What cookies are
Cookies are small text files that a website stores on your device through your browser. On every subsequent request the browser sends the cookie back, so the site can “remember” something — for example that you are already logged in.
Alongside cookies there are other local storage technologies, such as localStorage. These are not sent to the server automatically, but they do remain on your device — which is why we describe them here too.
Cookies may be first-party (set by the site you are visiting) or third-party (set by another organisation, usually for advertising or measurement). home.gr currently uses first-party cookies only.
What we use today
The table below describes every cookie the platform sets today. All of them are strictly necessary: without them, logging in to your account does not work.
| Name | Purpose | Duration |
|---|---|---|
| homegr_session Strictly necessary | Session cookie. It holds the signed token (JWT) that keeps you logged in to your account, so you do not have to enter your password on every page. It is httpOnly — not readable by JavaScript — and is transmitted over HTTPS in production. |
30 days from your last login; deleted when you sign out |
| homegr_oauth_state Strictly necessary | A temporary security cookie used when signing in with a third-party account (e.g. Google). It protects against cross-site request forgery (CSRF) by confirming that the response coming back from the provider corresponds to the request you started. | 10 minutes; deleted as soon as sign-in completes |
| homegr_oloklirosi Strictly necessary | Temporary, only while you sign up with Google or Apple. It keeps what the provider sent us (which provider, identifier, email, whether the email was verified, name), together with the page language and the page you will return to, until you accept the Terms of Use. It is signed so that it cannot be altered. Without it no account is created. It cannot be read by JavaScript (httpOnly). |
15 minutes. Deleted as soon as the account is created or you press “Cancel”. |
| homegr_mfa Strictly necessary | A temporary two-factor cookie. It is set only if you sign in with a third-party account (e.g. Google) and have two-factor authentication enabled: it holds the signed challenge from the moment you return from the provider until you enter the six-digit code. It is httpOnly. It is not a session and it does not open your account. When you sign in with email and password it is not set at all. |
5 minutes; deleted as soon as verification completes or is rejected |
| homegr.dg.lang Local storage | Not a cookie but a localStorage key. It stores the language you chose (el or en) so the site opens in your language. It is never sent to the server. |
Remains until you clear your browser data |
Local storage
Beyond cookies, the site stores data on your device, in three areas controlled by your browser. Unlike cookies, they are not sent along with every request to the server:
localStorage— persists after you close your browser, until you clear site data.sessionStorage— deleted the moment you close the tab.IndexedDB— a browser database. Note: it is not removed by “delete cookies”; it needs a “site data” clear (see section 05).
The table below lists every key the platform writes today. Not all of them exist for every visitor: most are created only if you take the matching action, and the second column says which.
| Key | When it is written & what it holds | Duration | Personal data? |
|---|---|---|---|
| homegr.dg.lang localStorage | On the first load of any page. Your display language: el or en. |
Until you clear site data | No |
| homegr.dg.searchView localStorage | On Search. Whether you prefer the list or the map: list or map. |
Until you clear site data | No |
| homegr.dg.saved localStorage | When you save a listing without an account. Listing identifiers only — nothing about you. Once you sign in they move to your account and the key is deleted. | Until you sign in, or until you clear site data | No — but it does show what interests you |
| homegr.map.seen localStorage | When you open a pin on the map. Which listings you have already viewed, so they fade. It stays on the device; it is never synced to your account. | 7 days per listing | No — but it does show what interests you |
| homegr.dg.wizard.draft localStorage | Only if you are listing a property. The draft of the form, so you do not lose what you filled in. It contains the exact address you typed — street, number, postcode and, if you set it, the position on the map, along with price, features and description. This is your own data, about your own property. If you are signed in, the same draft is also saved to your account, so you can pick it up on another device; without an account it stays here only. | Until you submit the listing or delete your account; otherwise until you clear site data | Yes |
| homegr.dg.wizard.step localStorage | Alongside the draft. Which step of the form you are on. | Same as the draft | No |
| homegr.dg.wizard.maxstep localStorage | Alongside the draft. The furthest step you have reached. | Same as the draft | No |
| homegr.proelefsi localStorage | Only if you arrived through a link with campaign details and pressed “I agree”. It holds whichever of utm_source, utm_medium, utm_campaign, utm_content and utm_term were in the link, for the most recent campaign — never the gclid. A newer campaign replaces an older one. It is sent only if you create an account within 30 days of your arrival through the campaign link; what we keep then is set out in section 02 of the Privacy policy. It is deleted when you withdraw. If your device has it from before 13/09/2026, 15:38, we delete it the next time you open one of our pages, before it is read or sent. | 30 days from your arrival through the campaign link; neither a direct visit nor signing in renews them | Yes |
| homegr.consent localStorage | When you answer the window “May we measure our campaigns?” or change your choice in “Consent settings”. It holds your choice (agree or do not agree), when you made it and the version of the notice, so we do not ask you again while your choice is valid. It stays on your device; if you are signed in, it is also recorded with your account. | 6 months from your choice; neither a visit nor signing in renews them | Yes — your choice |
| homegr.analytics.optout localStorage | Only if you ask to be excluded from usage measurement. The value 1 means “do not measure me”. |
Until you clear site data | No |
| homegr.analytics.internal localStorage | An internal marker for our own team’s devices, so that our visits do not pollute the measurements. Set with ?internal=1, cleared with ?internal=0. |
Until you clear site data | No |
| homegr.listing.msg sessionStorage | When you write a message on a listing while signed out. It holds the text you wrote, so you do not have to write it again after signing in. It is read once, then deleted. | Until you close the tab | Yes — your own free text |
| homegr.booking.draft sessionStorage | When you send a booking request while signed out. Dates, number of people and your message. It is read once, then deleted. | Until you close the tab | Yes — your own free text |
| homegr.dg.editStash.<listing> sessionStorage | Only if your session expires while you are editing your own listing. It holds the changes that did not get saved — and if you changed the location, they include the address. They return to the form after you sign in; they are read once, then deleted. | Until you close the tab | Yes |
| homegr:arnisi-dimosiefsis:<listing> sessionStorage | Only if you press “Publish listing” and publishing does not complete. It holds home.gr’s reply (what is missing or why it was not published), so you see it on the same listing. It is read once, then deleted. | Until you close the tab | No |
| homegr.recovery.low sessionStorage | Only after a sign-in with a second factor, when you have two or fewer backup codes left. It holds only the number of them, so we can remind you. No code itself is stored. | Until you close the tab | No |
| homegr.wizard IndexedDB | Only if you are listing a property. The photos you selected, before they are uploaded, so they are not lost if you close the page. Not removed by “delete cookies”. | Until you submit the listing or delete your account; otherwise until you clear site data | Yes — photos of your property |
None of the above tracks your browsing on other sites. homegr.proelefsi exists to measure our campaigns: it is created from the link you arrived through, and only after you press “I agree”. homegr.consent holds only your answer to the window. The others that hold data about you are created only because you typed it, in a form you started yourself.
You can delete all of it by clearing site data in your browser settings (section 05). The listing draft and its photos are also deleted automatically as soon as the listing is published, and when you delete your account.
This table is not maintained by hand: an automated check in our test suite scans the code and fails if a key is written that is not listed here — or if a key stays listed here that is no longer written.
What we do not use
So there is no doubt, the platform currently does not use:
- Third-party cookies of any kind
- Third-party traffic analytics tools (Google Analytics and the like)
- Advertising cookies or tracking pixels
- Profiling or targeted-advertising cookies
- Embedded social network buttons that set cookies
We do, however, measure how the platform is used — ourselves. Our own code, our own database, no third party. The measurement sets no cookie and gives you no visitor identifier: on an ordinary visit it writes nothing to your device, and it reads only the language you chose and the two opt-out switches in section 03. What exactly we keep, on which legal basis and for how long, is set out in section 02 of the Privacy policy. Campaign measurement is separate: it writes to your device only if you press “I agree” — see section 06.
If any of the above is added in future, this page will be updated before they are switched on and a consent mechanism will appear where required.
How you manage them from your browser
You can view, block or delete cookies and site data at any time from your browser settings:
- Chrome — Settings → Privacy and security → Cookies and other site data.
- Safari — Settings → Privacy → Manage website data.
- Firefox — Settings → Privacy & Security → Cookies and Site Data.
- Edge — Settings → Cookies and site permissions.
- On mobile, the equivalents are in your browser app’s settings.
Most browsers also offer a private browsing mode, where cookies are deleted when you close the window.
Please note: if you block or delete the homegr_session cookie, you will be signed out of your account and will not be able to sign in again while the block remains in place. Searching and viewing listings work normally without an account.
Consent
The cookies in section 2 are strictly necessary for a service you expressly request (signing in to your account). For those, Law 3471/2006 (Article 4(5)), which transposes Article 5(3) of Directive 2002/58/EC, does not require consent.
One storage item asks for your consent: the campaign details (homegr.proelefsi). For it we show the window “May we measure our campaigns?”, only if you arrived through a link with campaign details and you do not have a valid recorded choice. The “I agree” and “I do not agree” buttons have the same size and the same weight. Closing, ignoring or scrolling is not consent. You find “Consent settings” on every page, even if you did not arrive from a campaign or are not signed in. There you can change or withdraw your choice at any time; withdrawing deletes homegr.proelefsi from your device.
The homegr.dg.lang key stores a preference that you set yourself by pressing the language switch.
Our own usage measurements set no cookie and store nothing on your device; of the keys in section 03 they read only your language and the two opt-out switches, and they write one of those only when you ask to opt out. They rest on legitimate interests (Article 6(1)(f) GDPR) and not on consent; you can object at privacy@home.gr. If your browser sends Do Not Track, no measurement leaves it.
If non-essential cookies are added in future, prior, freely given and revocable consent will be requested, with an equally prominent option to refuse.
Changes to this policy
This policy is updated whenever the implementation changes. The date of the last update is shown at the top of the page.
For the processing of personal data more generally, see the Privacy policy.
Contact
For questions about cookies and local storage: privacy@home.gr.
Operator details: ΠΕΡΣΗΣ Ι.Κ.Ε. (PERSIS P.C.) · VAT No. 800882264 · Rhodes Tax Office · Registered office: Georgiou Seferi 108, Rhodes, 85100, Greece · GEMI (Companies Registry) No. 143888520000