Privacy · Alaizyah Stays

This site is built to need as little information about you as possible. There are no accounts, no newsletter, no contact form and no advertising trackers.

What is collected

A first-party cookie holding a random identifier, used only to stop the same browser voting twice in one poll. It is not linked to a name, an email address, or an account.
A keyed, non-reversible hash of the requesting IP address, used for rate limiting and to record that a vote came from somewhere. The Alaizyah Stays application database does not persist raw visitor IP addresses.
Short-lived counters used to rate-limit voting and sign-in attempts.
Ordinary web server request logs, used for security and troubleshooting.

What is never collected

Visitors are not asked to create an account, or to provide a name, email address, phone number, or any other identifying profile information, in order to browse the site or to vote.
No payment card details are ever collected or stored. Support is sent through external services that we do not operate.
Visitor data is not sold or shared for advertising or marketing. Infrastructure providers may process request data for routing, security, abuse prevention and troubleshooting as described below.

Cookies

Two first-party cookies exist. Neither is used for advertising or disclosed to third parties for advertising or marketing:

alz_voter — a signed random identifier used to help prevent the same browser from voting twice in one poll. It contains no submitted name, email address, phone number, account information or other profile information.
alz_session — set only when an administrator signs in to the private admin area. Ordinary visitors never receive it.

Your light/dark preference is stored in your browser’s local storage and never sent to the server.

Analytics

No analytics are currently enabled. If that changes, it will be a privacy-conscious self-hosted tool that does not use cookies or build a profile of you. Google Analytics is not used.

How long any of this is kept

Retention periods below are the values this installation is actually configured with, and the pruning job that enforces them runs daily.

What	How long	Detail
Voter cookie (browser identifier)	180 days	A first-party cookie holding a random value. It expires on its own after this period; clearing your browser cookies removes it immediately.
Vote records	Kept as a poll result	The vote itself is retained so published results do not change after the fact. It is not linked to a name or an account at any point.
Browser and IP-derived identifiers attached to a vote	90 days	After this period the keyed hashes stored with a vote are irreversibly replaced, so the vote can no longer be associated with a browser or a network. The vote count is unaffected.
Rate-limiting counters	24 hours	Short-lived counters used to slow down repeated voting and sign-in attempts. They hold a keyed hash, never an address.
Administrator sessions	12 hours	Only created when an administrator signs in. Expired sessions are deleted, and changing a password deletes all of them immediately.
Staged CSV imports	1 day	An uploaded file awaiting confirmation in the admin area. Removed whether or not it is confirmed.
Web server request logs	Rolling buffer, capped at 50 MB	Container logs rotate automatically (five files of 10 MB). Older entries are discarded as new ones arrive rather than on a fixed schedule, and they are not archived anywhere else.
Administrative audit log	Retained indefinitely	The record of every financial and publishing action taken in the admin area. It is append-only and is deliberately never pruned — an audit trail that expires is not an audit trail. It contains no visitor data.

Children

This site is about a 13-year-old creator, and it is designed around protecting her. There is no direct messaging, no comment section, and no way for the public to contact Alaizyah directly. All contact goes to an adult-managed business inbox.

No last name, home address, school, hometown, phone number or private email appears anywhere on this site.
No live location, no live itinerary, and never a room number.
A stay is not published until after departure, and the destination stays hidden until an adult administrator separately clears it for publication.
The site does not ask visitors to create accounts or provide names, email addresses, phone numbers, or other identifying profile information in order to browse or vote.

This site is about a 13-year-old creator and is built around protecting her. It is not directed at children as an audience, and it does not ask any visitor — of any age — to provide a name, an email address, a phone number, or any other identifying profile information in order to browse or to vote. The technical records described above are what the site does keep, and they are described precisely rather than denied.

If you believe something has been published that should not have been, email [email protected] and it will be removed.

IP addresses

The Alaizyah Stays application database does not persist raw visitor IP addresses — it stores only a keyed, non-reversible hash. However, the site is served through Cloudflare and a Cloudflare Tunnel, and those infrastructure providers, together with reverse-proxy and web-server logs on the host, may process request IP addresses for routing, security, abuse prevention and troubleshooting. Cloudflare processes that data under its own privacy terms. We do not claim that raw IP addresses are never processed anywhere in the stack.

Security

Administrator sessions expire automatically, and changing a password revokes all of them. The database is not reachable from the internet; only this application can read it, and it has no network listener of its own.

Third parties

Video links point to YouTube, Instagram and TikTok. Nothing loads from those platforms until you click through, at which point their own privacy policies apply. Support options hand off to external payment services, which likewise have their own policies. See the disclosures page.

Contact

Privacy questions go to [email protected], an adult-managed inbox.