As little tracking as possible.

The HttpOnly, Secure, SameSite=Lax cookie __Host-anotherpillow_session connects your account to its authorised hotels. Password login lasts up to 12 hours, or 30 days if you choose Keep me signed in. Email-verification sessions last up to seven days. Signing out removes the cookie; resetting your password revokes existing sessions.

• Strictly necessary authentication
• Not available to page scripts
• No advertising purpose

Password login and recovery requests are protected by same-origin checks, honeypots and rate limits. Cloudflare Turnstile can add a visible browser challenge when enabled. We store salted password hashes, never readable passwords. Verification and recovery links expire after 15 minutes. The __Host-anotherpillow_password_reset cookie lasts up to 15 minutes and only authorises choosing a new password, not access to hotel data.

• Verified email before password access
• Single-use recovery links
• Server-side request limits

When Cloudflare Turnstile is enabled, its browser challenge helps protect sign-in and account creation. It is not an advertising service. Our application is hosted on World Wide Wood AB’s own DigitalOcean server.

• Only when enabled
• Purpose: abuse prevention
• No advertising purpose

The start flow uses sessionStorage for a one-way fingerprint and random attempt identifiers to prevent duplicate submissions. Your submitted website, email and setup choices are also held temporarily in that tab while the preparation page creates your account. This handoff is valid for ten minutes and is cleared after successful setup or when the tab closes.

• Safe retries
• No browsing history
• Tab-local setup handoff

Inside an authorised hotel workspace, the current AI conversation may remain in sessionStorage so a refresh does not immediately erase the work. It is limited to that browser tab and is removed when the tab is closed or storage is cleared.

• Private workspace only
• Current conversation
• Do not enter card data or unnecessary guest data

Choose Allow analytics to let Google Analytics 4 measure visits and registration/contact-link clicks on reviewed public marketing pages. It never runs in sign-in, registration, setup previews, hotel workspaces or guest booking pages. We send public page paths and a small set of approved campaign labels, not form values, account details or private URLs. Google receives network and browser information needed to process a visit. Advertising signals, personalised advertising and automatic form/link measurement are disabled.

• Provider: Google Ireland Limited
• Cookies: _ga and _ga_Q1MTMBG5L6, up to 180 days
• No Google tag or analytics requests before you agree

Use Cookie settings in the footer of any public marketing page to allow or turn off analytics. Turning it off stops the tag and removes its cookies in this browser; it does not undo visits already processed. Only necessary is as easy to choose as Allow analytics. The localStorage item ap.analytics-consent.v1 remembers your choice for 180 days and is used only to respect that choice. If storage is unavailable, analytics stays off.

• Reject without losing access
• Withdraw at any time
• No TikTok or advertising pixel installed