casanumbersRoom by room. Everything clear.Room by room. Everything clear.
This policy describes essential cookies, optional website analytics and app usage sharing, including how to change your preferences.
Last updated:
casanumbers_session identifies a server-side login session. It is HttpOnly, Secure in production and SameSite=Lax. XSRF-TOKEN is readable by the application and helps protect authenticated changes against cross-site requests. Both follow the configured session lifetime (seven days by default); logout and revocation invalidate server access.
casanumbers_google_attempt links a Google sign-in attempt to the browser. It is HttpOnly, Secure in production, SameSite=Strict, restricted to /api/v1/auth and expires after ten minutes. Google Identity Services loads on sign-in screens, not on the public presentation pages.
casanumbers.locale stores your chosen language and casanumbers.organization stores the last selected portfolio in local storage. They remain until removed or replaced. The portfolio preference does not grant access: the server checks membership on requests.
Google sign-in and property location previews communicate with Google. After you choose Show Street View, our server sends the address to Google to find a nearby panorama; your browser then opens Google’s interactive embedded viewer. Google may process browser and network information under its own terms. CasaNumbers does not cache the panorama data or imagery. These optional maps and viewers are not embedded in the public website.
Use Analytics preferences in the website footer to accept or reject Google Analytics. The choice expires after 180 days. In the app, usage sharing is enabled by default and can be disabled in Settings for this browser. You can also remove cookies and site data in your browser; removing session cookies signs you out.
This list must be reviewed when integrations or storage behavior change. Contact the privacy/support address shown here for questions. See the Privacy Policy for processing purposes, recipients and rights.
Cloudflare Turnstile loads when you interact with the contact form to check for automated abuse. We configure it without pre-clearance. It is separate from the app’s login cookies and is not used here for advertising or analytics. If you block the verification script, email us directly.
After you accept, Google Analytics receives public page views and app-launch/contact-success events on casanumbers.com only. The host-only _ga and _ga_* cookies last up to 180 days. We store the consent choice in casanumbers.analytics.website.v1. Advertising features are disabled. Analytics does not receive form contents or authentication tokens.
Mixpanel receives predefined screen and action events only from app.casanumbers.com using EU ingestion. A random identifier in casanumbers.analytics.id.v1 links browser visits and is reset on logout/account changes. casanumbers.analytics.app.v1 stores the browser preference; casanumbers.analytics.notice.v1 remembers dismissal of the notice. These local storage entries persist until changed or removed. Opting out clears the identifier and stops future events. We disable recordings, automatic click capture and IP-based geolocation. Events are pseudonymous, not fully anonymous; the provider receives network information to deliver requests.
