Privacy policy

What we do not collect

• No accounts, so no names, emails or passwords for readers.
• No advertising or cross-site tracking cookies.
• No third-party analytics that profile you across the web.
• No raw IP addresses stored against anything you do.

Because we set no tracking cookies, there is no consent banner. That is the point of not setting them.

What we do collect

Page counts

We keep a daily count of how many times each page was viewed. It is a single number per page per day, with nothing attached to it — no visitor identifier, no session, no device information. We use it to decide which hotels to re-research first.

Traveller submissions

When you submit a hotel confirmation we store what you typed, plus two things you did not:

• A salted hash of your IP address. Not the address itself. It exists only so one source cannot flood the moderation queue. Rotating the salt anonymises every historic submission, and we cannot reverse it to recover an address.
• Your browser’s user-agent string, used to identify automated abuse.

The hash and the user-agent string are erased from the record automatically after 60 days; what you wrote stays, without them. This covers the one-tap “Is this still right?” confirmation too, which is a submission with two answers instead of a form.

We do not ask for your name or email, and there is no field to give them. Submissions are published as anonymous traveller reports or not at all.

Listing reports

The “Something wrong with this listing?” form on a hotel page stores the kind of problem you chose and any words you typed, with the same salted IP hash and user-agent as a traveller submission and for the same reason: to stop one source flooding the queue. It has no name or email field either, which also means we cannot write back to you.

Suggested hotels

“Suggest a hotel we are missing” stores the name, city, website and any note you typed, with the same salted IP hash and user-agent (erased after 60 days) for the same reason. There is no name or email field, so we cannot write back.

Saved on your own device

“My trip”, its packing list ticks, “Recently viewed”, the answer you give about your kettle’s label, and what each hotel on your trip said the last time you looked (used to tell you what has changed) are kept in your browser’s local storage, on your device. They are never sent to us and we cannot see them; clearing your browser’s site data removes them. A trip link you share contains only the hotels’ names in URL form, and anyone who opens it sees exactly that plan.

Server logs

Our web server keeps standard access logs, including IP addresses, for security and debugging. They rotate automatically and are not linked to anything else.

What we send elsewhere

Nothing about you. The site loads no third-party fonts, scripts, or embeds — every asset comes from roombrew.com. Links out to hotel websites are ordinary links; we do not pass anything about you along with them.

Advertising

RoomBrew currently carries no advertising. Nothing below is active today — it describes what will be true if and when that changes, stated now so there is a real policy to read before the first ad ever loads rather than one written after.

If we turn on display advertising, it will run through Google AdSense. That means Google becomes a separate, independent processor of certain data from your visit — not something RoomBrew collects and hands over, but something Google’s own ad-serving systems handle directly. Serving and measuring ads this way typically involves:

• Cookies or similar local storage set by Google, not by RoomBrew.
• Signals like your approximate location, device and browser type, and the pages you view, used to select and measure ads.
• Where you have not limited ad personalisation, your activity across other sites and apps that also use Google’s ad services.

For visitors in the EEA, the UK and Switzerland, Google requires publishers to gather consent through a consent management platform (CMP) certified against the IAB Europe Transparency & Consent Framework before any personalised ad is served. We would use Google’s own certified CMP for this, not a homemade banner — the same rule that keeps this site simple today (real controls, not a cookie notice for its own sake) would still apply. You would see that consent prompt on your first visit after ads go live, be able to decline ad personalisation while still seeing (non-personalised) ads, and be able to change your choice later from a link this page would then carry.

Google explains what its own ad products collect and how in How Google uses information from sites and apps that use our services and Google Ads Settings, where you can review or turn off ad personalisation across every Google-served ad, on any site, independent of anything we do here.

Your rights

Since we hold no identifiable information about readers, there is generally nothing to request or erase. If you submitted a hotel report and want it removed, contact us with enough detail to identify it and we will delete it.

Changes

If this policy changes materially we will say so on the page rather than updating it quietly.