Cookie Policy
Last updated: 31 October 2026
Transfer Crete uses only essential cookies and localStorage preferences to make our booking system work properly. We do not use any analytics, advertising, or tracking cookies.
Essential cookies
These cookies are set by Auth.js (our authentication system) only when you sign in to access protected areas like admin, operator, or driver portals. They are strictly necessary for the application to function and cannot be disabled.
| Cookie name | Purpose | Lifetime |
|---|---|---|
| __Secure-authjs.session-token (authjs.session-token on HTTP) | JWT session token holding your user ID, roles, and permissions | 30 days idle (rolling) |
| __Host-authjs.csrf-token (authjs.csrf-token on HTTP) | CSRF protection for sign-in requests | Browser session |
| __Secure-authjs.callback-url (authjs.callback-url on HTTP) | Remembers where to redirect after sign-in | Browser session |
All auth cookies are httpOnly, sameSite=lax, and secure (HTTPS only in production). They are never set on public pages — only after a successful sign-in.
LocalStorage preferences
We use browser localStorage (not cookies) to remember UI preferences like table column visibility and sidebar state. These are functional only and never used for tracking.
transfer_view_cols— Transfer list view mode (drivers + operator portals)portal-sidebar-collapsed— Sidebar collapsed state (operator portal)admin_transfers_columns— Admin transfers table visible columnscookie-consent— Your cookie consent choice (value: "accepted")
Third-party services
Our site interacts with the following third-party services. None of them set cookies on our domain.
Mapbox (maps and routing)
We use Mapbox GL JS to display interactive maps and calculate routes. Mapbox may set third-party cookies on its own domain (mapbox.com) when loading map tiles. Mapbox collects anonymous usage telemetry by default, which we cannot disable without using unofficial APIs.
Stripe (payment processing)
When you pay online, you are redirected to Stripe's hosted checkout (checkout.stripe.com). Stripe sets cookies on its own domain for fraud prevention and compliance. We never see or control these cookies.
Google Fonts / next/font
All fonts are self-hosted at build time via Next.js Font optimization. No requests are made to Google servers, and no cookies are set.
What we don't use
- No analytics cookies (Google Analytics, Vercel Analytics, PostHog, etc.)
- No advertising or marketing cookies
- No social media tracking pixels
- No fingerprinting or cross-site tracking
Managing cookies
You can control cookies through your browser settings. Disabling essential cookies will prevent you from accessing protected areas (admin, operator, driver portals), but public pages will still work.