Cookie policy
Every cookie Saff sets, what it is for, and how to change your choices.
Last updated: [TO BE COMPLETED BY THE OPERATOR — effective date]
The short version
Saff uses a small number of cookies, all of them first-party except the one that keeps bots off our public forms. We set no advertising cookies and, today, no analytics cookies at all. Nothing optional runs until you say yes.
Cookies and browser storage
A cookie is a small file a site stores in your browser and receives back on the next request. Browser storage — localStorage — is similar but is never sent to a server; it stays on your device. Both are listed below, because both affect your privacy even though only one of them is technically a cookie.
Strictly necessary cookies
These make sign-in, security and language selection work. They carry no advertising identifier and are exempt from the consent requirement, so they cannot be switched off inside the product — blocking them in your browser will stop you from signing in.
| Name | Purpose | Category | Duration |
|---|---|---|---|
| authjs.session-token | Keeps you signed in and identifies your session. Prefixed with __Host- and marked secure in production. | Strictly necessary | Until you sign out or the session expires |
| authjs.csrf-token | Protects sign-in and account forms against cross-site request forgery. | Strictly necessary | Browser session |
| authjs.callback-url | Remembers where you were so you land back on the right page after signing in. | Strictly necessary | Browser session |
| __Host-saff-platform | Signs in Saff platform operators. It is never set for clinic staff or patients. | Strictly necessary | Until sign-out or expiry |
| NEXT_LOCALE | Remembers the language you picked with the language switch, so pages render in Arabic or English as you chose. Set only when you use the switch. | Preferences | 12 months |
| Cloudflare Turnstile | Confirms that the public clinic-application and waitlist forms are being submitted by a person. Set by Cloudflare. | Strictly necessary | Short-lived, set per challenge |
Stored in your browser, never sent to us
These two values live in your browser's local storage. They are read by the page you are looking at and are never transmitted to our servers — which is also why your cookie choices have to be made again if you clear your browsing data or switch browser.
| Name | Purpose | Category | Duration |
|---|---|---|---|
| consent_v1 | Your cookie choices. Stored only in your browser and never sent to our servers. | Preferences | Until you clear site data or reset your preferences |
| theme_v1 | Whether you prefer the light or dark appearance, or want to follow your system setting. | Preferences | Until you clear site data |
Analytics and marketing cookies
The consent banner offers analytics and marketing categories and both default to off. No analytics or advertising service is currently connected to Saff, so choosing "accept all" today does not switch anything on. If that changes, the banner will ask again before anything is set, and this page will list what was added.
Third-party cookies
The only third party that can set a cookie on our site is Cloudflare, whose Turnstile check protects the public clinic-application and waitlist forms from automated abuse. It sees the request and the challenge result, not the answers you type into the form.
Changing your choices
Reopen the consent banner with the button below to review or change every optional category. You can also block or delete cookies in your browser settings — remember that blocking the strictly necessary ones will break sign-in.
Questions
Ask us anything about this page using the contact details below. Our privacy policy explains the wider picture of what personal data Saff handles.
- Operator
- [TO BE COMPLETED BY THE OPERATOR — registered legal entity name]
- [TO BE COMPLETED BY THE OPERATOR — privacy / data-protection contact email]