Cookie Policy

Cookies (opens in a new tab) are small files that a website stores on your device. They allow the site to remember information between pages and visits. This policy also covers similar technologies, such as your browser's local storage (opens in a new tab).

Depending on who sets them, cookies are first-party (set by the site you are visiting) or third-party (set by another service whose content is loaded on the page). Depending on how long they last, they are session cookies (deleted when you close the browser) or persistent cookies (kept for the stated period or until you delete them). Cookies that are strictly necessary to provide the service you request do not need your consent; the others do, except for the exempt audience measurement explained in section 4.

All the cookies we set ourselves are first-party cookies: they are created by secondbookapp.com and read only by SecondBook. Those that other services may set are explained in section 5. We do not currently use any advertising cookies, whether our own or third-party.

Strictly necessary technical cookies (always active; no consent required):

• sb_access: keeps you signed in. It lasts 15 minutes and is renewed automatically while your session remains open
• sb_refresh: renews your session without you having to sign in again. It lasts 30 days and is only sent when the session is renewed or closed
• sb_authed: indicates that a session is open in this browser, so the site does not check for one unnecessarily; it contains no sign-in data. It lasts up to 30 days and is deleted when you sign out
• sb_device: identifies this browser with a random code so that we can manage your sessions and alert you to sign-ins from new devices. It is set when you sign in, is not deleted when you sign out and lasts 400 days
• mfa_challenge, password_reset_session, passkey_setup, sudo_challenge and sudo: complete specific security steps (two-step verification (opens in a new tab), changing your password, creating your first passkey (opens in a new tab) and confirming your identity before sensitive actions). They last between 5 and 15 minutes
• sb_oauth_state: links a sign-in with Google or Apple to the browser that started it, to prevent impersonation. It lasts 10 minutes
• appeal_session: allows you to appeal an account suspension from the link sent to you by email. It lasts 2 hours at most

Preference cookies (needed to show you the site as you have chosen):

• locale: remembers the language of the last page you visited. It lasts 1 year
• sb_lang: your account's language, so that the interface is shown in that language when you are signed in. It lasts 1 year and is deleted when you sign out
• sb_tz: your time zone, so that dates and times are shown in your local time. It lasts 1 year
• sb_uses: how the optional uses of your data are set in this browser (section 4), so that the site knows which usage data it may send. It does not identify anyone. It lasts 390 days

Display preferences (chosen by you at the top of this page, under “Preferences”): whether you want to see seasonal decorations and which country's calendar they follow. They don't use a cookie of their own: if you're not signed in, we keep them on our servers linked to this browser's sb_vid identifier; if you are, in your account. When you sign in, your account takes this browser's if you changed them more recently. If you switch decorations off, this browser also remembers it in its local storage (section 3), so they are not shown while each page loads.

Audience measurement cookie (exempt from consent; you may object to it):

• sb_vid: a random identifier for this browser. It is used for anonymous audience measurement (section 4) and, only where they are switched on, for personalised recommendations and full measurement of how our website is used from this browser. We also use it to protect the site against abuse. It lasts 390 days (less than 13 months): it is set once and is not extended on later visits

Besides cookies, we store some operational data in your browser. Only this website reads it, on your device; it is not sent to our servers on its own.

Local storage (kept until you delete it):

• the details of the last account that signed in on this device (name, email and photo), to offer you "Continue as…" when you return. They are kept after you sign out, expire after 90 days and can be deleted from the sign-in screen itself
• the destinations you searched for most recently, to suggest them again
• the two-step verification method you used last time, to offer it first
• that you have already read the notice with the messaging rules, so it is not shown again
• that you have switched seasonal decorations off, so they are not shown even for a moment while each page loads. It is deleted if you switch them back on

Session storage (deleted when you close the tab):

• the email you type when signing in, so you do not have to repeat it between steps
• the state of some steps in progress, such as a password change or the listing you have just published
• markers so that something is not done twice in the same visit: counting a purchase in the measurement, looking up your profile photo or sending the device fingerprint (the latter only with full measurement switched on; section 4)

They are strictly necessary or used by a feature you have requested, so they do not require your consent. You can delete them in your browser settings, together with cookies (section 6).

Beyond what is strictly necessary, we use your data for four optional purposes, explained in section 9 of our Privacy Policy. The three that depend on your browsing have their switch at the top of this page, and all four are on the Your data page. If you are not signed in, your choice applies to this browser; if you are, to your account. Each change takes effect immediately. While your account is paused (restriction of processing), we carry out none of them.

• Personalised recommendations: we suggest hotels and destinations based on what you look at. Legal basis: legitimate interest. On by default; you may object by switching them off
• Anonymous visit measurement: we count visits and what is viewed most, without knowing who you are. Legal basis: the audience-measurement exemption recognised by the AEPD (opens in a new tab) and the CNIL (opens in a new tab). On by default; if you switch it off, we measure nothing of what you do, not even anonymously
• Full measurement of your use: statistics on how you use the site, linked to your account or your browser. Legal basis: your consent. Off by default; it only works if anonymous measurement is also on. While it is on, we also compute a technical fingerprint (opens in a new tab) of your device in your browser (using the FingerprintJS library) and associate it with your sb_vid identifier
• Reminders of what you have viewed: emails if you leave a search, a hotel or a payment unfinished. Legal basis: your consent. Off by default; they require an account you are signed in to and personalised recommendations switched on; they are switched on and off on the Your data page

How anonymous measurement works: we record the pages visited, the active time on each page, how far you scroll, clicks on links and buttons (never what you type in forms) and which destination, accommodation and listing pages were viewed, together with your country, language and type of device. We do not link it to your account or your session, we do not store your IP address (opens in a new tab) or your precise location, and we remove query strings from addresses (except utm_* (opens in a new tab) campaign tags).

It is used only for aggregate statistics — never for advertising, profiling, recommendations or reminders — and is not shared with third parties. The records are deleted after about 90 days and are never kept for more than 25 months. It relies on the exemption for strictly necessary first-party audience measurement under article 22.2 of the Spanish LSSI (opens in a new tab), as interpreted by the Spanish Data Protection Agency (AEPD, 2023 cookie guide (opens in a new tab)), equivalent to the one applied by the French CNIL.

We also collect anonymous page-speed measurements (Web Vitals) with no identifier at all.

Some pages load content from other services, which process your data under their own policies:

• Payments (Stripe): on the payment page we load Stripe's form, which sets its own cookies to process the payment securely and prevent fraud. They are needed to pay and are loaded only on that page (Stripe's cookie policy (opens in a new tab))
• Sign in with Google: on our sign-in screens we load Google's button, which may offer to continue with the Google account open in your browser. To do so, Google uses its own cookies and may store one on our domain (for example, g_state, if you close that prompt) (Google's cookie policy (opens in a new tab))
• Sign in with Apple: it takes place on Apple's page, which applies its own cookies and its own policy
• Bot protection: at the email step of signing in and in requests about your data sent without being signed in, a usually invisible Cloudflare check (Turnstile) confirms that a person is using the browser (Turnstile privacy notice (opens in a new tab))
• Maps: the maps of destinations and accommodation are downloaded from our map provider's servers, which receive your IP address as with any website visit; the download is made without cookies
• Visit statistics (onedollarstats): it gives us visit statistics without cookies: it stores nothing on your device and follows the anonymous measurement switch

Advertising: we do not currently show third-party ads or use Google Analytics or advertising cookies. If we add third-party advertising in the future, we will update this policy and ask for your consent before setting any advertising cookie.

On SecondBook: use the switches at the top of this page or those on the Your data page. You can withdraw your consent or object to a use at any time, as easily as you gave it; the change takes effect immediately and does not affect what we did earlier with your consent. To object to anonymous measurement you can also write to us at soporte@secondbookapp.com.

In your browser: you can view, block or delete cookies and the other data that websites store in it. This is how to do it in the most widely used browsers:

• Google Chrome (opens in a new tab)
• Safari on Mac (opens in a new tab) and Safari on iPhone and iPad (opens in a new tab)
• Mozilla Firefox (opens in a new tab)
• Microsoft Edge (opens in a new tab)

If you block technical cookies, parts of the site, such as signing in or paying, may stop working. If you delete sb_vid, this browser will count as a new one and the choices you made in it without signing in will be lost; those of your account are kept.

• Cookies: the period stated for each one in section 2. Those of your session (sb_access, sb_refresh, sb_authed and sb_lang) are also deleted when you sign out. None lasts more than 2 years, and those used for measurement (sb_vid and sb_uses) never more than 13 months
• Third-party cookies: the period each service sets in its own policy (section 5)
• Local storage: until you delete it; the "Continue as…" details, 90 days
• Session storage: until you close the tab
• What we record thanks to them: anonymous measurement, about 90 days and never more than 25 months (section 4); the rest of your data, the periods in our Privacy Policy

We may update this Cookie Policy, for example if we add a new cookie or service. The date shown at the top indicates when it was last changed. If a change requires your consent, we will ask for it before applying it.