Legal
Cookie policy
Which cookies this site uses, who sets them, and how to change your choice at any time.
We set cookies that are strictly necessary to run the site, plus the analytics and marketing cookies listed below. Whether those last two need your permission first depends on where you are reading this from — cookie law is not the same everywhere, and we apply the one that actually covers you rather than the strictest one on earth. Either way you can turn them off, at any time, from the link in the footer of every page.
Which rules apply to you
- European Economic Area, United Kingdom, Switzerland, Brazil, South Korea and Quebec — we ask first. No analytics or marketing script is loaded at all until you accept that category, and declining is a single click on the same banner. This is also what Google’s own EU User Consent Policy requires of us, which is why the UK and Switzerland are on this list even though their own law is less demanding.
- United States and Canada — we tell you. Analytics and ad measurement start when you arrive, a short notice says so on your first visit, and the Your privacy choices link in the footer turns them off. If your browser sends a Global Privacy Control signal we treat that as an opt-out of marketing without your having to click anything.
- Everywhere else — analytics and ad measurement run by default and we do not interrupt you with a banner, because no law where you are asks us to. The controls are still in the footer, and they still work.
We work this out from the country your connection appears to come from, at the moment you load a page. That is used only to pick which of the three rules above applies; it is not stored with anything that identifies you, and the only thing kept in your browser is the three-letter answer (strict, soft or open) plus whatever choice you have made yourself.
Cookies we use
| Name | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
| sb-<project>-auth-token | PilavTour (Supabase Auth) | Keeps you signed in, so your saved trips reach you on any device. Only set if you choose to sign in. | Until you sign out | Necessary |
| pt_geo | PilavTour | Holds one word — strict, soft or open — for which of the three cookie rules above applies to you, so the rest of the site doesn't have to re-check your location on every page. It holds no country, no city and nothing that identifies you. | 24 hours | Necessary |
| _ga | Google Analytics 4 | Distinguishes unique visitors for aggregate traffic reporting. | 2 years | Analytics |
| _ga_<container-id> | Google Analytics 4 | Persists session state for a specific GA4 property. | 2 years | Analytics |
| _gcl_au | Google Ads | Stores the ad-click information Google uses to attribute a booking inquiry to the ad that led to it (conversion measurement). | 90 days | Marketing |
| _gcl_aw | Google Ads | Holds the Google Ads click identifier (gclid) after you arrive from one of our ads, for the same conversion measurement. | 90 days | Marketing |
| cf_clearance | Cloudflare Turnstile | Bot protection on our inquiry forms. Set on Cloudflare's own domain, and only after you start filling in a form — nothing loads before that. | About 30 minutes | Necessary |
The analytics and marketing cookies above are only set while their category is on. When it is off — because you switched it off, or because you are somewhere we have to ask first and haven’t been told yes — the scripts that set them are not loaded at all, rather than loaded-but-inactive.
Categories
- Necessary — required for the site to function. We set two cookies of our own: pt_geo, which records which cookie rules apply to you, and — only if you choose to sign in — the session cookie. Two other things live in your browser’s local storage rather than in a cookie — your cookie/consent choice, and the trips you save with the heart icon (your “Saved trips” shortlist). Local storage is never sent to us, and clearing your browsing data removes it.
- Analytics — Google Analytics 4, listed above. Tells us which pages are useful. The script is not loaded while this category is off.
- Marketing — Google Ads, listed above. Measures whether our advertising brought you here (so we know which ads work) and supports showing relevant ads. The Google Ads tag is not loaded at all while this category is off.
Video embeds
Some blog posts embed a YouTube or Vimeo video. These show a click-to-play preview first — the video provider’s player (and any cookies it sets) only loads if you click play on that specific video. This is independent of the categories above and isn’t covered by your analytics/marketing choice, since it only ever runs on your direct action.
Changing your choice
Every page carries the control in its footer — labelled Cookie settings, or Your privacy choices if you are in the United States or Canada. It opens the same panel wherever you are, and it lets you switch each category on or off regardless of which of the three rules above applied when you arrived.
Questions
For any question about this policy, email hello@pilavtour.com.
Last updated: September 21, 2026. See also our Privacy policy.