Cookie policy

These make sign-in work. They are exempt from the consent requirement because the service cannot be provided without them, and there is no way to switch them off and still use an account.

__session— set by Clerk, our authentication provider. It holds a short-lived signed token for your signed-in session, which Clerk renews about every minute, and is sent over HTTPS only. Clerk’s own script reads it to keep you signed in, so unlike the cookie below it isn’t hidden from JavaScript.

__client — also Clerk, set on our sign-in subdomain clerk.be-outside.app. It is what keeps you signed in between visits and cannot be read by JavaScript.

__client_uat — also Clerk. It records when your session was last updated so the site knows whether to show you a signed-in or signed-out page before anything loads.

Clerk may also set copies of these with a short suffix on the name (for example __session_Ab12Cd34), which do the same job.

__stripe_mid and __stripe_sid — set by Stripe only when you open the payment form to book a stay, which runs on Stripe. They help detect card fraud; __stripe_mid lasts a year and __stripe_sid 30 minutes. Paying for Pluson the web happens on Stripe’s own checkout page, so its cookies are set there, not here.

We do not set a CSRF cookie. The API verifies the Clerk token on every request and checks which origin issued it, which is what protects against cross-site requests here.

A few things live in your browser’s local storage. They stay on your device, are never sent to us, and are cleared when you clear site data.

be-outside.analytics-consent— whether you accepted or declined analytics. We keep it so the banner doesn’t ask you again every visit. Without it we would have to treat every page load as undecided, which means asking again.

be-outside.chat-consent— the same, for support chat. It’s kept separately because you can say yes to one and no to the other.

be-outside.theme— light, dark, or follow your browser. This is why the page doesn’t flash white before turning dark.

go:pending-invite — when you open a trip invitation before signing in, which invitation it was, so you land back on it afterwards. It expires after a day.

be-outside:stay-checkout — while you pay for a stay, the hotel, dates and room you chose, so the booking can finish after the payment page sends you back. It is kept for that browser tab only and contains nothing about you.

Your distance units, currency and notification settings are not stored on your device — they are part of your account, so they follow you to another browser or the mobile app.

If you accept, Google Analytics sets _ga and _gid to count visits and see which features get used. _ga lasts two years and _gid 24 hours.

Until you accept, the Google tag is not loaded at all — no script is fetched, no cookie is set, and no request leaves your browser. That is stricter than the common approach of loading the tag with storage denied, and it is what UK PECR expects for non-essential cookies.

You can change your mind whenever you like in Settings. Withdrawing consent stops the tag and deletes the cookies it left behind. Declining changes nothing about how the product works.

Our live chat is provided by Crisp. If you allow it, Crisp sets crisp-client/session/…so your conversation is still there when you come back. It lasts six months. If you’re signed in, your conversation is also linked to your account, so it follows you to another device, and Crisp receives your name and email so we know who we’re talking to.

Crisp also keeps a few items in local storage with names starting crisp, for the same purpose.

Until you allow it, the chat is not loaded — the button you see is ours, and nothing is requested from Crisp until you press “Start chat” (or “Start a chat” on our help page). Turning it off in Settings removes the chat and deletes its cookie.

The app doesn’t use cookies. It keeps your sign-in in your phone’s secure storage, along with your theme choice. If you allow notifications, it registers a push token with Firebase Cloud Messaging so we can send them. If you start a support chat, Crisp keeps that conversation on your device until you sign out. There is no analytics or advertising tracking in the app.

None. We set no advertising cookies, run no third-party ad trackers, and do not sell or share your data with advertisers.

Every major browser lets you view and delete cookies and local storage, and block them per site. Blocking the strictly necessary cookies will stop sign-in working — the rest of the site will still read.

Questions about any of this: privacy@be-outside.app. Be Outside is a product of ASHER LABS LTD, company no. 17085554, registered in England and Wales.