Cookie Policy

A cookie is a small file a site stores in your browser. We also use two related browser features — local storage and session storage — which work the same way from a privacy point of view, so they are covered here too.

These cannot be turned off without breaking the site.

• Session cookie (authjs.session-token) — keeps you signed in. Set when you sign in, cleared when you sign out. HttpOnly, so no script on the page can read it.
• CSRF token (authjs.csrf-token) — proves a sign-in or sign-out request genuinely came from our site, and not from another site acting in your name.
• Callback URL (authjs.callback-url) — remembers which page to return you to after signing in.

One preference is a cookie because the server needs it to render the page correctly the first time:

• Language (openlet_locale) — whether you chose English, Sinhala or Tamil. It is sent with each request so the page arrives already in your language rather than flickering from English. It holds a two-letter code and nothing else, is not used to identify you, and lasts a year. If you have not set one we read your browser's own language preference instead, and store nothing.

The rest are stored in your browser's local storage rather than sent to us with each request. Clearing your browser data removes them.

• Theme — whether you chose light or dark mode.
• Display currency — the currency listing prices are converted into for display. Prices are always in LKR underneath.
• Listing drafts — a half-finished listing is kept on your own device so a dropped connection doesn't lose it. Drafts are scoped to your account and wiped when you sign out.

We use Clicky to count visits and see which pages are used. It records the page, the referring site, an approximate country and the browser type. It is not linked to your Openlet account, is not used to build a profile of you, and is not shared with any advertising network. It runs on the live site only — not on development or preview builds.

Map tiles, Street View imagery and address autocomplete are served by Google, which may set its own cookies when a map loads. If you sign in with Google, Google sets its own cookies during that exchange. Payment pages are served by PayHere or Stripe under their own cookie policies. We do not control those, and we do not embed any advertising or social-media tracking script.

Every browser lets you view and delete cookies and site data, usually under Settings → Privacy. Blocking the strictly necessary cookies above will prevent you from signing in. What we do with the data behind them is described in the Privacy Policy.