Privacy

• Your account: your full name, your email address and your password (the password is kept only as a one-way digest). In your account you may add a phone number, your language and currency, and your favourite hotels.
• If you sign in with Google: the name, email address, profile picture address and Google account ID Google sends us are kept with your account's sign-in records. We never see your Google password, and we do not show your profile picture on the site.
• Your bookings: the guest's name, email address, optional phone number and special requests; the dates, the number of guests and, because they set the price, the children's ages. If you ask for an invoice, your invoice details: name or company name, Turkish ID or tax number, tax office and address.
• Payments: when you pay by card you type your card details on the bank's own secure payment page; your card number never reaches HotelTut and is never stored. We keep the masked number the bank returns (first six and last four digits), the amount, the transaction numbers and the result. When you pay at the property, the property takes the payment.
• Messages and reviews: what you write to the property, the agency or the HotelTut team about a booking, and the reviews you write after your stay. Your review shows your first name and the initial of your last name ("Ayşe K."); an anonymous review shows no name. Messages do not accept card numbers, and reviews are checked for contact details and links.
• Technical information: HotelTut's own database tables do not keep your IP address. The sign-in system (Supabase Auth) records a connection address and browser details for each sign-in and session, and Cloudflare, which hosts the site, keeps technical records of requests. To limit abuse, a visitor key is derived from your IP address with a secret key; without that secret key it cannot be turned back into your IP address, and it is kept with booking attempts and partner applications.
• Activity counts: for lines such as "viewed today" on hotel pages, each visit is counted by a one-way digest that belongs to that day. The filters chosen in searches are counted the same way.

• To make your booking, pass it to the property or agency, and send you emails about it.
• To open your account, protect your sign-in and remember your preferences.
• To limit abuse: it is how we cap the attempts one network can make per minute and the rooms that can be held without signing in.
• To keep the accounting and tax records of paid bookings.
• We do not use your information for advertising or profiling. The site has no third-party advertising or visitor analytics tools; listings labelled “Ad” are shown on HotelTut's own pages by the place you search, never chosen for you.

• The property or agency you book with: once the booking is confirmed, it sees the guest's name, email, phone, special requests, the dates, the number of guests and the children's ages. It never sees a booking that is not yet confirmed (apart from a sale an agency entered itself), or your invoice details.
• The HotelTut team: may see bookings, messages and accounts for support and oversight.
• The bank: for a card payment the bank is sent the amount and a transaction number; you type your card details on the bank's page yourself.
• Resend: the emails HotelTut sends (for example account confirmation and password reset) are delivered through Resend; your email address and the email's content pass through Resend.
• Supabase: our database, sign-in system and files are at Supabase, on servers in Frankfurt (Germany, EU).
• Cloudflare: hosts the site and answers every request; the per-minute attempt limits are counted at Cloudflare too.
• Google: if you sign in with Google, Google knows you signed in to HotelTut. While you browse without signing in, the pages offer Google's account chooser; for that your browser loads Google's code and connects to Google.
• Maps: map images come to your browser from OpenFreeMap; in that connection your IP address is visible to OpenFreeMap.

• For a booking that expires unpaid, the guest's name, email, phone, special requests, the children's ages and the visitor key are deleted 30 days after it expired.
• Notifications in your account are deleted after 90 days.
• The text of a message the HotelTut team removed is kept 30 days for support only, then deleted.
• Activity digests are deleted the next day, and daily totals after 90 days.
• Records of paid bookings are not deleted automatically. Even when you delete your account, your name and invoice details on those bookings are kept for 10 years from the end of the year of the last payment; your phone, special requests and the children's ages are deleted.
• Your account and preferences are kept until you delete them.

The site uses no advertising or tracking cookies. These are the cookies it sets:

• Those starting sb-: your session once you sign in, and a security check during sign-up.
• booky.theme: your light or dark appearance, for a year.
• booky.currency: the currency prices are shown in, for a year.
• booky.recentFilters: the last four filters you used in a search, for hotels, tours and transfers separately; offered again under "Recently used", kept on this device alone, for 90 days.
• NEXT_LOCALE: the site's language, until you close your browser.
• __Host-booky.google-nonce: a random value that protects signing in with Google. It is set on the pages that offer Google's button or account chooser while you are signed out, stays valid for 30 more minutes each time, and is deleted when you sign in with Google.
• When Google's button and account chooser load, Google uses its own cookies on its own domain; those are subject to Google's privacy policy.

• You can correct your name, phone, language and currency in your account.
• You can delete your account from the Security section of your account (Delete my account); you will be asked for your password again. If you have an upcoming stay, a payment in progress or an open case, the account cannot be deleted yet, and the page says why.
• To delete an account you opened with Google that has no password, first set one with "Forgot password" on the sign-in page. For 24 hours after a password is set or changed, the account cannot be deleted.
• You can turn off review invitations and service reminders in your account or from the link in the email; the other emails about your booking are always sent.
• For any question or request about your information: info@hoteltut.com