Storage on this site
- Entrance session · ps-clearance
- After a successful browser check, this signed first-party cookie verifies entrance for 30 minutes from issue. It is HttpOnly, SameSite=Lax and Secure on HTTPS. Refreshing does not extend it. Expiry, removal or a signing-key/version change invalidates it. It does not sign you in or authorize a reservation. This is an application session, not Cloudflare edge protection.
- Cookie preference · ps-preferences
- A separate signed, HttpOnly first-party cookie records necessary-only or accepted optional memory, using preference version 2. It lasts 180 days from your explicit choice, unless changed, removed or invalidated by a signing-key/version change. Refreshing does not extend it. It stores the preference, not booking or payment details. SameSite=Lax; Secure on HTTPS.
- Supabase sign-in cookies · names beginning sb-
- Hold authentication session information and, during Google sign-in, the PKCE verifier securing the return. They are HttpOnly and SameSite=Lax; Secure is enabled on HTTPS. The library sets a maximum lifetime of 400 days, renewed when written. This is a browser storage limit, not a guarantee of session validity. The server verifies sessions. Sign-out clears these cookies; completed exchange removes the verifier.
- Google return destination · ps-oauth-next
- Remembers an allowed return page, including selected visit details when relevant. It expires after 10 minutes and is cleared on callback or sign-out. It does not reserve a space.
- Optional visit · palmsteeze.visit.v1
- Only after acceptance, sessionStorage keeps the resource, date, start and duration so you can return to your plan in this tab. The selected visit also appears in its page URL.
- Optional payment choice · palmsteeze.payment.v1:…
- Only after acceptance, sessionStorage keeps your minimum, custom or full payment choice and typed amount for the selected visit. It contains no card details or payment authorization. The server checks the amount again.
Optional drafts retain their tab/session scope; the 180-day preference does not extend their retention. Closing the tab usually ends sessionStorage, but browser session restoration may retain it. The application does not write localStorage on this site’s origin. The former tab-only preference key is ignored and removed when the current application loads.
Provider pages & security
Turnstile runs on the entrance screen and again for reservation creation. These are separate security checks. Tokens stay in memory, last up to five minutes and can be validated once. The application’s entrance session avoids repeated checks while valid. Privacy, Cookies and Demo Terms remain readable without verification. The application does not request or manufacture a Cloudflare pre-clearance cookie.
Cloudflare’s Turnstile notice explains its security signals and bot-detection improvement purposes. Local checks observed cf.turnstile.u in localStorage on challenges.cloudflare.com. Its provider-controlled lifetime has not been verified; it is separate from token expiry. Browser site-data controls manage provider storage. Cookie settings here cannot remove that origin’s data.
Google sign-in and Stripe sandbox Checkout open provider pages with their own security, session and preference storage: Google cookies and Stripe cookies. There are no optional analytics or advertising categories.
Your controls
The first-visit banner offers Accept optional storage, Necessary only and Manage preferences. You can also change your choice here at any time, without entrance verification. Optional memory stays off until accepted. Necessary-only visitors can complete bookings.
Accepting optional memory is not agreement to all personal-data processing. Security and sign-in are separate. Sign-out removes sign-in cookies; the entrance and preference cookies remain until their own expiry or removal. Browser site-data controls can remove cookies and provider storage. Removing browser data does not delete server or provider records.
Blocked first-party cookies prevent a usable entrance session or sign-in. A blocked security script prevents verification and new reservations; these policy pages remain available. For account or record requests, see Your choices & rights.