Cookies, in short

Cookies are small text files that your browser stores on your device at the request of a website you visit. The browser sends them back to the same site on later visits, which lets the site remember things such as your language or whether you are signed in.

Cookies are classified by origin: first-party cookies are set by the site you are visiting, third-party cookies by other domains (advertising networks, for example). They are also classified by lifetime: session cookies are deleted when you close the browser, persistent cookies stay until they expire or you delete them.

And they are classified by purpose: strictly necessary cookies that make the site work, preference cookies that store your choices, analytics cookies that measure usage, and marketing cookies that track you across sites. The HAWJAN website uses the first two kinds only.

The site sets cookies for three purposes only:

• Remembering the language you read the site in, so that it sends you to the Arabic or English version the next time you open the home page.
• Remembering the appearance you chose (light, dark or system) with the theme switch.
• Not replaying the intro animation on the home page during the same session.

In addition, a sign-in cookie exists for the HAWJAN team only when they use the dashboard; it is never set for visitors.

The site does not use cookies for analytics, advertising or cross-site tracking, and none of these cookies is linked to your identity or to the data from the contact form or the newsletter. Every cookie described above is first-party, set by the hawjan.com domain itself. The only exception is the embedded video player, which loads only after you press play yourself (see the chapter "Third-party cookies").

This is the complete list of cookies the site may set in your browser as a visitor, with the purpose, type, duration and who sets each one:

• hawjan-locale — stores the code of the language you are reading (ar or en) so that the home page sends you to the same language later — necessary preference cookie, first-party — one year from your last visit — set automatically by the site's server with the first page you open.
• hawjan-theme — stores your appearance choice: light, dark or system — preference cookie, first-party — one year — set by your browser only when you press the theme switch; it does not exist if you never use the switch.
• hawjan-intro — records that the intro animation has played in this session so that it is not repeated — functional session cookie, first-party — deleted when you close the browser — set by your browser after the intro plays on the home page.

None of these cookies contains personal data; their values are fixed words such as ar, dark or 1. They are not used to identify or track you.

All of them are sent with SameSite=Lax, meaning the browser does not send them with requests coming from other sites, and with the Secure attribute on encrypted connections, so they travel over HTTPS only.

When a team member signs in to the dashboard, the site sets a cookie named __Host-hawjan_session (hawjan_session in the development environment). It holds a long random token of which the server keeps only a keyed hash. It is HttpOnly, so scripts in the page cannot read it, Secure, so it is sent over HTTPS only, SameSite=Lax, and lasts at most 30 days, expiring after 7 days of inactivity.

During password recovery only, a temporary cookie named __Secure-hawjan_reset (hawjan_reset in development) is set, restricted to the recovery page path and valid for 30 minutes; it is also HttpOnly and Secure.

Neither cookie is ever set in an ordinary visitor's browser. We list them here for complete transparency; signing in concerns the staff who manage the content.

The public site does not use the browser's local storage for any purpose.

In the dashboard only, the post editor keeps a backup of unsaved drafts in the browser's local storage (under a key starting with hawjan.post-draft) so that a team member's work is not lost if the tab closes unexpectedly. The backup is removed when the post is saved or the draft is dismissed. This feature does not concern visitors and holds none of their data. After you press play, an embedded video player may use the local storage of its provider's own domain under that provider's policy.

The site itself sets no third-party cookies. There is no analytics code (such as Google Analytics), no advertising pixels, no embedded social sharing buttons that set their own cookies, and no fonts loaded from external servers; fonts, images and videos uploaded to the site are served from the site's own domain.

The only exception is the embedded video player: some pages may show a video from YouTube or Vimeo. This player loads only after you press play yourself, and your browser does not contact the provider before that. It is served from the privacy-enhanced domains (youtube-nocookie.com, and player.vimeo.com with the do-not-track option dnt=1), and once loaded the provider may set cookies of its own under its own policy.

The site's pages apply a Content Security Policy that prevents loading scripts from unauthorised sources and allows embedded players from those two domains only, which technically limits the possibility of third-party cookies being added without our knowledge.

If we ever add an external service that sets cookies, we will update this policy before enabling it and ask for your consent where the law requires.

Laws require consent for cookies that are not necessary, such as analytics, marketing and tracking cookies. Cookies that are necessary to run the site or to carry out a preference you asked for yourself (such as your language or appearance choice) do not require prior consent.

Because the HAWJAN website sets only cookies of that kind, it shows no consent banner and asks you to accept nothing. We believe a banner that offers no real choice merely annoys visitors. An embedded YouTube or Vimeo player, by contrast, loads only after you ask for it by pressing play, so your browser does not contact its provider before that.

This decision is based on what the site actually does today. If that changes, the way we ask for consent will change with it, and you will find the update on this page.

You can control cookies from your browser settings: view them, delete them, block a specific site from setting them, or block them altogether. The approximate path in common browsers:

• Google Chrome: Settings → Privacy and security → Cookies and site data.
• Safari (Mac): Settings → Privacy → Manage Website Data. On iPhone: Settings → Safari → Privacy & Security.
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Microsoft Edge: Settings → Cookies and site permissions.
• Samsung Internet: Settings → Personal browsing data.

You can also use private browsing mode, in which the browser deletes all cookies when you close the window. To change your language or appearance choice you do not need to delete anything: use the language or theme switch on the site and the cookie is updated automatically.

The site works fully without cookies; you can browse every page, send the contact form and subscribe to the newsletter without any of them. Only convenience changes:

• The site will not remember your language and will send you, when you open the home page, to the language your browser suggests (Arabic by default); you can switch from the menu at any time.
• The appearance will return to the default setting on every visit instead of the one you chose.
• The intro animation on the home page may play on every new visit (it never plays for people who enable reduced motion on their device).

The dashboard cannot be signed in to without the session cookie, which concerns the HAWJAN team only.

We process the information held in cookies on the basis that it is necessary to deliver the service you asked for and to run the site securely, in accordance with the Personal Data Protection Law of Saudi Arabia and its Implementing Regulations, and under Article 6(1)(f) of the GDPR for visitors in the EU and the UK, consistent with the electronic-communications privacy rules that exempt strictly necessary cookies from prior consent.

The values of these cookies are generally not personal data, since they do not identify you. We nonetheless treat them with the same care and mention them in the Privacy Policy.

For more about your personal data and your rights, see the Privacy Policy.

We update this policy when we add a cookie, change the purpose or duration of an existing one, or when the applicable rules change. The date of the last update appears at the top of the page.

If we ever add non-essential cookies, we will offer a clear way to consent before setting them, and we will not infer consent from your continued browsing.

For any question about cookies or this policy, write to Hawjan at info@hawjan.com. If your question is about your personal data in general, the Privacy Policy has the full details and the ways to exercise your rights.