Privacy

Who we are

Fyonli Nest is a two-bedroom homestay in Dehradun, Uttarakhand, run by Shalini Kala and Aarushi Sharma. We decide what this website collects and what it’s used for, so any question about your information comes to the two of us.

Email thefyonlinest@gmail.com, message us on WhatsApp or call +91 97627 26246.

This notice covers this website and the WhatsApp chats, calls and emails that start from it.

The short version

There are no accounts, passwords or payment details on this site.
The request form keeps what you type in your own browser. Nothing reaches us until you press send in WhatsApp.
Google Analytics counts visits and taps on our WhatsApp and call buttons. Nothing we send it includes your name or phone number.
Your chat with us stays in WhatsApp. Ask us and we’ll delete it.

What we collect, and why

When you send a request from the site

When you pick your dates on the stay page and go on to the request form, the form asks for your name, a phone number (optional, only if it’s different from your WhatsApp number), your dates, the number of adults and children, and whether you’d like breakfast.

Your name and phone number don’t go to any server of ours. The site writes your request into a WhatsApp message and opens WhatsApp with it filled in. Until you press send there, we don’t see it. It also keeps a copy in your browser’s session storage, so the next page can greet you by name and resend the request if WhatsApp didn’t open. Session storage belongs to that one tab and is cleared when you close it.

The dates and number of guests you pick are part of the page address on the booking pages, so our web host and Google Analytics see them, without your name. They’re also kept in session storage, so they’re still there if you go back to the stay page in the same tab.

When you message, call or email us

A WhatsApp message brings us your number, your WhatsApp name and whatever you write. A call shows us your number. An email brings us your email address and your message. We use these to answer you, check dates and arrange your stay. See how booking works.

The tag at the end of our WhatsApp messages

Messages started from this site end with a short tag, such as “(ref: web-stay / google)”. The first part says which page or button you wrote from. The second part says where your visit began: the utm_source in the link you followed, or the website that sent you here, such as Google or Instagram. The site works this out when you arrive and keeps it in session storage for that tab. It tells us which pages help people book. You can delete the tag before you press send.

What’s kept in your browser

Name	What it holds	How long
`fyonli:source` session storage	Where your visit began, such as “google” or “instagram”	Until you close the tab
`fyonli:booking` session storage	The dates and number of guests you picked	Until you close the tab
`fyonli:confirmed` session storage	Your request: name, phone (if given), dates, guests, breakfast	Until you close the tab
`_ga` cookie, Google Analytics	A random ID that tells a returning browser apart from a new one	Up to 2 years by default
`_ga_` followed by an ID cookie, Google Analytics	Keeps track of the current visit	Up to 2 years by default

Our own code sets no cookies. The two cookies come from Google Analytics. Google notes that browsers shorten them if you don’t come back: to at most 400 days in Chrome and 7 days in Safari.

Google Analytics

We use Google Analytics 4 to see which pages are useful and which lead to bookings. It records:

the pages you view, with their address (on the booking pages, that includes your dates and number of guests)
taps on our Instagram links: which link and on which page
taps on our WhatsApp and call buttons: which button and on which page, the tag described above for WhatsApp buttons, and on the date-checking buttons, the number of nights and guests
when you send a request: the number of nights and guests, whether you ticked breakfast, and the estimated total

Depending on how the account is set up, it can also note when you scroll to the bottom of a page and which links to other sites you tap. Google also collects details about your device and browser, and uses your IP address to work out roughly where you are, down to the city. Google says it then discards the IP address. The events our code sends never include your name or phone number, and we don’t use Analytics to work out who you are.

When Analytics notes a tap on a link to another site, it records the whole link. That’s why the WhatsApp messages that include your name or phone number (the ones on the request form and the page after it) open from a button, not a link: Analytics’ link tracking never sees them. Our other WhatsApp links carry at most your dates and number of guests.

Google Analytics deletes its detailed records after the retention period set in our account (Google offers 2 or 14 months). Totals, such as visits in a month, stay in the reports.

How to opt out

Install Google’s Google Analytics opt-out browser add-on, for Chrome, Firefox, Safari and Edge.
Use a content blocker that blocks Google Analytics. Clearing cookies or using a private window doesn’t stop Analytics counting your visit, but it stops your visits being linked to each other.
Skip the site and message us directly. Booking works the same either way, and the site still works with Analytics blocked.

Google explains what it does with this data in How Google uses information from sites or apps that use our services.

WhatsApp (Meta). When you tap a WhatsApp button, your browser hands the filled-in message to WhatsApp to open the chat, and our conversation runs on WhatsApp under WhatsApp’s privacy policy.
Google. Google runs Analytics for us, and our email address is a Gmail account, so emails to us are held by Google.
Our web host. Like any website, the servers that send you these pages see your IP address, your browser and the page you asked for, and may keep these in routine logs.

We don’t sell your information or pass it to anyone else, unless a law requires us to. Our Instagram link takes you to Instagram, which is also run by Meta and has its own policy.

How long we keep it

In your browser: session storage is cleared when you close the tab. You can clear the cookies yourself at any time.
Your WhatsApp chat: it stays in WhatsApp. Ask us and we’ll delete it, along with anything else we hold about you, unless a law requires us to keep it.
Your emails: they stay in our inbox. Ask us and we’ll delete them on the same terms.
Analytics: as described above.

Deleting a chat on our side doesn’t remove it from your phone. You can do that in WhatsApp yourself.

Your rights

India’s Digital Personal Data Protection Act, 2023 gives you the right to:

Access: ask for a summary of the personal data we hold about you, what we do with it, and who we’ve shared it with (section 11).
Correction and erasure: ask us to correct, complete or update it, or to erase it, unless we still need it for your stay or a law requires us to keep it (section 12).
Grievance redressal: complain to us about how we’ve handled your data. If you’re not satisfied with our answer, you can then go to the Data Protection Board of India (section 13).
Nomination: name someone who can use these rights for you if you die or can’t act yourself (section 14).
Withdrawing consent: where you’ve given consent, take it back as easily as you gave it (section 6).

Most of the Act, including these sections, is due to come into force in May 2027. We already work this way.

To use any of these rights, write to us from the WhatsApp number or email address you used with us, or tell us your name and dates of stay so we can find your messages. We’ll reply within 90 days at most. That’s the longest the Digital Personal Data Protection Rules, 2025 allow for answering a complaint.

Children

This site is for adults planning a stay. The request form asks how many children are coming, not their names or ages. Under the Act, anyone under 18 is a child, so if you’re under 18, please ask a parent or guardian to contact us. If you think a child has sent us personal information without a parent’s okay, tell us and we’ll delete it.

Changes to this notice

If the site starts collecting something new, or we change how we use what it collects, we’ll update this page and the date at the top.

Sources: The Digital Personal Data Protection Act, 2023 (MeitY); Digital Personal Data Protection Rules, 2025 (MeitY); commencement notification G.S.R. 843(E), 13 November 2025 (MeitY); Google Analytics cookie usage; Google Analytics: use of IP addresses; Google Analytics data retention; Google Analytics enhanced measurement; MDN: sessionStorage.