1. General
- This policy describes the information that aereclub.com (the Website) stores in or reads from your browser. It is issued by YNS, the controller identified in section 1 of the Privacy Policy, which governs the processing of personal data.
- The Website uses six items of browser storage of its own. Each is strictly necessary or records a choice you made, except for the Partner's link name carried by
fe-oauth-consent(section 3). On the checkout page, Stripe sets two cookies of its own. A script also holds a Partner's link name in the memory of the page (section 3). - The Website uses no analytics or advertising cookies and no social-network plug-ins, and shares no browsing data with advertising networks. Page views are measured without any cookie or other browser storage (section 6).
2. Definitions
- A cookie is a small text file that a website asks the browser to store and that the browser sends back to the website with later requests. Local storage is browser storage that is not sent to the server. In this policy, "cookies" covers both where the difference is immaterial.
3. Cookies and storage used
| Name | Purpose | Category | Duration |
|---|---|---|---|
sb-* (several, named by our authentication provider) | Keep you signed in (session and refresh tokens) | Strictly necessary | Up to 400 days, renewed while you use the Account; deleted on sign-out |
NEXT_LOCALE | Remembers the site language you chose | Strictly necessary | Browser session; no expiry date is set |
fe_recovery | Set when you open a password-reset link from your email; proves that the reset was started from your mailbox; used once | Strictly necessary | 15 minutes, or until the password is changed |
fe-oauth-consent | Set only on signup with Google. Holds your choices on the signup form (acceptance of the Terms, the newsletter choice) while you are on Google's page. If you arrived through a Partner's link, it also holds the Partner's link name, which identifies the Partner, not you. | Strictly necessary for your choices. The Partner's link name is not strictly necessary: it serves settlement with Partners. | 10 minutes; deleted on return from Google |
fe-consent | Your answer to the cookie banner: the banner version and whether the analytics category is allowed | Strictly necessary | 12 months |
fe-offer (local storage) | Records that you closed the welcome-discount box, which then stays hidden for at least 7 days, or that you requested a code, after which it is not shown again. Holds dates and yes/no values, no address or identifier. | Strictly necessary | 24 months from the last write; then deleted at your next visit |
__stripe_mid, __stripe_sid | Set by Stripe, only on the checkout page, to prevent fraud in card payments. We do not read them. | Strictly necessary, set by Stripe | As set by Stripe (Stripe's cookie policy) |
fe_recoveryandfe-oauth-consentarehttpOnly: scripts on the page cannot read them.fe-offeris held in local storage, is never sent to a server and is read by no server.- Partner's link name in page memory. If you open an address of the Website ending in
?ref=and a Partner's link name, a script reads the link name, removes it from the address bar and holds it in the memory of that tab only. It is written to no browser storage, exceptfe-oauth-consenton a Google signup from that tab. It is lost when you reload or close the tab and reaches us only if you sign up or start a paid checkout in that tab. The script does this for every visitor, without asking for consent. To avoid a record, reload the page before you sign up or pay. Clause 3.10 of the Privacy Policy describes what we record.
4. Legal basis
- Strictly necessary cookies are used without consent, because the Website cannot provide the service you request without them: signing in (
sb-*), the chosen language (NEXT_LOCALE), a secure password reset (fe_recovery), signup with Google (fe-oauth-consent, for your choices), recording your cookie choice (fe-consent) and your answer to the welcome-discount box (fe-offer). Stripe's cookies are necessary for a secure card payment. - The Partner's link name, in
fe-oauth-consentand in page memory, is not strictly necessary. It is used without consent, as described in section 3. - If you delete strictly necessary cookies in your browser, you are signed out and the cookie banner is shown again.
5. Third parties and external websites
- On the checkout page, Stripe's script sets the cookies listed in section 3, and Stripe's payment form sets cookies on Stripe's own domains under Stripe's cookie policy. No other third party sets cookies through the Website.
- Stripe's billing page, opened from the Account settings, Google's sign-in pages and the external flight search websites opened by booking links set their own cookies under their own policies. Booking links carry no affiliate or tracking identifier.
6. Analytics category
- Page views are measured with Vercel Web Analytics, which writes no cookie or other browser storage. It runs without consent and does not depend on the cookie banner. Clause 3.5 of the Privacy Policy describes what it records.
- The cookie banner offers an Analytics category. It is off by default and covers only analytics that would store data on your device. None is used at present.
- Before any such tool is used, we will name it in this policy and ask every user again through a new version of the banner.
7. Managing your choices
- You can change or withdraw your analytics choice at any time through the Cookie settings link in the footer of the Website.
- You can block or delete cookies in your browser settings. Blocking strictly necessary cookies prevents signing in.
- Your cookie choice is stored only in the browser in which you made it and is separate from your marketing email choice (section 5 of the Privacy Policy).
8. Changes to this policy
- We update this policy and its effective date whenever an item in section 3 is added, removed or changed.
9. Contact
- Questions about this policy: privacy@aereclub.com.