Cookie Policy

This policy covers the Sanad website and the Sanad admin panel. It does not cover the mobile app, which does not use cookies.

What a cookie is

A cookie is a small piece of text your browser stores for a website and sends back on every later request. It is how a site remembers you between one page and the next — for example, that you are signed in.

The cookies we use

These are all the cookies we set. Most are strictly necessary; one only remembers a display preference.

Sign-in cookie (admin_token, website_token). Strictly necessary. This holds your session token. It is encrypted before it is written and marked httpOnly, which means scripts running in your browser cannot read its value. Note the limit of that protection: httpOnly stops a script from stealing the token, but a malicious script running on our page could still act as you while you are signed in, because the browser attaches the cookie automatically. It lasts up to 30 days, and is deleted when you sign out or when your session is rejected as expired.
Sign-in indicator (has_admin_token, has_website_token). Strictly necessary. A plain 1 that our own page code can read, so the interface knows whether to show you as signed in. It contains no token, no name and no secret, and it is stored unencrypted.
Sidebar state (sidebar_state). A preference, not a necessity. In the admin panel it remembers whether you collapsed the side menu. It stores only true or false, and lasts 7 days. Blocking it costs you nothing but a collapsed menu.
Language (NEXT_LOCALE). Remembers whether you chose English or Arabic. It stores nothing but the language code, and lasts a year.

What we do not use

We have no analytics cookies, no advertising cookies, and no tracking or profiling cookies of any kind. There is no Google Analytics, no advertising pixel, no session-recording tool and no third-party tag on our site. Nobody is paying us to watch you, and we do not follow you across other websites.

Because none of our cookies are used for tracking, we do not show a consent banner. There is nothing to consent to beyond what is needed to sign you in, remember your language, and remember how you left the menu.

Other browser storage

Cookies are not the only thing we keep in your browser. The admin panel also uses your browser's local storage for interface settings — theme, font and table layout. That data stays on your device, is never sent to us, and holds no personal information. Clearing your browser's site data removes it.

Controlling cookies

Every browser lets you view, block and delete cookies — usually under Settings, in a section named Privacy, Cookies, or Site data. You can also clear cookies for a single site without touching the rest.

Be clear about the trade-off: if you block or delete our cookies, signing in will not work. The sign-in cookie is the session. Block it and you will be logged out immediately, or bounced back to the login page every time you try. Deleting the language or sidebar cookie is harmless — you will just be asked to choose your language again, and the menu will reopen.