Cookies policy.

Cookies are small text files that a website places on your device when you visit. They let the site remember information about your visit — such as whether you are logged in, what language you prefer, or whether you have already seen the consent notice.

The Platform also uses browser localStorage. localStorage stores data in your browser but is never sent to a server automatically. We use it to remember your saved properties, your currency choice, and your consent decision. localStorage stays on your device until you clear it.

When we talk about "cookies" in this policy, we mean cookies, localStorage, and similar browser storage together. We list each type separately in the table below so you can see exactly what is stored, where, and for how long.

We group everything we set on your device into four categories: Essential, Functional, Analytics, and Advertising. The table below shows what each category contains, why we use it, how long it stays, and how you can opt out.

You will see immediately that the Advertising category is empty. That is deliberate. Gouna Realty does not run ad campaigns from the Platform itself, does not use retargeting pixels, and does not share usage data with advertising networks. If you came here from a paid ad on Meta or Google, the tracking happened on that platform — not here.

The full table is rendered below this section for accessibility and easy scanning on mobile. The same information is also exposed as machine-readable JSON-LD for screen readers, search engines, and AI assistants.

Plausible Analytics is a privacy-first analytics service that we use to measure aggregate site usage: how many people visit, which pages they read, where they come from, and how the site performs. We chose Plausible specifically because it does not need cookies to do its job.

Plausible identifies repeat visits without tracking individual users. It does this by hashing your IP address together with the User-Agent string and a daily-rotating salt. The result is a short anonymous identifier that lasts for the day. After 24 hours that identifier expires and cannot be reconstructed. Your raw IP is never stored, never logged, and never sent to any third party. No personal data leaves your browser in a form that can identify you.

The data Plausible collects is aggregate only: page views, referrer domain, country (derived from IP, then discarded), browser family, operating system family, and device type (mobile / tablet / desktop). It does not record city-level location, does not fingerprint your hardware, and does not follow you across other websites. It cannot be combined with personal data because there is no personal data to combine.

Plausible data is stored on servers in the European Union. Plausible Analytics BV is a GDPR data processor for the Platform. We have signed a Data Processing Agreement with Plausible that limits how the data may be used and requires deletion on request. You can request that your country-level visit data be excluded from our analytics at any time by emailing dpa@gounarealty.com — we will configure an exclusion within seven days.

The only piece of state Plausible leaves in your browser is a single localStorage entry called "plausible_ignore". This flag opts you out of being counted in Plausible's aggregate metrics on this device. It contains no personal data and is never sent to any server. You can also opt out via your browser's Do-Not-Track signal — see section 8.

Cloudflare Web Analytics is a second privacy-first analytics service we use as a redundancy layer and for edge-level performance measurement. Like Plausible, it does not set any cookies. Instead it uses a small JavaScript beacon that fires once per page load and reports aggregate metrics back to Cloudflare's edge network.

The beacon collects the page URL, the referrer, the page-load timing, and the country derived from the request IP. It does not collect your IP itself, does not fingerprint your browser, and does not link visits together across pages or sessions. Cloudflare's privacy commitment for Web Analytics is that no personal data is collected and no cookies are set — and the network traffic confirms this.

We use Cloudflare Web Analytics primarily to monitor Core Web Vitals (LCP, FID, CLS, INP) on real-user devices so we can detect performance regressions. The metrics are aggregated by route — for example, the average LCP for the /buy page across all visitors in the last 24 hours. Individual visitor performance is never visible to us.

Cloudflare is a GDPR data processor for the Platform under the Cloudflare Data Processing Addendum. Data is processed at the nearest edge location to your visit and is not retained beyond the aggregate metric.

When you log in to a Gouna Realty account — buyer dashboard, partner portal, or agency back-office — we use Supabase as our authentication provider. Supabase sets a small set of session cookies that keep you logged in across page navigations.

The primary cookie is the Supabase session token, which is a signed JWT (JSON Web Token). The cookie name follows the pattern "sb-<project-ref>-auth-token", where <project-ref> is the Supabase project reference for the deployment (for example sb-abc123def456-auth-token). This cookie is set with the HttpOnly flag (it cannot be read by JavaScript in your browser), the Secure flag (it is only sent over HTTPS), and SameSite=Lax (it is not sent with cross-site requests). These three flags together mean the cookie cannot be stolen by a malicious script and cannot be used for cross-site tracking.

The session cookie expires after 30 days of inactivity. If you log out, the cookie is deleted immediately. The JWT inside the cookie contains your user ID, the issuer, the expiry timestamp, and the role claim — nothing else. It does not contain your email, your password, or any property data.

Supabase is a GDPR data processor for the Platform. Data is stored in the European Union region. We have signed a Data Processing Agreement with Supabase that requires deletion of authentication records on account closure.

When you first visit the Platform, a consent banner appears at the bottom of the screen. You can accept analytics, decline analytics, or close the banner without choosing (which counts as decline, the privacy-safe default). Your decision is stored in localStorage under the key "gouna-realty:consent" so you do not see the banner on every visit.

You can revisit your choice at any time. Open this Cookies page and use the "Manage cookies" button below — that clears your stored decision and re-shows the banner on your next page load. You can also clear localStorage for gounarealty.com directly in your browser's developer tools, which has the same effect.

If you have not made a choice, Plausible and Cloudflare Web Analytics still run because they do not require consent under GDPR — they do not use cookies and do not process personal data. If you decline, both services stop firing their beacons immediately on this device. The decline persists until you change it.

Granular per-vendor control is on our roadmap for the next platform release. Until then, accept and decline apply to the full analytics group. Essential storage cannot be declined because the site will not function without it.

If you want to clear all stored data for the Platform — including the session cookie, the consent flag, and your saved properties — you can do this directly in your browser. The steps differ slightly per browser:

- **Chrome**: Settings → Privacy and security → Third-party cookies → See all site data and permissions → search for "gounarealty.com" → click the bin icon. - **Safari**: Settings → Privacy → Manage Website Data → search "gounarealty" → Remove. - **Firefox**: Settings → Privacy & Security → Cookies and Site Data → Manage Data → search "gounarealty" → Remove Selected. - **Edge**: Settings → Cookies and site permissions → Manage and delete cookies and site data → See all cookies and site data → search "gounarealty" → Delete.

Vendor documentation links: chrome.google.com/cookies, support.apple.com/safari-cookies, support.mozilla.org/firefox-cookies, support.microsoft.com/edge-cookies. Note that deleting site data will log you out and clear your saved properties — re-saving will require a new login.

We respect the Do-Not-Track (DNT) signal sent by your browser. If your browser sends DNT, both Plausible and Cloudflare Web Analytics are disabled automatically on this device — even before you reach the consent banner. You do not need to take any further action.

You can enable DNT in most browsers under Privacy settings. In Firefox: Settings → Privacy & Security → "Tell websites not to sell or share my data". In Safari: Settings → Privacy → "Prevent cross-site tracking". Chrome and Edge have largely deprecated DNT in favour of newer privacy controls, but we honour the legacy header if present.

If you use a privacy-focused browser such as Brave, Mullvad, or Tor — all of which block most trackers by default — you should not see any analytics activity from the Platform. We test the site regularly in these browsers to make sure the experience does not degrade.

We update this Cookies Policy whenever we change the storage or analytics we use. When we do, we update the "last updated" date at the top of this page and re-show the consent banner so you can reconfirm your choice. Significant changes — adding a new analytics service, switching providers, or expanding what we collect — are announced on the homepage banner and in the next Substack update.

We do not silently introduce new trackers. If you want to be notified by email when this policy changes, you can subscribe to gounarealty.substack.com — the privacy and policy category sends a notification per material update.

For questions about cookies, analytics, or any aspect of this policy, contact our data-protection team at dpa@gounarealty.com. We aim to respond within 72 hours during business days. If you are based in the European Union and are not satisfied with our response, you have the right to lodge a complaint with your national data-protection authority — for the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).