The short version
We use a small number of cookies to sign you in and keep the sign-in secure — without these the site cannot work. We store your preferences and unsaved drafts in your own browser, where they never reach us. And we use Google Analytics to understand how the site is used. Everything is listed below by name.
1.What this policy covers
Cookies are small text files a website stores in your browser. Websites also use closely related technologies that this policy covers too: local storage and session storage, which hold data in your browser without sending it to a server; service worker caches, which store pages for offline use; and push subscriptions, which let us send notifications.
This policy forms part of our Privacy Policy and should be read with it and with our Terms of Service.
2.Strictly necessary cookies
These make the Service work. They cannot be switched off from within the site — blocking them in your browser will stop you signing in.
| Name | Purpose | Lifetime |
|---|---|---|
| next-auth.session-token | Keeps you signed in as you move between pages. Set to HttpOnly so scripts cannot read it, and to Secure in production. | Up to 30 days |
| next-auth.csrf-token | Protects sign-in and other form submissions against cross-site request forgery. | Session |
| next-auth.callback-url | Remembers where to return you after sign-in. | Session |
| oc_draft_token | Lets you come back to an itinerary you started planning before signing in. It is a credential for that draft — which holds your dates, budget and party details — so it is HttpOnly and not readable by scripts. | 30 days |
We do not use cookies to build an advertising profile of you, and we run no advertising network on the Service.
3.Browser storage we use
These live in your browser’s local or session storage. They are not transmitted to our servers — they exist so the Service remembers what you were doing. Clearing site data removes them.
| Key | What it holds |
|---|---|
| oc_chat_messages | Your recent SerendAI conversation, so it survives a page reload. |
| oc_chat_trip_context | Trip details you gave the assistant — destination, dates, budget, party. |
| oc_saved_responses | Assistant answers you chose to save. |
| oc_anon_traveller_profile | Preferences the assistant inferred while you were signed out. Stays in your browser unless you sign in. |
| oc_budget_tracker | Your trip budget and spending entries. |
| oc_embassy_country | Your country, so we can show the right embassy contact details. |
| oc_tts | Whether you have read-aloud switched on. |
| oc_trip_gen_count | How many AI itineraries you have generated, for fair-use limits. |
| oc_ai_refine_* | Hands an itinerary from the assistant to the planner when you continue editing it. |
| oc_inspiration_seed | Carries places found in a screenshot or pasted text across to the trip planner. |
| crew-guidelines-seen | Remembers that you have read the crew guidelines, so we stop showing them. |
| loc_tip_seen | Remembers that you have seen the location-permission tip. |
| Packing and checklist keys | Which packing-list items you have ticked off. |
On a shared or public computer, sign out and clear site data when you finish. Some of these keys hold trip details you may not want the next person to read.
4.Analytics
We use Google Analytics 4 in production to understand which pages are used, how people move through the Service, and where it is slow or broken. It sets cookies beginning _ga — typically _ga and _ga_<container id> — which last up to two years and identify a browser rather than a person by name.
Google acts as our processor for this data, and also processes it for its own purposes under its own privacy policy. Data is processed outside Sri Lanka. IP addresses are handled by Google’s collection infrastructure as described in its documentation.
Separately, we record a small number of our own product events — whether a prompt was shown or a button clicked — against your account where you are signed in, so we can tell whether a feature actually helps. These are stored on our own servers, not with a third party.
To opt out of Google Analytics across every site, install the Google Analytics opt-out browser add-on, or block analytics cookies in your browser as described in section 8.
5.Third-party technologies
Some features load content from third parties, which may set their own cookies or receive your IP address as a necessary part of delivering the content:
- Google Sign-In — only if you choose to sign in with Google.
- Google Maps and Places — where a map, place details or photograph is shown.
- Map tile providers — the background imagery in our maps.
- Our payment processor — on the checkout page, for payment and fraud prevention.
- Google Fonts and content delivery networks — for fonts and static assets.
These parties are governed by their own cookie and privacy policies. We embed no advertising or social-media tracking pixels.
5.1 Our assistant embedded on partner sites
Where a partner embeds SerendAI on their own website, our storage is confined to that embedded frame and is separate from the partner’s own cookies. The partner’s cookie policy governs the rest of their site.
6.Service worker and offline caching
OneCeylon is installable as an app and works partly offline. To do that, a service worker stores pages, images, map assets and emergency audio in a browser cache so they are available without a connection — useful when you are somewhere with no signal and need an emergency phrase or a downloaded itinerary.
This cache sits in your browser and is not sent to us. It is cleared when you uninstall the app, clear site data, or unregister the service worker in your browser’s developer settings.
7.Push notifications
If you allow notifications, your browser creates a push subscription — an endpoint address issued by your browser vendor’s push service, plus encryption keys — and we store it so we can send you booking updates and alerts. It does not identify you by name and carries no message content until we send one.
Revoke it at any time in your browser or device site settings, or from your notification preferences. We delete a subscription once the push service tells us it is no longer valid.
8.How to control all of this
8.1 In the Service
Sign out to end your session cookie. Manage notification preferences in your settings. Clear your SerendAI conversation from within the assistant. Revoke location permission in your browser at any time.
8.2 In your browser
- Chrome — Settings › Privacy and security › Third-party cookies, and Site settings for per-site data.
- Safari — Settings › Privacy, and Safari › Advanced › Website Data on iOS.
- Firefox — Settings › Privacy & Security › Cookies and Site Data.
- Edge — Settings › Cookies and site permissions.
Most browsers also offer a private or incognito window, which discards everything when you close it.
8.3 What breaks if you block them
- Blocking strictly necessary cookies makes sign-in impossible.
- Blocking local storage loses your preferences, budget entries and unsaved drafts on every reload.
- Blocking the service worker disables offline use and installation.
- Blocking analytics changes nothing about how the Service works for you.
9.Do Not Track
Browsers may send a Do Not Track or Global Privacy Control signal. There is no settled standard for how a site must respond, and we do not currently change our behaviour based on either signal. We will say so here if that changes. You can still control everything on this page directly.
10.Legal basis
Under the Personal Data Protection Act, No. 9 of 2022, cookies that are strictly necessary to deliver a service you asked for are used on the basis of performing our contract with you. Preference storage rests on the same basis or on your consent. Analytics rests on our legitimate interest in understanding and improving the Service, and on your consent where the law of your own country requires it.
Visitors from the European Economic Area and the United Kingdom have the additional rights described in our Privacy Policy.
11.Changes
We will update this policy when we add, remove or change a cookie or storage technology, and update the effective date at the top. Where a change materially affects your privacy, we will give notice in the Service.
12.Contact
- Controller
- OneCeylon (Private) Limited (PV-00260243)
- Privacy questions
- privacy@oneceylon.space
- Data protection contact
- privacy@oneceylon.space
- Online
- oneceylon.space/contact
See also our Privacy Policy and Terms of Service.