How We Use Cookies

1. What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They let a site remember things between page loads — for us, mainly whether you are logged in.

We group cookies into three categories: strictly necessary (the site cannot work without them), analytics (how the site is used), and advertising. We do not use advertising cookies at all.

2. Cookies We Use

These are the cookies set by Kundasang Homestay and by the third-party services we use on the site.

The security cookie is set by Cloudflare, Inc. as part of the site's hosting and protection, and may not appear if you are not routed through their bot-protection checks.

3. Other Browser Storage

Not everything we store in your browser is a cookie. We also use localStorage, which is a separate storage area:

• CSRF protection token. A token used to protect our forms from cross-site request forgery. It is not used for tracking, and it is not a cookie.
• Guest display details. A small record holding your guest name and ID, so the header can show who is signed in without an extra request. It is not used for tracking.

Unlike the login cookies, these are not marked HttpOnly, because page scripts need to read them. You can clear them at any time by clearing your browser storage, but you will be signed out.

4. Analytics

We use two analytics tools, with different privacy characteristics:

• Cloudflare Web Analytics. A privacy-preserving service that does not set cookies, does not collect or store personal data, and does not fingerprint your browser. It reports only aggregate, anonymous statistics — for example, how many visitors we got today and which pages were most read.
• Google Analytics 4. This does set cookies (see the table above). It records which pages you visit, how you arrived, and general technical information such as your approximate location, device type, browser and operating system, and a truncated IP address. Google processes this data on our behalf and may transfer it outside Malaysia.

We use both tools only to understand how the site is used so we can improve it. We do not use them to build advertising profiles, we do not enable Google advertising features or data sharing for ads, and we do not sell this data to anyone.

5. Your Choices

You are in control of cookies. You can:

• View and delete cookies already stored, using your browser settings.
• Block all cookies, or only third-party cookies.
• Set your browser to notify you when a cookie is set.
• Opt out of Google Analytics entirely using Google's browser opt-out add-on.

Important: the login cookies are strictly necessary. If you block them, you will not be able to sign in, view your bookings, list a property, or complete a booking. The public pages — browsing homestays and reading our policies — will still work.

Blocking analytics cookies has no effect on how the site works for you.

6. Consent

Strictly necessary cookies are set because the platform cannot function without them. For analytics, we rely on our legitimate interest in understanding how the site is used, and we give you the controls described in section 5.

Malaysian law does not currently require a cookie-consent banner, so you will not see one. If we later begin using cookies that need prior consent, we will add one and update this policy first.

Our handling of personal data more generally — including your rights of access, correction and withdrawal of consent — is set out in our Privacy Policy.