Cookie and Tracker Policy

Draft to be validated by legal counsel before final publication.

Version: draft of 1 October 2026. Effective date: [À COMPLÉTER / TO BE COMPLETED: final publication date].

1. WHAT WE USE

A cookie is a small file placed by a website in your browser. Local storage (localStorage and sessionStorage) is a comparable space, read only by the website that created it. Festime uses only cookies and storage necessary for the operation of the service you request. Festime uses no advertising cookies, no third-party audience measurement tools and no embedded social networks that place trackers.

2. COOKIES PLACED BY FESTIME

festime_session — Purpose: maintaining your session (login, protection against cross-site request forgery, chosen language, two-factor authentication step). Characteristics: session cookie deleted when the browser is closed, HttpOnly, Secure, SameSite=Lax. Necessary: yes.

festime_device — Purpose: security and fraud prevention at sign-up and login (detection of multiple accounts in the referral programme); only a hashed fingerprint of this random identifier is stored. Characteristics: placed only upon sign-up or login, lifetime 400 days, HttpOnly, Secure, SameSite=Lax. Classified as necessary for the security of the service. [À COMPLÉTER / TO BE COMPLETED: validation by legal counsel of the “strictly necessary” classification and of the lifetime, possibly reduced to 13 months.]

3. BROWSER LOCAL STORAGE

festime.nav.groups (localStorage) — remembers which side-menu groups you have opened or closed. Interface preference, containing no personal data, kept until you clear it.

festime.nav.scroll (sessionStorage) — remembers the menu scroll position for the current tab; cleared when the tab is closed.

festime-tus:…, festime-video:…, tus::… and tusSupport (localStorage) — allow an interrupted video upload to be resumed; created only when you start an upload and deleted when it is completed or has expired.

Language and accessibility preferences are stored in your session or your Account, not in an additional cookie.

4. INTERNAL AUDIENCE MEASUREMENT

To provide Festivals with the number of visits to their page, Festime records a hashed fingerprint of the session per festival and per day, without any additional cookie and without cross-referencing with other websites. These fingerprints are deleted after 90 days and only aggregated statistics are reported. [À COMPLÉTER / TO BE COMPLETED: validation of the consent exemption for this audience measurement.]

5. THIRD-PARTY SERVICES

Payment: the Stripe and PayPal payment pages are displayed on those providers’ domains after redirection; their cookies are governed by their own policies.

External videos: videos hosted on YouTube (youtube-nocookie.com domain), Vimeo (“do not track” parameter enabled) or Google Drive are loaded only after you click “Load Video”. Before that click, no connection is made with these services. After that click, the provider may place its own cookies or trackers, governed by its privacy policy.

E-mails: commercial campaign e-mails, sent only with your consent, may contain an open-tracking pixel and click-tracking links used to compile statistics. [À COMPLÉTER / TO BE COMPLETED: validation of the consent arrangements for e-mail open tracking.]

6. WHY THERE IS NO CONSENT BANNER

The cookies and storage described above are strictly necessary for the service requested or for its security, or are created only following an explicit action on your part (playing an external video, uploading). They are exempt from prior consent within the meaning of Article 82 of the French Data Protection Act (Loi Informatique et Libertés) and Article 5(3) of Directive 2002/58/EC. Should Festime ever add non-essential trackers (third-party audience measurement, targeted advertising, social networks), a prior consent mechanism would be put in place before they are placed and this policy would be updated.

7. MANAGING COOKIES

You can delete cookies and local storage from your browser settings. Deleting festime_session logs you out; blocking this cookie prevents login.

Contact: [À COMPLÉTER / TO BE COMPLETED: dedicated data protection e-mail address].