Cookie policy
Version 2.1 · Last updated on October 5, 2026
This document has not been translated yet. The Dutch text is the binding version.
Statistics through Google Analytics are only on if you allow them. You can change your choice at any time.
This cookie policy describes which cookies and similar techniques Huurmarkt uses, what they are for and how long they are kept. It forms part of our privacy policy.
This is a translation of the Dutch original. In the event of any discrepancy, the Dutch version prevails.
In short
Huurmarkt places functional cookies: they are needed to make the platform work, and we do not ask for consent for them. For statistics we use Google Analytics, but only if you consent to it. We ask you first, in a small notice. Without your "yes", Google Analytics does not load and nothing is sent to Google Analytics.
We place no advertising cookies and no social network cookies, and we do not share data with advertising networks. In two places, a service we embed does place a cookie itself: Google on the sign-in page, and Cal.com on the page for businesses — the latter only once you open the calendar yourself.
Which cookies we place
Always — even without an account
| Cookie | Purpose | Retention |
|---|---|---|
NEXT_LOCALE | Remembers your language choice (Dutch or English) so you do not have to set it every time. | Session — cleared when you close your browser |
When you use a particular feature
| Cookie | Purpose | Retention |
|---|---|---|
__Host-hm-cookiekeuze | Remembers whether you allow or reject statistics through Google Analytics, and on which date you chose. That way we do not ask you again on every visit. We remember a "no" as well. | 12 months |
__Host-hm-crashrapporten | Remembers that you switched off crash reports from the website (see below). Only present if you switched them off; switching them back on removes it. | 12 months |
huurmarkt:search:page-size | Remembers how many results per page you want to see on the search page. | 1 year |
verify-return | During an identity check with Didit, remembers which page to take you back to afterwards. | 15 minutes |
Only when you are signed in
| Cookie | Purpose | Retention |
|---|---|---|
access-token | Keeps you signed in while you use the Platform. | Short-lived, refreshed automatically |
refresh-token | Renews your session so you do not have to sign in repeatedly. | Until you sign out or the session expires |
identity-id | Links the session refresh to the correct account. | Until you sign out or the session expires |
These three are strictly necessary: without them you cannot stay signed in. They are cleared as soon as you sign out.
Placed by services we embed
In two places, a service we embed places a cookie itself. This only happens where that service is shown:
| Cookie | From | When | Purpose | Retention |
|---|---|---|---|---|
g_state | On the sign-in page, because the "Continue with Google" button is there — also if you then sign in with your email address. | Google uses it to remember the state of that button, for example whether you dismissed it. | 6 months | |
__cf_bm | Cal.com | Only on the page for businesses, and only after you choose "Open calendar" yourself. | Protects the calendar against automated visitors (bots). | 30 minutes |
__Secure-next-auth.csrf-token and __Secure-next-auth.callback-url | Cal.com | Same. | Needed to make the calendar work and keep it secure. | Session — cleared when you close your browser |
Cal.com also uses your browser's local storage and a service worker in its own window, and loads profile pictures via Google.
Only with your consent: statistics through Google Analytics
We use Google Analytics (from Google, through Firebase) only if you consent to it. Before anything happens, we ask you in a small notice with two buttons of the same size: "Reject" and "Accept". If you choose nothing or reject, Google Analytics does not load, places nothing on your device and nothing is sent to Google Analytics. We then only remember your choice (__Host-hm-cookiekeuze, see above). Huurmarkt simply keeps working.
If you consent, Google Analytics measures which pages you view and what you do on Huurmarkt, for example searching, saving a listing or requesting a booking. If you are signed in, this is linked to your account. From the address of a page we first remove anything that says something about you, such as a booking number, a user number or an invitation code. Some events do include an internal number of a booking, conversation or listing, for example when you request a booking, send a message or view a listing. A search is sent with the search term as you typed it, unless it looks like an email address, phone number or postcode. On the page of an invitation we do not measure at all. Google signals and ad personalisation are switched off. More about what happens to the data is in our privacy policy.
Google Analytics then places:
| Cookie or storage | From | Purpose | Retention |
|---|---|---|---|
_ga | Google Analytics | Tells visitors apart, using a random number. | 2 years |
_ga_<id> | Google Analytics | Keeps track of your visit (session). <id> is the number of our measurement. | 2 years |
firebase-installations-database and firebase-heartbeat-database (IndexedDB, storage in your browser) | Firebase (Google) | An installation number from Firebase, and which version of the Firebase software ran on which day. | Until you withdraw your consent or clear your browser data |
Changing or withdrawing your choice is always possible, just as easily as giving consent, through "Cookie settings". That button is at the top of this page, in your profile, on the sign-in page (if you are not signed in) and in the website footer. If you are signed in, you can also use the "Analytics" switch under Profile → Privacy & Sharing. If you withdraw your consent, measuring stops immediately, in your other tabs as well, and we remove the Google Analytics cookies and storage from your device.
Crash reports from the website
If something goes wrong on the website, we send an error report to Error Reporting from Google Cloud, so that we can fix the error. For this we place no cookie and use no storage in your browser: the report goes from your browser to our own server, and only that server passes it on to Google Cloud Error Reporting. Your browser does not talk to Google for this. We remove email addresses, phone numbers and codes from it; your account and your IP address are not included.
Crash reports are on by default, on the basis of our legitimate interest in a website that works; we do not ask for consent for this. You switch them off with the "Crash reports" switch in the notice under "Customise", through "Cookie settings", or if you are signed in under Profile → Privacy & Sharing. Only if you switch them off do we remember that, in __Host-hm-crashrapporten (see above); it does not change your choice about Google Analytics. What exactly is included and how long Google keeps it is in our privacy policy.
Similar techniques
Besides cookies we use your browser's storage (localStorage and sessionStorage). That is not a cookie, but it works similarly and we list it for completeness. This storage stays on your device; we do not read it on our servers. What is in sessionStorage disappears when you close the tab.
| Key | Type | Purpose |
|---|---|---|
hm.session.lastRefreshAt | local | Records when your session was last refreshed, so we do not do it more often than needed. |
huurmarkt:location-search-history | local | The places you searched for most recently, so you can pick them again quickly. |
huurmarkt:<page>:view-mode (for example huurmarkt:search:view-mode) | local | Whether you want to see listings as a list or a grid. |
huurmarkt.app-banner-dismissed | local | That you dismissed the "download the app" bar. |
huurmarkt.akkoord.wachtrij* | local | An acceptance of terms that still has to reach our server, if sending it briefly failed. |
huurmarkt.checkout.booking-id | local | Which booking you are paying for, so we know which one it was after the payment page. |
huurmarkt.push_priming_shown:* | local | That we already asked whether you want to turn on notifications, so we do not ask again. One per account; * is your account number. |
hm-cookiekeuze-signaal | local | A signal to your other tabs that your choice about Google Analytics changed. Removed immediately, and only used in browsers that cannot send that signal another way. |
huurmarkt:apply-booking-draft:* | session | What you already filled in for a booking request. |
huurmarkt.apply-response.pending.* | session | A reply to a home listing that still has to be sent. |
huurmarkt.contact-challenges.v1 | session | An ongoing check of a new email address or phone number, so you can still enter the code after checking your mail. At most 15 minutes. |
payout-setup:ingediend-op | session | That you have just submitted your payout details. |
hm-wizard-sessie | session | A random number for our own measurement of creating a listing: which step you reached, without name, account or listing. |
hm-instellen-naam:* | session | Your first and last name as you entered them while setting up your account, so the bank account step doesn't have to ask for them again. |
mapbox.eventData* | local | Placed by Mapbox, the mapping service we use to show search results on a map. |
We also do the same own measurement of creating a listing in the app: as on the website, without asking for your consent and without name, account or listing in what we record, and with a random number that is only kept in the app's memory and is not stored on your device. The IP address and time of the request do end up in our hosting provider's log; more about that in our privacy policy.
The Mapbox data is processed by Mapbox as an external service provider. See the Mapbox privacy policy for their processing.
External services
While you use the Platform, data is exchanged with a limited number of external parties:
- Our hosting and storage providers, to serve the website and show listing photos.
- Mapbox, to display maps and locations.
- Stripe, when paying for a booking. Stripe may place its own cookies on the payment page; see the Stripe privacy policy.
- Google and Apple, when you sign in with your Google or Apple account. The sign-in page loads the Google and Apple buttons; Google places the
g_statecookie (see above). See the Google privacy policy and the Apple privacy policy. - Cal.com, when you schedule an introduction on the page for businesses. The calendar only loads after you choose "Open calendar". Cal.com sends its own error reports to its provider Sentry in the United States, and loads images via Google; see the Cal.com privacy policy.
- Google Analytics (through Firebase), only if you consent to it; see above.
- Google Cloud Error Reporting, for crash reports from the website. This goes through our own server, not through your browser; see above.
Refusing or deleting cookies
You reject statistics through Google Analytics in the notice, or turn it off later through "Cookie settings". You can also delete or block cookies at any time through your browser settings. Note that the Platform may then not work properly: without the necessary cookies you cannot stay signed in, and so cannot book or rent out.
Changes
If we later add cookies that are not strictly necessary, we will ask for your consent in advance and update this policy. If a new purpose is added, we will ask for your choice again.
Questions
Questions about this cookie policy? Contact us through the help centre or by email at info@huurmarkt.nl. Our company details are in the privacy policy.