Cookie policy

This page explains every category of cookies and similar technologies (localStorage, session storage) used on onetapfly.com, what happens when you accept or reject them, and how to change your mind later. It is written to match exactly what the site actually does — if we add a new tracking tool, this page and the consent banner change first.

1. How consent works here

On your first visit we show a consent banner with three equally available actions: Accept all, Reject all and Configure. Until you choose, all non-essential storage is denied by default — we implement Google Consent Mode v2 with denied defaults, which means analytics and advertising tools receive no data before your consent. Your choice is stored in your browser and logged on our server (timestamp, your choices, and a salted hash of your IP address — never the raw IP) so we can demonstrate compliance.

You can change your choice at any time via the "Cookie settings" link in the footer of every page, which reopens this banner. You can also clear the site data in your browser, which has the same effect.

2. Categories we use

Necessary — always on

These keep the product functioning and cannot be switched off, because the service would break:

Name	Type	Purpose	Lifetime
otf-consent-v1	localStorage	Remembers your cookie choice so we don't ask on every page	Until you clear it (choice re-asked after 24 months)
Session/security cookies	Cookie	Checkout session integrity, rate-limit fairness, CSRF protection (arrive with checkout)	Session

Analytics — off until you allow it

Anonymous usage statistics: which pages are visited, which searches fail, where the funnel drops. We use this to fix real problems (for example, a confusing form field). No analytics script is loaded at all while this category is denied. As of the date above, no analytics tool is installed yet — the category exists so that when one arrives, it respects the choice you already made.

Advertising — three separate switches, off by default

If we run Google Ads campaigns, three distinct Consent Mode v2 signals matter, and we expose each of them honestly in the Configure view:

• Advertising storage (ad_storage) — cookies that measure whether an ad click led to a booking.
• Ad user data (ad_user_data) — sending conversion data (e.g. a hashed email) to the ad platform.
• Ad personalisation (ad_personalization) — letting the platform tailor ads to you (remarketing).

Rejecting all three means ads may still exist somewhere on the internet, but nothing on our site feeds them data about you. As of the date above, no advertising script is installed either; the switches are live plumbing, not decoration.

3. What we deliberately do not use

• No third-party cookie walls: rejecting everything keeps the full product usable.
• No fingerprinting, no session-replay recording of your keystrokes.
• No selling of personal data to data brokers — ever.
• No marketing email without a separate, unticked-by-default checkbox (and none exists yet).

4. Changing or withdrawing your choice

Your consent is as easy to withdraw as it was to give. Click "Cookie settings" in the footer of any page — the banner reopens, and a new choice applies immediately and is logged the same way. Clearing the site data for onetapfly.com in your browser (Settings → Privacy → Site data) also brings the banner back on the next visit. In any case, we re-ask for your choice after 24 months. Withdrawing consent does not affect the lawfulness of processing that happened while consent was active.

5. Cookies set by others in the booking chain

Payment authentication (3-D Secure) happens inside your bank's or the payment provider's embedded page and may set its own strictly-functional cookies during that step; they are governed by the provider's policy, are necessary to complete a payment you initiate, and we receive no tracking data from them. Airline websites you visit after booking (online check-in) have their own cookie policies entirely outside our control.

6. Contact and complaints

Questions about this policy: support@onetapfly.com. If you believe our use of cookies violates the law, you can complain to the UK Information Commissioner's Office or your local EU supervisory authority (in Spain, the AEPD) — but write to us first, we fix faster than regulators reply.

7. Updates

Any new cookie or tool appears in this table before it goes live, together with an updated banner where the law requires renewed consent. The "last updated" date above always tells you whether anything changed since your last visit.