Current cookie use
Cookie Policy
A clear inventory of the cookies Regi uses, why we use them, and whether they can be opted out.
Last updated: May 28, 2026
This page explains the cookies and similar browser storage used by Regi. We separate them by category so you can understand which cookies are required for the service and which, if any, are optional.
All cookies at a glance
| Cookie | Provider | Duration | Purpose |
|---|---|---|---|
| Essential cookies | |||
| regi_consent | Regi | Up to 1 year | Stores cookie consent choices. |
| regi_cookie_consent | Regi | Up to 1 year | Legacy consent cookie migrated to regi_consent. |
| __Host-authjs.csrf-token | Regi / Auth.js | Session | Protects sign-in flows against CSRF attacks. |
| __Secure-authjs.callback-url | Regi / Auth.js | Session | Stores the post-authentication return URL. |
| __Secure-authjs.session-token | Regi / Auth.js | Usually up to 30 days | Keeps authenticated users signed in securely. |
| lodging-checkin-session | Regi / iron-session | Up to 16 hours | Keeps a traveler check-in flow active. |
| Preferences cookies | |||
| regi:preferred-locale | Regi | Up to 1 year | Remembers the preferred website language. |
| regi:sidebar | Regi | Up to 1 year | Remembers whether the workspace sidebar is collapsed. |
| Analytics cookies | |||
| _ga | Google Analytics | Up to 2 years | Distinguishes users for aggregated analytics. |
| _ga_<measurement-id> | Google Analytics | Up to 2 years | Persists session state for a measurement property. |
| ar_debug | Google Analytics / Google | Short-lived | Supports Google Analytics debugging. |
| ph_<project-id>_posthog | PostHog | Up to 1 year | Product analytics: distinguishes devices and preserves the analytics identity. |
| Legacy or deprecated cookies | |||
| NEXT_LOCALE | Regi / next-intl | Session or configured duration | Deprecated language preference cookie. |
How language preference works
- When you visit a supported page without a language prefix, such as /blog, Regi chooses the best language from this cookie first, then from your browser language settings, then from Spanish as the fallback.
- When you manually change language with the language selector, Regi writes this cookie immediately and unconditionally. This is treated as a strictly necessary, functional cookie under GDPR: you have explicitly requested that the site honor your language choice, so the choice is recorded without a separate consent prompt. Ignoring an explicit UI action because you have not yet interacted with the cookie banner would silently break the feature.
- When Regi instead infers your language automatically from your browser (with no explicit selection), persisting that inferred value in this cookie is treated as a preference, and is only written if you accept preference cookies. Without consent, your language is still chosen correctly per request from your browser settings — it just is not remembered across visits.
- This cookie is used only to route you to the correct language version of a page and remember your language preference.
Cookies in detail
Essential cookies
Essential cookies are necessary for the website behavior users reasonably expect, or for functionality that is crucial to the service being requested — using the site securely, preserving authentication, remembering cookie choices, or completing an active check-in flow.
Can you opt out? No. These cookies are required for the site to function and to record your consent choices themselves.
- regi_consentStores the current cookie consent record — which optional categories you accepted — so the banner does not reappear on every page view. It also stores the consent policy version, so when the policy materially changes the banner reappears and you re-consent under the new terms.
- regi_cookie_consentLegacy name used by an earlier version of the consent banner. New consents are written to regi_consent. If you consented before the rename, this cookie may still exist until it is migrated or expires.
- __Host-authjs.csrf-tokenCSRF token issued by Auth.js to protect sign-in and sign-out requests against forged submissions. Set only when you visit an authenticated area of the site.
- __Secure-authjs.callback-urlStores the URL you should be returned to once the authentication flow finishes, so you are not dropped on a generic page after signing in.
- __Secure-authjs.session-tokenEncrypted session token used to keep an authenticated user signed in across requests. Large tokens may be split into numbered chunks (.0, .1) by the browser. Removing it logs you out.
- lodging-checkin-sessionEncrypted temporary cookie that holds the lodging, account, token, and session identifiers needed to complete a public traveler check-in. Created when you start a check-in flow and removed when it ends or expires (up to 16 hours).
Preferences cookies
Preference cookies enhance site functionality beyond what is strictly necessary, for example by remembering language settings or other user-selected options. Blocking them may reduce available functionality or degrade the quality of certain features. Consent required under GDPR: Yes.
Can you opt out? Yes. If disabled or deleted, Regi may infer your preferred language from your browser settings again.
- regi:preferred-localeRemembers the language you selected (or the best match inferred from your browser) so URLs without a language prefix can redirect to the correct language version on your next visit. It is written in two situations with different consent rules: (1) when you make an explicit choice in the language selector, it is written immediately as a strictly necessary functional cookie — your explicit action is treated as consent for the single value needed to honor it, in line with the GDPR "strictly necessary to fulfill a service the user explicitly requested" carve-out; (2) when Regi instead infers your language automatically from your browser, persisting that inference is treated as a preference and is only written if you accept preference cookies.
- regi:sidebarRemembers whether the workspace sidebar is collapsed.
Analytics cookies
Analytics cookies help us understand aggregate usage and improve the site. They are loaded through Google Analytics only after analytics consent is enabled.
Can you opt out? Yes. These are only loaded when analytics consent is granted, and you can withdraw consent at any time.
- _gaSet by Google Analytics to distinguish anonymous users so aggregated usage metrics can be reported. Only loaded after you grant analytics consent.
- _ga_<measurement-id>Persists session state for a specific Google Analytics 4 property. The placeholder is replaced with the actual measurement ID at runtime. Only loaded after you grant analytics consent.
- ar_debugShort-lived debug cookie that can appear when Google Analytics or related Google tooling is being debugged. Not used for tracking.
- ph_<project-id>_posthogProduct analytics: distinguishes devices and preserves the analytics identity.
Legacy or deprecated cookies
These cookies may remain in some browsers from earlier versions of the site. They are listed for transparency.
Can you opt out? Yes. They are no longer used by the current site behavior.
- NEXT_LOCALEPreviously used by the Next.js app (next-intl) to remember language preference. Regi now uses regi:preferred-locale instead, but this cookie may remain in some browsers from earlier versions of the site.
Managing cookies in your browser
You can delete these cookies through your browser settings. If you remove the language preference cookie, Regi may infer your preferred language again from your browser configuration the next time you visit a URL without a language prefix.