Sarto Cookie Policy

Last updated: July 24, 2026

This policy explains which cookies the sarto.app website uses and why. It complements the Privacy Policy. The Sarto iOS app itself does not use cookies; everything below is about the website only.

1. What are cookies

Cookies are small text files that websites store on your device while you browse. They are used to make sites work properly, remember choices, protect against abuse, or measure site usage.

2. Cookies we use

sarto.app is a static site served through Cloudflare's network. It uses exactly three groups of cookies:

Consent cookie: one first-party cookie that stores your cookie choice, so we do not ask you on every visit.
Cloudflare security cookies: strictly necessary technical cookies that Cloudflare may set when its protection features are active (for example bot mitigation, challenges, or rate limiting). They do not always appear; it depends on security configuration and traffic behavior.
Google Ads conversion cookies: set only if you accept them in the cookie banner. They tell us whether a visit or an App Store click came from one of our ads. Nothing is set before you choose, and the Google tag starts with consent denied by default.

3. Cookie table

Cookie	Set by	Purpose	Typical duration
cc_cookie	sarto.app	Stores your cookie consent choice. Strictly necessary.	6 months
__cf_bm	Cloudflare	Anti-bot protection (Bot Management / Bot Fight Mode). Strictly necessary.	About 30 minutes of inactivity
cf_clearance	Cloudflare	Certifies that you passed a security challenge so it is not repeated while valid. Strictly necessary.	Variable
_cfuvid	Cloudflare	Distinguishes visitors sharing an IP address so rate limiting can be applied fairly. Strictly necessary.	Session
_gcl_au, _gcl_aw and other names starting with "_gcl"	Google	Advertising measurement: link a visit or App Store click to one of our Google Ads. Set only with your consent.	About 90 days

Other Cloudflare security cookies can appear if additional protection features are triggered; Cloudflare classifies them as strictly necessary for its security services. Cloudflare and Google may process cookie data in their data centers outside your country, including the United States; the safeguards described in the Privacy Policy apply.

4. Cookies we do not use

As of the date of this policy, sarto.app does not use:

Analytics or measurement cookies (no Google Analytics, no Hotjar, no session recording). We measure site audience and performance with Cloudflare Web Analytics, which is cookieless: it sets no cookies, stores no identifiers, and does not track you across sites.
Social media cookies.
Personalization cookies.
Any advertising cookies beyond the consent-gated Google Ads conversion cookies described above. We build no advertising profiles of you, and the website never receives resume content.

5. Legal basis

Strictly necessary cookies (the consent cookie and Cloudflare's security cookies) rely on our legitimate interest in providing a functional and secure website, in line with Article 6(1)(f) of the GDPR where it applies. Google Ads conversion cookies rely on your prior consent (Article 6(1)(a) where it applies), which you can withdraw at any time as described below.

6. Managing cookies

You can review and change your choice at any time via the "Cookie preferences" link in the footer of every page, which reopens the consent panel. You can also configure your browser to block or delete cookies, although blocking strictly necessary ones can make parts of the site misbehave (for example, a security challenge may repeat).

Chrome: support.google.com/chrome/answer/95647
Firefox: support.mozilla.org
Safari: support.apple.com
Edge: support.microsoft.com

7. Updates to this policy

We may update this policy to reflect changes in our practices or technical configuration. We will post the updated version on this page and revise the "Last updated" date.

8. Contact

[email protected] · BEAST LABS, SLU, Avinguda Verge de Canòlich 124, Sant Julià de Lòria, AD600, Andorra