Cookie Policy

A cookie is a small file a site stores in your browser. We also use two related browser features — local storage and session storage — which work the same way from a privacy point of view, so they are covered here too.

These cannot be turned off without breaking the site.

• Session cookie (authjs.session-token) — keeps you signed in. Set when you sign in, cleared when you sign out. HttpOnly, so no script on the page can read it.
• CSRF token (authjs.csrf-token) — proves a sign-in or sign-out request genuinely came from our site, and not from another site acting in your name.
• Callback URL (authjs.callback-url) — remembers which page to return you to after signing in.

One preference is a cookie because the server needs it to render the page correctly the first time:

• Language (openlet_locale) — whether you chose English, Sinhala or Tamil. It is sent with each request so the page arrives already in your language rather than flickering from English. It holds a two-letter code and nothing else, is not used to identify you, and lasts a year. If you have not set one we read your browser's own language preference instead, and store nothing.

The rest are stored in your browser's local storage rather than sent to us with each request. Clearing your browser data removes them.

• Theme — whether you chose light or dark mode.
• Display currency — the currency listing prices are converted into for display. Prices are always in LKR underneath.
• Listing drafts — a half-finished listing is kept on your own device so a dropped connection doesn't lose it. Drafts are scoped to your account and wiped when you sign out.

We use Clicky to count visits and see which pages are used. It records the page, the referring site, an approximate country and the browser type. It is not linked to your Openlet account, is not used to build a profile of you, and is not passed to the advertising described in the next section. It runs on the live site only — not on development or preview builds.

We show adverts from Google AdSense in three places: between the results on a search page, on a listing page beside and below the property, and once on the home page. Each one is labelled Advertisement. They are how the site pays for itself; they are not endorsements, and no advertiser can buy a place in our search ranking.

Serving an advert means Google receives the page you are looking at, your IP address and your browser type, and it may set or read cookies on googlesyndication.com and doubleclick.net. Those cookies cap how often you are shown the same advert, count clicks, and detect click fraud; depending on your Google settings they may also personalise which advert you see. We never send Google your name, your email address, your account, or anything you have typed into an enquiry or a listing.

You can turn personalised advertising off — here and on every other site — at myadcenter.google.com. You will still see adverts; they simply stop being based on your activity. Blocking third-party cookies in your browser has the same effect and breaks nothing else on Openlet.

Map tiles, Street View imagery and address autocomplete are served by Google, which may set its own cookies when a map loads. If you sign in with Google, Google sets its own cookies during that exchange. Payment pages are served by PayHere or Stripe under their own cookie policies. Google's advertising script is covered in section 5. We do not control any of these, and we embed no social-media tracking script at all — there is no Facebook pixel, no TikTok pixel and no share widget that reports back.

Every browser lets you view and delete cookies and site data, usually under Settings → Privacy. Blocking the strictly necessary cookies above will prevent you from signing in. What we do with the data behind them is described in the Privacy Policy.