Last updated: 7 July 2026
Cookies are small text files that a website stores on your device to remember you between page loads and visits. Related technologies — localStorage, sessionStorage, and similar browser storage — do a comparable job and are treated the same way in this policy. Broadly, they fall into two groups:
Bookr uses only the first group.
UK law — the Privacy and Electronic Communications Regulations 2003 (PECR), read alongside the UK GDPR — requires a website to obtain your consent before storing non-essential cookies, but expressly exempts cookies that are strictly necessary to provide a service you have asked for. Because every cookie Bookr sets falls within that strictly-necessary exemption, there is no consent banner to accept or reject and nothing to opt out of. If we ever introduce a non-essential cookie (for example, lightweight first-party analytics), we will not set it until we have asked for and received your consent, and we will update this policy first.
| Name | What it does | Set by | Expiry |
|---|---|---|---|
sb-access-token | Keeps you logged into your Bookr account. | Bookr (via Supabase) | 1 hour, refreshed automatically |
sb-refresh-token | Lets us refresh your login without making you sign in again. | Bookr (via Supabase) | Session — expires when you log out or after 7 days of inactivity |
__csrf (or equivalent) | Cross-site request forgery (CSRF) protection — validates that form submissions come from the Bookr site and not a third-party page. Contains no personal data. | Bookr | Session |
bookr_demo_bookings | Stores guest bookings locally so you can find them again before creating an account. (Technically localStorage, not a cookie — same idea.) | Bookr | Until you clear browser storage |
bookr_cookie_notice_dismissed | Remembers that you've dismissed the small cookie notice so we don't show it on every page. (Technically localStorage, not a cookie.) Contains no personal data. | Bookr | Until you clear browser storage |
__stripe_mid, __stripe_sid | Set by Stripe's fraud-prevention script (Stripe.js), which loads on the Bookr booking page. They are stored in the first-party mybookr.app context and used by Stripe to detect and prevent payment fraud. Bookr does not read or control these cookies; they are governed by Stripe's privacy policy. | Stripe (set in the first-party mybookr.app context) | Up to 1 year (__stripe_mid); session (__stripe_sid) |
Every entry above is either strictly necessary to run the service (login, checkout, fraud/CSRF protection) or a functional preference you would expect. None of them track you across other websites, and none are used for advertising.
The only third party that sets cookies through Bookr is Stripe, our payment processor. When you reach the payment step, Stripe's payment library (Stripe.js) loads directly on the Bookr booking page rather than redirecting you elsewhere. Stripe sets __stripe_mid and __stripe_sid in the first-party mybookr.app context to help detect and prevent payment fraud — this is part of keeping your payment secure and is itself strictly necessary to take a card payment safely. Bookr does not read or control these cookies; they are governed by Stripe's privacy policy.
If that ever changes (for example, we add privacy-friendly first-party analytics) we'll update this page and ask for consent before setting anything new.
Some browsers send a "Do Not Track" (DNT) or Global Privacy Control (GPC) signal. Because Bookr does not track you across sites or set any advertising or profiling cookies in the first place, these signals make no practical difference to what we store — there is no tracking for them to switch off. We honour their spirit by simply not doing the things they are designed to prevent.
You can block or delete cookies in your browser settings at any time. Be aware that blocking the strictly-necessary ones will sign you out of Bookr and can break the login and checkout flow, and blocking Stripe's cookies may interfere with taking payment. Instructions for common browsers:
The owner-facing Bookr mobile app does not use browser cookies. It keeps you signed in using secure device storage (the iOS/Android keychain via expo-secure-store) rather than a cookie, and it does not contain any advertising or third-party analytics SDKs for tracking. How the app handles data is described in our Privacy Policy.
This page covers the small technologies stored on your device. How Bookr collects and uses your personal data more broadly — including the lawful bases, who we share it with, and your rights — is set out in our Privacy Policy, which includes a matching summary of these cookies.
If we change what cookies Bookr uses, this page will be updated and the "Last updated" date above will move. For any material change — in particular, before we would ever set a non-essential cookie — we'll surface a notice on the site and, where the law requires it, ask for your consent first.
Questions about cookies or anything on this page? Email support@mybookr.app.