What this page shows
This page lists what the freestays platform stores in the browser. It is based on the list in the platform's program code. The same list renders the platform's cookie page, and the cookie banner reads it. The platform is pre-launch. A comparison with the entries actually set in production is still pending.
Overview
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
| sb-*-auth-token | Cookie | Keeps a sign-in active. Set only after sign-in. | until sign-out, at most 400 days | necessary |
| sb-*-auth-token-code-verifier | Cookie | Secures the sign-in process by email link; planned also for sign-in with a Google or Apple account. | until the sign-in is completed | necessary |
| fs_consent | localStorage | Stores the choice made in the cookie banner so that it is not asked again. | 12 months | necessary |
The list contains no further entries. The platform currently uses no analytics service.
Sign-in cookies
The two cookies starting with sb- belong to sign-in. They are readable only by the server; scripts in the browser cannot access them. They are set over encrypted transmission and with the SameSite Lax setting; only in local development without HTTPS is the encryption requirement dropped. The platform renews them automatically on requests as long as the sign-in lasts.
Sign-in with a Google or Apple account is set up in the code but will only be offered once the respective provider is in use. When people sign in this way, the providers set their own entries on their own pages during the sign-in process. They are themselves responsible for that. The platform sets no further entries in doing so.
Choice from the cookie banner
The fs_consent entry sits in the browser's local storage. It contains the version of the banner, the decision on analytics (yes or no) and the time of the decision. If it is older than twelve months or the banner has changed, the choice is treated as not made, and the banner asks again.
As long as no decision exists, the platform loads no service of the analytics category. There is currently no such category in the list. Planned is error reporting in the browser with Sentry, which is to run only after consent and is not yet in use.
For signed-in users, the platform also records the choice in the account, as evidence of consents given and withdrawn. What is stored is the user identifier, document and times; the code writes neither an IP address nor a browser identifier. For visitors without an account, the choice stays in the browser only. The browser entry is authoritative for the banner. If saving to the account fails, the choice remains valid in the browser.
Changing the choice
The choice can be changed with the button in the cookie settings. It is on the platform's cookie page and in the settings of creator accounts, under the consents section.
Legal assessment
Whether the three entries may be set without consent because they only provide the requested function, and which legal basis applies to the evidence in the account, is open for legal review.
Questions
support@freestays.app answers questions.