email and password — those are your choice to click, so they load only when you do.
How to change your mind
Click "Open cookie preferences" above, or reset preferences in your browser. Strictly-necessary cookies will always be loaded if you want to stay signed in.
Questions about a booking made under the 2026-06-01 Cookie Policy should reference this version number — email support@local-hotel.com with your booking reference.