Musterlist
Cookie Policy
Last updated 27 October 2026
A cookie is a small file a website leaves in your browser. Musterlist uses only the cookies it needs to work: to keep you signed in, to protect forms, and to remember that a device has already typed a charter's code. We use no analytics, advertising or tracking cookies, and no one else's cookies on our own pages. Because every cookie we set is strictly necessary, the law does not ask for your consent, and we show no cookie banner.
The cookies we set
| Cookie | What it is for | How long |
|---|---|---|
proposals_session |
Your session: keeps you signed in from page to page, and remembers short-lived things such as a form's errors. Set on every visit, signed in or not. | 120 minutes after your last action |
XSRF-TOKEN |
Protects forms against requests forged by other websites. | Same as the session |
remember_web_… |
Only if you tick Remember me when you sign in, or open Musterlist from inside CYA: keeps you signed in on that browser. | Until you sign out, or 400 days |
ml_sheet_…ml_recipient_… |
On a guest's preference sheet, or a guest list shared with a yacht's crew: remembers that this device typed the charter's code, so it is not asked again. It holds a signature, not the code. | 30 days |
Our cookies are encrypted or signed, and sent only over secure connections
[SESSION_SECURE_COOKIE on in production, to be confirmed]. Except XSRF-TOKEN, which our own
pages must read to protect their forms, scripts on the page cannot read them.
Other things kept in your browser
Some screens remember a choice in your browser's own storage instead of a cookie. It never leaves your device and is never sent to us:
- The map style you picked on a shared itinerary, and whether you have seen the itinerary builder's welcome.
- The app's language and layout settings.
- In the Channel Manager app, a copy of the app's styles, scripts and images, so it opens fast on a phone. Never a page or a booking.
Other companies
Some pages load maps from Mapbox; parts of the signed-in app and shared itineraries load fonts or code from public content networks [Google Fonts, jsDelivr, cdnjs, jQuery, Lordicon, DataTables]. Your browser then connects to them and they see its IP address, but they set no cookies through Musterlist that track you. [We plan to serve these files from our own servers; until then, this list is kept up to date.]
Payments happen on Stripe's own pages, under Stripe's cookie policy.
Your choices
You can block or delete cookies in your browser's settings. If you block ours, you will not be able to sign in or open a guest sheet, because they are what makes those work.
Changes
If we ever add a cookie that is not strictly necessary, we will ask for your consent first and update this page. Questions: contact us. See also our Privacy Policy.