Cookie Policy

Effective Date: September 23, 2026

Short version: this website sets cookies from three sources and nothing else: Google Analytics, so we can see which pages and which of our sites people use; Microsoft Clarity, so we can see how pages are used (heatmaps and masked session replays); and the Meta Pixel, so we can see whether our Facebook and Instagram ads bring people to oldtownetf.com. All three are loaded by Google Tag Manager, a loader that sets no cookies of its own. If your browser sends a Global Privacy Control or Do Not Track signal, none of them is loaded, not even the loader, and nothing is set. When you send the reservation form, our own server also tells Meta about that one request (section 3), unless your browser sends one of those signals. No law that applies to a business of our size requires a click-through banner for this, which is why there is still no consent banner, and why this page is still short.

1. What a cookie policy usually lists

Most cookie policies sort cookies into four groups. Here is that list, honestly filled in for this site.

Strictly necessary cookies: none. There is no login, no basket and no booking session to carry between pages.
Functional cookies: none. The preferences this site remembers are described in section 2, and they are not cookies.
Analytics cookies: yes, from two services. Google Analytics 4 sets _ga and _ga_* (up to two years) so that repeat visits count as the same visitor, including a visit that starts on tfrooms.com and continues here. Microsoft Clarity sets _clck (one year) and _clsk (one day) to tell one visitor’s pages apart from another’s; Clarity does record sessions, with strict masking, and section 3 says exactly what it captures. Clarity’s collection servers on clarity.ms and bing.com may also set Microsoft’s own third-party cookies (MUID, CLID, ANONCHK, MR, SM; MUID for up to a year), which most browsers now block by default. Both services are loaded by Google Tag Manager, which sets no cookies itself. There is no Plausible and no Fathom on this site.
Advertising and marketing cookies: two, from one source. The Meta Pixel sets a first-party cookie called _fbp (and _fbc when you arrive through a link from Facebook or Instagram, an ad or otherwise) that lasts 90 days, so Meta can tell whether one of our ads led to this visit or to a reservation request, and so we can show a reminder ad to people who have visited this site. Section 3 says exactly what Meta receives and section 4 how to switch it off.

The cookies above are the only ones, all of them are switched off by the browser signals described in section 4, and no law that applies to a business of our size requires a click-through banner for them, so no consent banner interrupts the page.

2. What is stored on your device, and for how long

This site has an accessibility panel. If you change any of those settings, the choice is saved so the site does not reset itself on the next page. The eight tf- values below are held in your browser's local storage, not in a cookie, and are never transmitted to us or to anyone else. The items after them are real cookies, set by Google Analytics, Microsoft Clarity and the Meta Pixel, and those services read them (section 3).

tf-theme — light or dark appearance
tf-font-size — your chosen text size
tf-high-contrast — high contrast mode on or off
tf-reduce-motion — reduced motion on or off
tf-reading-guide — reading guide on or off
tf-link-highlight — link highlighting on or off
tf-pwa-dismissed-oldtownetf — set only if you dismiss the “Install this site as an app” offer, so it is not shown again
tf-office-v1: a copy of the office hours and holiday closures last read from tfrooms.com, so the office clock keeps working when that read fails; it holds nothing about you and is never sent anywhere
_ga and _ga_* — set by Google Analytics: a random visitor identifier and the current visit, kept for up to two years
_clck and _clsk — set by Microsoft Clarity: a random visitor identifier (one year) and the current session (one day)
_fbp — set by the Meta Pixel: a random browser identifier, kept for 90 days
_fbc — set by the Meta Pixel only when you arrive through a Facebook or Instagram link that carries a click identifier (fbclid): that identifier, kept for 90 days

Duration: the accessibility values have no expiry date, because no server sets one; each stays until you change the setting back or clear your browser's site data for this domain. The Google Analytics cookies expire two years after they were last refreshed, Clarity’s _clck after one year and _clsk after one day, and the two Meta cookies after 90 days; none of them is set at all when your browser sends the signals described in section 4. Clearing any of this costs you nothing except those preferences.

3. Third parties

Three third-party scripts run on this site, all of them loaded by Google Tag Manager (gtm.js from googletagmanager.com, a loader that sets no cookies and sends nothing about you on its own): Google Analytics (gtag.js), Microsoft Clarity (clarity.js from clarity.ms) and the Meta Pixel (fbevents.js from connect.facebook.net). The other scripts the pages load are our own, one for the site's behaviour and one small machine-readable helper for AI assistants. The office clock on these pages also reads the office hours and any holiday closures from tfrooms.com, our own site; that request carries no cookies.

Five third parties are worth naming:

Google (Analytics). When it loads, your browser tells Google LLC which page you viewed and when, how you got here, your IP address (which Google uses for a rough location and does not store), browser details and the _ga value. We use the reports to see which pages, sites and room types people look at and where visitors come from; Google uses the data under its privacy policy. Google Signals is off, so nothing here is joined to a Google account for advertising, and the reports are kept for 14 months. It also learns whether you tapped a phone number, a map link or a link to leave a review on the site (which link, nothing else).
Microsoft (Clarity). When it loads, after your first click, key press or scroll or three seconds after the page opens, your browser tells Microsoft Corporation which page you viewed and how you moved through it: clicks, scrolls, taps and cursor movement, screen size, browser details and your IP address. Microsoft builds heatmaps and session replays from that. Clarity’s strict masking is on, so all text on the page and anything you type into a form is replaced by placeholders before it leaves your browser: the replays show the layout and the movements, never the words, names, dates or signatures. Microsoft uses the data under its privacy statement and keeps recordings for 30 days (a small random sample, and any we mark as favourites, for up to nine months; heatmap and aggregate data longer); we use them to see where pages confuse people.
Meta (the pixel and the Conversions API). When the pixel loads, your browser tells Meta Platforms, Inc. which page you viewed and when, your IP address and browser details, and the _fbp value. When you tap a phone number on the site it also tells Meta you did (a “Contact” event, no number and no name), so we can count the calls our ads lead to. On the reservation page it also sends the dates, room type, number of guests and quoted total you chose. Whenever you send any form on this site (the reservation and guest-registration form, the waiting-list form, the contact chat or a repair request) it also sends a hashed (SHA-256) copy of the name, email address and phone number fields it recognises, and nothing else, so that Meta can match the request to an ad; the plain text never goes to Meta. When you send the reservation form, our server also sends Meta a copy of that one event directly, through Meta’s Conversions API, so that a request is counted even when an ad blocker or a browser’s tracking protection stopped the pixel. That copy says whether it was a reservation or a request, which page it came from, the dates, room type, number of guests and quoted total, your IP address and browser details, the _fbp and _fbc values when your browser holds them (or the Facebook click identifier in the page address), and a hashed (SHA-256) copy of your name, email address and phone number. Nothing else from the form goes with it: not your date of birth, address, emergency contact, employer, notes or signature, and never your name, email address or phone number in plain text. The browser and the server give the event the same number, so Meta counts your request once. Meta uses this under its privacy policy and, for residents of the US states whose privacy laws it supports, under its Limited Data Use terms, which we switch on. We get back only counts, never who you are. To opt out, see section 4, or turn off ad personalisation in your Facebook or Instagram settings.
Our web host. The site is hosted on Netlify, which keeps ordinary server logs in order to serve the pages and block abuse. Those are logs, not cookies. Our privacy policy covers them.
The contact form. Submitting a form sends what you typed to us through our host's form service. It does not place a cookie on your browser. For the reservation form, our server then passes Meta only the summary and hashed details described under Meta above. The reservation form also carries the _fbp and _fbc values and the page address to our host so our server can pass them on; they are kept with your request.

If you follow a link from this site to somewhere else, such as a map or a review page, that destination sets its own cookies under its own policy, which we do not control.

4. Do Not Track and Global Privacy Control

If your browser sends a Do Not Track header or a Global Privacy Control signal, we honour it: Google Tag Manager is not loaded, so neither Google Analytics, Microsoft Clarity nor the Meta Pixel is, none of the cookies in section 2 is set, and nothing about your visit reaches Google, Microsoft or Meta: the reservation form is then sent without the mark that lets our server pass it to Meta, so the server copy described in section 3 is not sent either. That is the opt-out. We never sell personal information, and the pixel, with that server copy of a reservation request, is the only sense in which we share any for advertising. Most browsers offer both signals in their privacy settings. A content blocker stops the pixel but not the server copy; only a Global Privacy Control or Do Not Track signal stops both.

5. Managing this yourself

Every browser can block or delete cookies and clear stored site data, usually under privacy or site settings. You can also simply switch any accessibility preference back to its default.

6. Changes and contact

If what this site stores or loads changes again, this page will be updated before that happens rather than afterwards, and the effective date above will change with it. The last change added the server copy of a reservation request that goes to Meta (section 3), started counting taps on links to leave a review, and made the office clock read the office hours from tfrooms.com, our own site, keeping a copy in your browser (sections 2 and 3).

Questions about this policy: newleafmotels@gmail.com or (208) 733-2010. See also our privacy policy and terms of service.