What is this Policy?
This Cookie Policy ("Policy") explains how Yatra For Fun Pvt. Ltd. ("Yatra", "we", or "us") uses cookies, local-storage entries, session-storage entries, IndexedDB rows, pixels, and similar device identifiers (together, "Cookies") on yatraforfun.com, dashboard.yatraforfun.com, our mobile and progressive-web applications, and any Yatra API served to a browser.
It forms part of our Privacy Policy and our Terms of Service, and is drafted under the Individual Privacy Act, 2075 (2018), the Individual Privacy Regulations, 2077 (2020), and Section 47 of the Electronic Transactions Act, 2063 (2006). Nothing in this Policy reduces the rights you hold under Nepali law or under the non-waivable privacy rules of a destination country.
What is a cookie?
A cookie is a small text file that a website places on your device the first time you visit. On each subsequent visit, your browser sends the cookie back to the same website so the site can recognise you, keep your session alive, remember your preferences, or measure which features you use.
Cookies set by yatraforfun.com itself are called first-party cookies; cookies set by a third-party domain loaded inside a Yatra page (for example, a payment-gateway checkout or a font provider) are called third-party cookies.
Yatra also uses local storage, session storage, and IndexedDB for similar purposes. Those are not literally cookies, but they operate in a functionally identical way, so this Policy treats them all together.
The categories of storage we use
Yatra does not currently show a cookie-consent banner. Instead we keep non-essential storage to a minimum, honour browser opt-out signals for our own analytics (see "Managing your choices"), and list below everything the site stores. Advertising cookies are set by Google AdSense, not by Yatra.
1. Strictly necessary
- Sign-in. When you sign in, your access token, refresh token and basic profile are kept in your browser's local storage until you sign out.
- Booking flow. The flight, hotel, activity, vehicle or apartment you selected and your search details are kept in session storage so the checkout pages can read them. They are cleared when you close the tab.
- Security. Cloudflare, which sits in front of the site, may set a short-lived bot-management cookie.
2. Functional
- Theme choice (light or dark), in local storage.
- Unsent form drafts for dummy tickets, dummy hotel bookings and dummy itineraries, in local storage, so you don't lose your typing. They are deleted when the order is placed.
- Whether you have already seen the WhatsApp button prompt (session storage).
3. First-party analytics
Yatra runs its own analytics. Nothing is sent to a third-party analytics company. We record page views, clicks (including repeated "rage" clicks and clicks that do nothing), scroll depth, quick returns to the previous page and JavaScript errors, linked to a random device ID. On blog pages we also record page views, scroll depth and outbound clicks. These records are not combined with your identity unless you are signed in. Form fields such as passwords, payment data and passport numbers are not captured.
4. Advertising (Google AdSense)
Many pages show ads served by Google AdSense. Google and its partners may set or read cookies and device identifiers to serve, measure and, where allowed, personalise ads. Ads are not shown on sign-in, account, checkout or payment pages, or on our own dummy-document product pages. Google's use of this data is governed by Google's advertising policies.
Storage inventory
The storage entries the Services set in the current release. Lifespans are maximums; clearing site data removes all of them.
| Name | Type | Category | Purpose | Lifespan |
|---|---|---|---|---|
accessToken, refreshToken, user | Local storage | Strictly necessary | Keeps you signed in. | Until you sign out |
Booking-flow keys (for example selectedHotel, bookingResponse) | Session storage | Strictly necessary | Carries your selection through checkout. | Until the tab closes |
__cf_bm | Cookie (Cloudflare) | Strictly necessary | Bot management and security. | 30 minutes |
yatra-theme | Local storage | Functional | Light or dark theme. | Until cleared |
| Dummy-product form drafts | Local storage | Functional | Saves an unfinished order form. | Until the order is placed or cleared |
yatraWhatsAppFabSeen | Session storage | Functional | Stops the WhatsApp prompt repeating. | Until the tab closes |
yatra.va.device | Local storage | Analytics | Random device ID for first-party analytics. | Until cleared |
yatra.va.session | Session storage | Analytics | Groups one visit's events. | Until the tab closes |
yat_v | Cookie | Analytics | Random visitor ID for blog analytics. | 1 year |
yat_s | Cookie | Analytics | Blog analytics session ID. | Browser session |
Google ad cookies (for example __gads, __gpi) | Third-party cookies (Google) | Advertising | Serving, measuring and limiting repeat ads. | Per Google's policy (up to about 13 months) |
Payment gateways (eSewa, Khalti, ConnectIPS, FonePay, PayPal) set their own cookies on their own sites when you are sent there to pay. If you find storage on yatraforfun.com that is not listed here, please report it to support@yatraforfun.com with subject "Undocumented cookie".
Third parties
These companies receive data from the Services. Only Cloudflare, Google AdSense and the payment gateways interact with your browser; the rest are called from our servers.
- Cloudflare — CDN, DDoS protection and bot management in front of every Yatra hostname. Cloudflare privacy notice.
- Google AdSense — display advertising. Google privacy policy.
- eSewa, Khalti, ConnectIPS, FonePay and PayPal — payments, on their own checkout pages.
- Sparrow SMS — SMS delivery.
- Nepal Fillings — WhatsApp messages and some e-mail, sent through its WhatsApp gateway.
- SMTP e-mail provider — transactional e-mail.
- Anthropic — the Claude API for the AI itinerary builder.
- Agoda and Amadeus — hotel and flight inventory, server-to-server.
We do not embed social-network widgets. Our share links are plain links that load the other site only when you click them.
No sale of personal data
Yatra does not sell personal data or pass the contents of our booking database to data brokers. Google AdSense, described above, may use cookies to show ads, including personalised ads; you can control that in Google's ad settings.
Where Yatra shares booking data with an airline, a hotel, a visa consulate, or a payment gateway, it is because the sharing is necessary to deliver the specific service you have asked for. Our Privacy Policy lists every sharing category.
Managing your choices
Our own analytics
If your browser sends a Do Not Track or Global Privacy Control (GPC) signal, our first-party analytics do not run at all.
Google ads
You can turn off personalised ads from Google at adssettings.google.com. You will still see ads, but they will not be based on your browsing.
Browser-level controls
Every modern browser lets you block cookies, clear site data, or browse in a private window. Help articles:
If you block local storage entirely, you may not be able to stay signed in or complete checkout.
Children
You must be at least eighteen (18) to create an account, as our Terms of Service require. Children travelling on a parent's booking are covered by the parent's account. If you believe a child has used the Services without adult supervision, write to support@yatraforfun.com.
Changes to this Policy
We update this Policy when we add or remove storage. The Last updated date at the top of the page reflects the most recent revision.
Contact
Questions, corrections, or undocumented-cookie reports:
- E-mail: support@yatraforfun.com — subject "Cookie question".
- Postal: Yatra For Fun Pvt. Ltd., Koteshwor-32, Kathmandu, Nepal.
- Support phone: +977 970-8072952.
- Hours: Sun–Fri, 09:00–19:00 (NPT) · Sat on-call for emergencies.