Cookie Policy

1. The cookies we use

When you use the website these cookies may be set, all first-party:

• sandr-session: keeps the session, that is, it remembers that you are using the website and that you have signed in. For people watching without an account it also keeps the random identifier that counts the preview. It lasts 120 minutes from the last activity. It cannot be read by JavaScript (HttpOnly), travels only over an encrypted connection (Secure) and is not sent with requests coming from other sites (SameSite=Lax).
• XSRF-TOKEN: protects forms and requests against CSRF attacks, which exploit your session without you knowing. It lasts 120 minutes, travels only over an encrypted connection (Secure) and is not sent with requests coming from other sites (SameSite=Lax). The website's code reads it, which is why it is not HttpOnly.
• remember_web_*: appears only if you tick “Keep me signed in” when you sign in. It keeps you signed in for 30 days on that device, or until you sign out. It cannot be read by JavaScript (HttpOnly), travels only over an encrypted connection (Secure) and is not sent with requests coming from other sites (SameSite=Lax). The name continues with a sequence of letters and numbers.
• sandr_oauth: appears only when you choose to sign in with Apple, and applies only to the /auth/apple path. It lasts 10 minutes and ties the sign-in request to your browser, so that nobody else can complete it in your place. We delete it as soon as sign-in ends. It cannot be read by JavaScript (HttpOnly) and travels only over an encrypted connection (Secure). It has SameSite=None because Apple brings you back to the website from an address on another site, and with a stricter value the browser would not send it.

They are all technical session and security cookies: without them the website and the personal area would not work securely. They let you sign in, keep you signed in and protect requests. They are not used to follow you.

Back to contents

2. Traffic statistics

When they are on, traffic statistics are our own and run on our servers. They store and read nothing in your browser: no cookies, no local storage, no third-party scripts. We use them only for aggregated figures about the website and the app, never to profile you, and we do not combine them with your account.

To count the visits of a day we use a code computed on the server from the masked IP address (without its last part) and the browser type, with a random salt that changes every day and is deleted after 48 hours. The IP address is not stored. If your browser sends the Global Privacy Control signal, we record nothing. Details are in the Privacy Policy.

Back to contents

3. Why there is no banner

Technical cookies can be used without your consent: you only need to be informed, which is what this page does. The Italian Data Protection Authority (Garante per la protezione dei dati personali) requires prior consent, and therefore a banner, for profiling and marketing cookies and tools and for statistics that do not meet certain safeguards (guidelines of 10 June 2021).

Our statistics meet those safeguards: they are first-party, used only for aggregated figures, mask the IP address, are not combined with other data and do not profile. That is why we do not ask for your consent, and you can still object.

If in the future we introduce cookies or tools that require consent, we will update this page and show a banner that lets you accept or refuse just as easily, before installing them.

Back to contents

4. What we do not use

• Third-party analytics, profiling or marketing cookies.
• Third-party cookies, pixels or scripts, such as social networks, statistics or advertising tools.
• Other tools that store information in your browser, such as local storage, to remember or follow you.
• External fonts: the website's typefaces are hosted by us.

When you choose to sign in with Google or Apple, the website takes you to the provider's page. Their cookies and their policy apply there, not ours.

Live stream video comes from our servers or, for some events, from the Bunny.net delivery network. In that case the provider sees the viewer's IP address, as explained in the Privacy Policy, but sets no cookies.

Back to contents

5. The app

The SANDR.tv app does not use cookies. It stores the access token and your profile data (name, email, language and consent choices) on your phone, in secure storage, so it does not ask for your password every time, and deletes them when you sign out. For people watching without an account it also stores a random installation identifier, used only to count the preview. It also keeps a copy of public data already downloaded (schedules and results), to load it faster.

For traffic statistics, when they are on, the app uses a session identifier that stays in memory and disappears when the app is closed. The app starts Google's Firebase service, used for notifications to station phones: as explained in the Privacy Policy, for viewers we receive no data from Firebase.

Back to contents

6. How to manage cookies from your browser

You can view, block or delete cookies from your browser settings. If you block technical cookies, public pages still show, but sign-in, sign-up, the preview and form submission may not work.

For instructions, search for “cookies” in your browser's help (Chrome, Firefox, Safari, Edge).

Back to contents

7. Changes

We update this page when our use of cookies changes. Each version has a number and a date, shown at the top. For questions write to privacy@sandr.tv.

Back to contents