Cookie Policy

Name	Purpose	Duration	Required?
wn_session	Authentication Identifies you across pages. httpOnly, secure, SameSite=Lax. Required for the service to work.	30 days (rolling)	Yes
wn_country	Country preference Remembers your country selection so we can show you content for the right country.	365 days	No
wn_theme	Theme preference Remembers your light/dark mode preference.	365 days	No
wn_dismissed_banner	Dismissed notices Tracks which non-essential notices (e.g., cookie banner, newsletter popup) you have dismissed.	30 days	No
Plausible cookies	Aggregated analytics We use Plausible Analytics for aggregated, cookieless page-view analytics. No personal data, no cross-site tracking, GDPR-compliant by design.	None — Plausible is cookieless	No

Partner	Cookie(s)	Duration	Privacy policy
Booking.com	Various (e.g., sid, bbsource, bbtp)	30 days after click	View ↗
Agoda	Various	Up to 30 days	View ↗
Klook	klook_aff	30 days	View ↗
GetYourGuide	gyg_aff	30 days	View ↗
Tiket	Various	7-30 days	View ↗
Traveloka	Various	30 days	View ↗
World Nomads	Various	30 days	View ↗
Airalo	airalo_aff	30 days	View ↗
iVisa	Various	30 days	View ↗

1. What is a cookie?

A cookie is a small text file that a website asks your browser to store, then sends back to the website on subsequent visits. Cookies are used for authentication, preferences, analytics, and advertising. Similar technologies include localStorage (browser-side key-value store), sessionStorage (cleared when the tab closes), pixels (invisible images that track views), and device fingerprinting. We use cookies and localStorage for the purposes below.

2. Cookies we use

The table below lists every cookie we set, and every cookie set by third parties when you use our service. We try to keep this list complete — if you find a cookie we missed, please email [email protected].

3. Affiliate cookies

When you click a link to a booking partner (Booking.com, Agoda, Klook, etc.), the partner sets cookies on your browser to track conversions. If you complete a booking within the cookie window, we may earn a commission. These cookies are set by the affiliate partner, not by us. We do not control their cookie behavior. We do require all partners to comply with applicable cookie law (ePrivacy Directive in the EU, GDPR consent rules, CCPA opt-out rights). See our [Affiliate Disclosure](/affiliate-disclosure) for full details.

4. How to control cookies

Browser controls. All modern browsers let you block or delete cookies. Look for "Privacy" or "Cookies" in your browser settings. - Chrome: chrome://settings/cookies - Firefox: Preferences → Privacy & Security → Cookies and Site Data - Safari: Preferences → Privacy → Manage Website Data - Edge: Settings → Cookies and site permissions "Do Not Track." We honor the Global Privacy Control (GPC) and Do Not Track (DNT) signals when they are enabled in your browser. When we detect GPC/DNT, we treat it as a binding opt-out of any non-essential cookies and data sales under CCPA/CPRA. Third-party opt-outs. For advertising cookies specifically: - Your Ad Choices: https://youradchoices.com - Network Advertising Initiative: https://optout.networkadvertising.org - Digital Advertising Alliance: https://digitaladvertisingalliance.org/choices Note: We do not run advertising or use advertising cookies. These opt-outs are not relevant to our site, but they are useful on sites that do.

5. Cookies and the GDPR

Under the GDPR (and the ePrivacy Directive), cookies that are not strictly necessary require your prior, specific, informed, and freely-given consent. We comply: - Strictly necessary cookies (wn_session) are set without consent because they are required for the service you requested. - Preference cookies (wn_country, wn_theme, wn_dismissed_banner) are set without consent because they enhance your experience of a service you have explicitly requested, and they do not involve third parties. - Analytics cookies are not used. Our analytics (Plausible) is cookieless. - Affiliate cookies are set only after you click a partner link. We display a clear disclosure at the click point so you can choose not to click. If you are in the EU/UK and want to exercise your right to withdraw consent at any time, clear your browser cookies or use the Global Privacy Control signal.

6. Cookies and CCPA/CPRA (California)

California residents have the right to opt out of the "sale" of personal information and the "sharing" of personal information for cross-context behavioral advertising. We do not sell or share personal information for advertising, so this is largely moot for our site. For affiliate cookies, we provide notice at the link level so you can choose not to click. We also honor the Global Privacy Control signal as a binding opt-out under CCPA/CPRA Regulations § 7025.

7. Cookies and Singapore PDPA

Under the Singapore Personal Data Protection Act (PDPA), cookies that store personal data require notification and, in some cases, consent. We comply: - We notify you about the cookies we use on this page. - Strictly necessary and preference cookies are set without explicit consent. - Affiliate cookies are set only after you click a partner link. You can opt out of any non-essential cookies by clearing your browser cookies or using the controls described above.

8. Do Not Sell or Share My Personal Information

Although we do not sell or share personal information as those terms are defined under CCPA/CPRA, you may still submit a "Do Not Sell or Share" request via the email below, and we will honor it as a binding opt-out. Email: [email protected] (subject: "Do Not Sell or Share")

9. Changes to this Cookie Policy

We may update this Cookie Policy from time to time. Material changes will be announced on our blog and via email to account holders at least 30 days before they take effect. The "Last updated" date at the top reflects the current version.

10. Contact

Privacy questions: [email protected] Postal mail: See our [Imprint](/imprint).

First-party cookies (set by us)

Third-party cookies (affiliate partners)