This policy covers the cookies and browser storage used on arbibase.com (the website) and app.arbibase.com (the app), both run by ArbiBase, LLC. It is effective October 12, 2026, and supplements our Privacy Policy.
We group what we use into four categories: strictly necessary, preferences, affiliate attribution, and third-party embeds. The tables below list each item by name. "Site" means arbibase.com and "App" means app.arbibase.com.
A cookie is a small text file that a website saves in your browser and reads back on later visits. A session cookie is deleted when you close the browser, while a persistent cookie lasts until its set expiry. Local storage works in a similar way, but it is never sent to our servers automatically, and it stays until you or the site delete it. We call items set by ArbiBase first-party. Items set by another company, such as Google, are third-party.
These items keep you signed in and make the forms and portals work. They don't need consent, and blocking them breaks sign-in.
| Name | Where | Purpose | Provider | Duration |
|---|---|---|---|---|
sb-…-auth-token | App | Keeps you signed in to your account. It may be split into numbered parts. | ArbiBase (Supabase Auth) | Up to 400 days, or until you close the browser if you didn't choose to stay signed in |
arb-remember | App | Remembers whether you asked to stay signed in | ArbiBase | 1 year, or session |
arb_portal | App | Sign-in session for the concierge client portal | ArbiBase | 30 days |
arb_owner_… | App | Sign-in session for a property owner's status page, one per property link | ArbiBase | 90 days |
arb_ref_… | App | Sign-in session for a referral partner's statement page | ArbiBase | 30 days |
cookie-consent (local storage) | Site | Saves your answer to the cookie banner | ArbiBase | Until you clear it or change it in Cookie settings |
ab-concierge-brief (local storage) | Site | Keeps your concierge brief, including your name, email and phone, so it survives the trip to Stripe Checkout and back | ArbiBase | Until you clear site data |
ab-careers-draft, ab-supply-app (local storage) | Site | Saves a draft of the careers or supply partner application so you don't lose it. Cleared when you submit. | ArbiBase | Until you submit or clear site data |
| Cloudflare Turnstile challenge | Site | Checks that a person, not a bot, is sending a form. Cloudflare may set or read a challenge token for security. It isn't used for tracking or advertising. | Cloudflare | The token expires after 5 minutes; any Cloudflare cookie lasts as Cloudflare's policy states |
Cloudflare Turnstile loads only on pages with a form that sends information to us, such as the waitlist, concierge, review, careers and email sign-up forms. It processes signals from your device and browser and your IP address to tell people from bots. See Cloudflare's privacy policy for details.
Payments take place on Stripe's own checkout pages, where Stripe sets its own cookies to process the payment and prevent fraud. See Stripe's privacy policy for details.
These items remember choices you make. They stay in your browser and aren't used to track you.
| Name | Where | Purpose | Provider | Duration |
|---|---|---|---|---|
theme, ab-theme (local storage) | Site, App | Light or dark mode | ArbiBase | Until you clear site data |
language (local storage) | Site, App | The language you picked | ArbiBase | Until you clear site data |
googtrans | Site, App | Tells Google Translate which language to show. Set only after you choose a language other than English. | ArbiBase (read by Google Translate) | Session |
arb_session_id | App | A random ID set when you open a property listing. It's used only for the listing's view count, is never linked to advertising, and isn't shared. | ArbiBase | 1 year |
Other ab-… and arbibase-… items (local storage) | App | Remember layout choices, such as collapsed panels, open tabs and dismissed notices | ArbiBase | Until you clear site data |
Referral partners earn a commission when someone they referred pays ArbiBase. To credit the right partner, we use PromoteBoost. Its script reads the referral code from a partner's link, for example ?ref=, and remembers it. When you check out, the code is attached to your payment.
| Name | Where | Purpose | Provider | Duration |
|---|---|---|---|---|
| PromoteBoost tracker cookies and storage | Site (after "Accept"), App | Remembers which partner referred you so the referral can be credited | PromoteBoost (third-party) | Set by PromoteBoost; see its policy |
arb_ref (local storage) | App | Keeps the referral code from a partner link until checkout | ArbiBase | Until you clear site data |
On arbibase.com, the PromoteBoost script loads only after you click "Accept". In the app, it likewise loads only after you click "Accept" in the app's banner (never on staff tools), so that a referral can be credited when you subscribe or buy. PromoteBoost is used only to credit referrals, never for advertising. If you reject, no referral is recorded through it.
| Service | Where | What it does | Cookies | When it loads |
|---|---|---|---|---|
| Google Maps and Places | Site, App | Suggests addresses as you type on the property submission and owner consent forms. Shows maps in the app. | Google may set cookies; see Google's policy | Site: only after "Accept". App: on pages with a map or address search. |
| Google Translate | Site, App | Translates the page into the language you pick. The page text is sent to Google. | Google may set its own cookies | Only after you choose a language other than English |
| Google Fonts | Site | Loads our typefaces. Google receives your IP address and browser details. | None set | Every page |
| Cloudflare Turnstile | Site | Bot and abuse protection on forms (see section 04) | May set or read a challenge token for security, not for tracking | Only on pages with a form |
| Supabase Storage | Site, App | Serves some images | None set | Pages with those images |
| Stripe Checkout, Cal.com | Their own sites | Payments; booking a call | Set on their sites under their policies | Only when you follow a link to them |
Sentry, our error monitoring service, runs in the app to report errors. It doesn't record sessions and isn't used to analyze how you use the app.
We don't use analytics cookies, advertising cookies, social media pixels, session recording tools or cross-site tracking. That means no Google Analytics, no Google Tag Manager and no Meta Pixel, on the website or in the app. We don't sell cookie data, and we don't share it for cross-context behavioral advertising. If we ever add analytics or advertising tools, we'll update this policy first and ask for your consent on the website before they load.
You can delete everything we've stored, and block it in future, from your browser:
- Chrome: Settings › Privacy and security › Third-party cookies › See all site data and permissions, then search for "arbibase" and delete.
- Safari (Mac): Settings › Privacy › Manage Website Data, then search for "arbibase" and remove. iPhone or iPad: Settings › Apps › Safari › Advanced › Website Data.
- Firefox: Settings › Privacy & Security › Cookies and Site Data › Manage Data.
- Edge: Settings › Privacy, search, and services › Cookies and site data › See all cookies and site data.
Clearing site data also clears local storage, which includes your theme, language, cookie choice and any saved form drafts. Clearing the app's cookies signs you out. Menu names change between browser versions, so check your browser's help pages if these steps don't match.
When we add, remove or change a cookie or storage item, we'll update this page and its effective date and add a line to the revision history. If we add a new optional item on the website, we'll ask for your consent again.