5.2Cookie categories
| Category | Purpose | Default setting |
|---|---|---|
| Strictly necessary | Login, security, fraud prevention, checkout, reservation flow, and saved consent choices | Always active where necessary |
| Preferences | Language, property preferences, and interface settings | Consent where required |
| Analytics | Understand traffic, errors, and feature use | Off until consent where required |
| Advertising | Measure campaigns, personalize ads, and limit repetition | Off until consent |
5.3Cookie controls
Where consent is required, non-essential cookies will not be activated until you choose to allow them. You may change your choice through Cookie Settings. Blocking necessary cookies may prevent login, checkout, or other core functions.
The Cookie Settings panel will identify the non-essential technologies active on the live Platform, including their providers, purposes, and retention periods. Malaya will update that panel whenever a technology is added, removed, or materially changed.
As of the date at the top of this page there are no non-essential technologies on this Platform — no analytics and no advertising — so there is nothing to allow or block and no consent prompt is shown. What is stored today is the current content of that panel.
Cookie Settings — what is stored today
Everything this site keeps in your browser, as of 2026-09-11. All of it is strictly necessary or holds no personal data, which is why no consent prompt appears:
- Your sign-in session ("sb-…" entries in local storage) — set when you sign in so you stay signed in between pages and visits. Removed when you sign out. Provider: Supabase. Strictly necessary.
- A referral code ("malaya.ref" in session storage) — set only if you arrive through an affiliate’s link, so the booking can be credited to them. Removed when you book or close the browser. Contains the code, nothing about you. Strictly necessary for the attribution you arrived with.
- Which updates you have already seen ("malaya:guest-updates-seen…" and "malaya:guest-thread-seen…" in local storage) — so the bell in the header does not show you the same notice twice. A timestamp and the ids of dismissed notices, nothing about you. Preferences; kept until you clear site data.
- A preview flag ("malaya.authPreview" in session storage) — used only on our own test deployments, never on the live site.
A few things on our pages are loaded from other companies’ servers, and those companies may set cookies on their own domains under their own policies: Google, if you choose “Sign in with Google” (the sign-in happens on Google’s site) and Google Fonts (no cookies, but it receives your IP address); OpenStreetMap, for the map on a villa page, loaded in a sandboxed frame; and YouTube or Vimeo, only if a video on our About page is played — YouTube in privacy-enhanced mode, which sets nothing until you press play.
Signing out removes your session from the browser. Your browser’s settings let you clear storage for this site or block it altogether; the site will still browse, but you will not be able to stay signed in or complete a booking without it.