Cookies

A cookie is a small piece of text your browser keeps for a website and hands back on your next visit. This page names every cookie that ends up in your browser because of STRatus Stays, says what it is for, and says how long it lasts.

There are six. Four are ours, and three of those four are what being signed in is made of. The other two are Stripe's, and they appear only if you start connecting a bank account.

There is no session table behind this portal: being signed in lives entirely in the first cookie below. The last of the four is a convenience, and everything works without it.

• authjs.session-tokenRequired

  Over HTTPS: __Secure-authjs.session-token

  Keeps you signed in. It carries a signed token holding your account id and your role and nothing else, and every page reads it to know who is asking.

  How long it lasts: Thirty days, or until you sign out.

• authjs.csrf-tokenRequired

  Over HTTPS: __Host-authjs.csrf-token

  Stops another website from submitting our sign-in form as you.

  How long it lasts: Until you close the browser.

• authjs.callback-urlRequired

  Over HTTPS: __Secure-authjs.callback-url

  Remembers the page you were trying to reach, so signing in returns you there instead of the front door.

  How long it lasts: Until you close the browser.

• stratus.propertyOptional

  Remembers which property you were last looking at, so Financials and the rest open where you left off. It holds a property id and nothing else, scripts on the page cannot read it, and we check it against what you are allowed to see every time - a copied or edited one cannot widen your access.

  How long it lasts: One year.

Connecting a bank account loads Stripe's own script into the page, because those details go straight to Stripe and never touch our servers. That script sets two cookies of its own.

• __stripe_midOptional

  Stripe's. Tells a returning device from a new one, which is how Stripe spots fraud.

  How long it lasts: One year.

• __stripe_sidOptional

  Stripe's. Groups the actions of a single visit while you are connecting an account.

  How long it lasts: Thirty minutes.

They are Stripe's, not ours, and we never read them. No other screen in the portal loads that script, so if you have never started connecting an account you will not have them. Stripe's cookie notice.

No advertising cookies. Nothing that follows you to another website. No social-media pixels. Nothing here is sold or shared.

No analytics either, and we mean the specific thing: this application contains no Google Analytics, no Google Tag Manager, no Plausible, no Fathom, no Segment, no Mixpanel, no PostHog, no Hotjar, and no product-analytics tool under any other name. There is no analytics code in it waiting to be switched on.

If that ever changes, this page changes first.

Every browser lets you see, clear and block cookies for a site, and you can do that here whenever you like. We show no consent banner, because none of these is a cookie you could decline and still use the portal, and a banner asking about cookies you cannot refuse is theatre.

Blocking them has consequences worth knowing. Without authjs.session-token we cannot sign you in at all. Without stratus.property the portal simply opens on your first property every time.

This notice is version 2026-10-06.v1. Questions about it, or about anything on it, go to info@stratus-stays.com.