1. What are cookies?
Cookies are small text files placed on your device when you visit a website. We also use similar technologies such as local storage, pixels, and software development kits (SDKs) in our mobile apps. These help the Services work, keep you signed in, remember your preferences, and understand how the Services are used.
2. Types of cookies we use
- Strictly necessary. Required for the Services to function — for example, signing you in and keeping your session secure (via our third-party identity provider), load-balancing, fraud prevention, and remembering items such as your saved-homes shortlist. These cannot be switched off in our systems.
- Functional / preferences. Remember choices you make, such as search filters, units (feet/metres), theme, and recently viewed listings, to give you a more personalized experience.
- Analytics / performance. Help us understand how visitors use the Services (pages viewed, performance, errors) so we can improve them. This data is aggregated and used to operate and enhance the Services.
- Marketing. Let Google and Meta measure whether our ads led to your visit or enquiry, and show our ads to people who visited Summitly. These tags load only after you allow Marketing cookies, and never when your browser sends Global Privacy Control unless you choose otherwise.
We do not sell your personal information. Analytics and Marketing tags load only after you allow them; until then we use Google Consent Mode with every signal set to “denied”.
3. Third-party cookies
Some cookies are set by third parties that provide functionality on our behalf — for example our authentication/identity provider, mapping provider, and analytics provider. These providers process data under their own privacy policies. AI features (including Zara) may rely on third-party AI providers; see our Privacy Policy for details on how that data is handled.
Every vendor we use
Each company whose code or cookies run on Summitly, what it does, its category in your choices, the cookies or storage it uses, and how long they last.
| Vendor | What it does | Category | Cookies or storage | How long |
|---|---|---|---|---|
| Summitly (us) | Remember your cookie choice, saved homes and searches, and reading settings on this device. | Necessary | Browser storage: summitly.consent.v1, summitly.consent.device, saved-homes and saved-search lists, reading tools | Until you clear them in your browser |
| Clerk privacy policy (opens in a new tab) | Sign-in and keeping your session secure. | Necessary | __session, __client_uat, __client (on clerk.summitly.ca) | __session about 1 minute (renewed while you use the site); the others until you sign out, at most 1 year |
| Stripe privacy policy (opens in a new tab) | Card payments and fraud prevention, on checkout pages only. | Necessary | __stripe_mid, __stripe_sid | __stripe_mid 1 year; __stripe_sid 30 minutes |
| Vercel privacy policy (opens in a new tab) | Hosting, and anonymous page-speed measurements (Speed Insights). | Necessary | No cookies | Not applicable |
| Mapbox privacy policy (opens in a new tab) | Map search and listing maps. | Necessary | No cookies; browser storage for an anonymous map-session count | Until you clear it |
| Google Maps Platform privacy policy (opens in a new tab) | Address suggestions and property maps. | Necessary | No cookies on summitly.ca | Not applicable |
| Google Analytics 4 privacy policy (opens in a new tab) | Count visits and find slow or broken pages. Page addresses and titles that could identify a home are blanked out first. | Analytics | _ga, _ga_<id> | 2 years |
| Google Ads privacy policy (opens in a new tab) | Measure whether our Google ads led to an enquiry, and show our ads to past visitors. Uses a hashed email or phone (enhanced conversions) when you send a form. | Marketing | _gcl_au; Google's own ad cookies on google.com and doubleclick.net | _gcl_au 90 days; Google's cookies up to 13 months |
| Meta Pixel (Facebook, Instagram) privacy policy (opens in a new tab) | Measure whether our Meta ads led to an enquiry, and show our ads to past visitors. | Marketing | _fbp, _fbc; Meta's own cookies on facebook.com | _fbp and _fbc 90 days; Meta's cookies up to 1 year |
| Meta Conversions API privacy policy (opens in a new tab) | The same ad measurement, sent from our server: the event, a hashed email or phone, _fbp/_fbc, your IP address and browser type. Never the listings you view, prices or finances. | Marketing | No cookies of its own | Kept by Meta under its terms |
4. How long cookies last
Session cookies are deleted when you close your browser. Persistent cookies remain for a set period or until you delete them, so we can recognize you on return visits and remember your preferences.
5. Managing cookies
Most browsers let you view, block, or delete cookies through their settings, and mobile devices let you reset or limit advertising identifiers. Because strictly-necessary cookies are required for sign-in and security, blocking all cookies may prevent parts of the Services — such as logging in or saving homes — from working. Where required by law, we will ask for your consent before setting non-essential cookies.
6. Changes & contact
We may update this Cookie Policy from time to time; the "Last updated" date reflects the latest version. Questions? Use our privacy request form or call (905) 553-8500.
Version history
- Added the Marketing category for ads (Google Ads, Meta), Google Consent Mode, and a list of every vendor with what it does and how long it keeps data.
- Questions now go through our contact page or by phone instead of email.
- Added a plain-words summary.
- Described cookie types and how to control them.
