Cookies & Local Storage

Why there is no consent banner

Maltese law implementing the EU ePrivacy Directive requires your consent before a website stores information on your device — unless that storage is strictly necessary to provide the service you have asked for.

Everything this site stores falls into that exception: the two cookies below, which let you hear the audio you bought and the free stops you chose; and in your browser, what you bought so you are not asked to pay twice, where you had got to on the walk, your language and speed preferences, and a cached copy of what you have opened so the guide keeps working underground and out of signal. There is no analytics, advertising or tracking storage of any kind, which is what a consent banner exists to ask about.

That is our reading of the rules and the reason you are not being interrupted by a banner. If you would rather nothing at all were stored, using a private browsing window achieves that, at the cost of the guide forgetting you between visits.

Cookies this site sets

Both are first-party, sent only to this site, and used for nothing but deciding which recordings your browser may play. Neither identifies you or follows you to other sites.

• mag_audio — set when you buy a tour, restore a purchase or open a guest pass. It holds which tours you have access to and when that access ends, signed so it cannot be altered. It lasts up to a year, or until a guest pass ends.
• mag_free — set the first time you play a stop of a tour you have not bought. It holds which stops you chose to hear free, so the three free stops stay three, signed so it cannot be altered. It lasts a year.

What is stored in your browser

All of this lives in your browser and is readable only by this site, on this device.

• Purchases — which tours have been unlocked. Without it, paid audio would lock again on every visit.
• Free stops — which stops you chose to hear free, so the guide can show it.
• Progress — which stops you have listened to, and where to resume.
• Preferences — narration language, playback speed and pause length.
• Offline cache — the app, downloaded audio and bounded city maps. These support offline walking inside each saved city; online map tiles are separate.
• A sign-in token, only if you have signed in to restore a purchase. It identifies you to our own restore endpoint and to nothing else, and signing out removes it.

Third parties

Stripe sets its own cookies on its own checkout pages when you pay. That happens on Stripe’s domain, under Stripe’s policies, and only if you begin a purchase.

Map tiles are requested directly from OpenFreeMap and OpenStreetMap. They do not set cookies here, but they do see your IP address, as any server does when your browser asks it for a file.

How to remove everything

The About page has a control that clears your progress, and one that clears every cache and stored value and reloads the site from scratch. You can also clear site data for this domain in your browser settings, which has the same effect.