Cookie Policy

Last updated: 10 September 2026

1. What cookies are

Cookies are small text files saved by the browser when you visit a website. They are used to remember your preferences, keep your login session active and, optionally, collect statistics on how the site is used or support advertising campaigns.

This policy is drafted in compliance with art. 122 of Legislative Decree 196/2003 (Privacy Code) and the Guidelines on cookies and other tracking tools of the Italian Data Protection Authority (measure of 10 June 2021, no. 231, updated 2024).

Besides cookies in the strict sense, some site features store data directly in your browser via Web Storage (localStorage/sessionStorage) and IndexedDB: technically these are not cookies, but we apply the same safeguards and list them in the same table below, together with the type of storage used.

2. Data controller

OnStage APS, with registered office at Via Paolo VI 54, 73020 Botrugno (LE), Italy, Tax Code and VAT Number 04810190753.
Email: privacy@onstageaps.com — PEC (certified email): onstagebotrugno@pec.it

3. Categories of cookies used

Necessary

Always on

Essential for the site to function. They cannot be disabled.

Cookies in category Necessary: name, domain, duration, purpose and third-party presence
Name	Type	Domain	Duration	Purpose	Personal data	Third parties
os:d:consent	Browser local storage (localStorage)	.onstageaps.com	24 months (then you are asked to make a new choice)	Stores the choices made in the cookie banner (necessary/preferences/analytics/marketing) and the date they were made.	No	No
os:d:cookie-consent:session-id	Browser local storage (localStorage)	.onstageaps.com	24 months, aligned with the choice it is linked to	Anonymous identifier generated on your device to link, if you are not signed in, the choice you made in the cookie banner to the record kept on the server (no personal data, and not linkable to you until you sign in).	No	No
os:d:auth:session-hint	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Signals, without containing any token, that a session may exist to restore: avoids unnecessarily attempting automatic login renewal for those who have never logged in.	No	No
os:d:auth:remember	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers whether you chose "Keep me logged in" on login (only the toggle, no login data).	No	No
os:s:auth:refresh:session	Browser session storage (sessionStorage)	.onstageaps.com	No longer written as of 20/07/2026: any residual value from a previous session is read once and immediately deleted on first startup	Legacy namespace for session refresh token. As of 20/07/2026 (security fix), the refresh token remains exclusively in memory and is no longer written here: this entry exists only to automatically clear any residuals left by sessions opened before that date.	Yes	No
os:d:auth:refresh:persistent	Browser local storage (localStorage)	.onstageaps.com	No longer written as of 20/07/2026: any residual value from a previous session is read once and immediately deleted on first startup	Legacy namespace for session refresh token (persistent variant of 'os:s:auth:refresh:session', used when the user chose "Keep me logged in"). Same note: no longer written as of 20/07/2026.	Yes	No
os:d:pos:selected-edition	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers the event selected on the till device (tablet), shared among the operators who take turns at the shift.	No	No
os:d:kds:muted	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers whether the audio alerts of the kitchen display (KDS) are disabled on this device.	No	No
os:d:kds:stand	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers the operational station (e.g. "Kitchen", "Bar") manually selected on this device for the kitchen display.	No	No
os:d:orders:voice-muted	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers whether voice announcements of order status changes are disabled on this device.	No	No
os:d:outbox	Browser database (IndexedDB)	.onstageaps.com	Every order stays in queue until it's successfully sent to the server: then it's deleted automatically, in a few seconds. If the server permanently rejects it, it stays visible at the till until an operator deletes it after checking it.	Browser IndexedDB database (name «onstage»): the till uses it to queue an order when connection is missing or unstable during an event, so it can send it as soon as the network comes back. It contains the products chosen, quantities, any line notes, the payment method and a technical identifier generated by the device: it does not contain the name, email or other details of the person placing the order.	No	No
os:s:pwa:reload-guard	Browser session storage (sessionStorage)	.onstageaps.com	For the duration of the browser tab: disappears when you close it	Technical counter of the latest automatic page reloads made by the site itself when publishing a new version: prevents an update that fails from causing the page to reload in an infinite loop. It contains no personal data, only instants of time.	No	No
os:d:live-update:quarantena	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	List of app updates that have already prevented startup on this device and were rolled back automatically: it stops them being downloaded again, so the app does not get stuck in a loop of failed launches. It holds only technical version identifiers, no personal data.	No	No
os:d:push:revoche-in-sospeso	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	When you sign out, this device is removed from push notifications so that whoever signs in after you doesn't receive yours. If that step doesn't fully succeed (for example you're offline at the moment you sign out), a note is kept here of what's still missing, so the operation is retried the next time you open the app instead of being silently forgotten. The note contains the technical address your browser or phone uses to receive notifications, and your user identifier, and it disappears as soon as the operation succeeds.	Yes	No
os:d:assets:cache-refresh-commit	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers which images and videos on the site have already been refreshed in your browser's technical cache (as of 10/08/2026: by comparing a technical list of files with the previous version, to update only those that have really changed instead of reloading the entire site on every visit). It contains only file paths and technical codes, no data about you.	No	No
os:u:cart	Browser local storage (localStorage)	.onstageaps.com	Automatically deleted on logout if you have an account; if you browse without logging in, it remains saved with no automatic expiry	The contents of the shopping cart (products chosen, quantity, notes) for the event you are visiting.	No	No
os:u:orders	Browser local storage (localStorage)	.onstageaps.com	Automatically deleted on logout if you have an account; if you browse without logging in, it remains saved with no automatic expiry	Local copy of your order history (status, amount, event) to display it immediately when opening the "My orders" page before even reloading it from the server.	No	No
os:u:user:profile	Browser local storage (localStorage)	.onstageaps.com	Automatically deleted on logout if you have an account; if you browse without logging in, it remains saved with no automatic expiry	Your authenticated profile: name, surname, email, phone and any date of birth (necessary for orders of age-restricted products). It allows you to be shown as a logged-in user immediately when the page reloads, without waiting for the network.	Yes	No
os:s:db-console:token	Browser session storage (sessionStorage)	.onstageaps.com	For the duration of the browser tab: disappears when you close it. It can also disappear earlier: when the console session expires it is deleted immediately and a new login is required	The code for the session opened on the administration SQL console, the page reserved for those who develop and maintain the site. The server releases it after verifying the six-digit code from the authentication app and accompanies every instruction sent. It does not affect site visitors: it is never created in a visitor's browser.	Yes	No
os:s:db-console:expires-at	Browser session storage (sessionStorage)	.onstageaps.com	For the duration of the browser tab: disappears when you close it; it is also deleted earlier, together with the session code, as soon as the console session expires	The instant at which the administration SQL console session expires, as declared by the server: it serves to display the countdown on the page and to close the console itself when time runs out. How long the session lasts is decided by the server configuration, not the browser and not this list. It contains only a date and time.	No	No
os:s:db-console:recent-queries	Browser session storage (sessionStorage)	.onstageaps.com	For the duration of the browser tab: disappears when you close it	The last five SQL statements successfully executed in the administration console, to be able to recall them from the "recent" list of the editor without rewriting them. The text of the statement is saved, never its result; if the person writing it includes personal data in it (for example an email address in a search filter), that data remains in the saved text. This also exists only in the browser of whoever administers the site.	Yes	No
Google Identity Services ("Continue with Google" button)	Network request to a third-party service (not a cookie of ours)	accounts.google.com	Managed by Google, not known to OnStage	It appears, loading immediately, on the login and account/event registration pages; on the member registration page it appears instead only if, after submitting the form, your email is already linked to a Google account. The button is rendered by Google inside its own iframe: opening one of those pages contacts accounts.google.com and communicates your IP address, even before clicking. According to Google's policy, accounts.google.com can set its own security/session cookies — names and duration are decided by Google, not by OnStage.	No	Yes
__Host-onstage_rt	Cookie	api.onstageaps.com	30 days, renewed on every successful login. If you log in with an operational station role (till, digital kitchen/bar, merchandise desk, games, activities) the server stops accepting it after 12 hours, even if it remains saved in the browser until 30 days. In local development the same cookie is called 'onstage_rt'.	Keeps you logged in after login, so you don't have to re-enter your password on every visit: it contains the token that renews the session. Readable only by our server, not by JavaScript (HttpOnly); travels only on encrypted connection (Secure) and is never sent to other sites (SameSite=Strict). Set by the API domain (api.onstageaps.com), separate from the site you are visiting (onstageaps.com). It is deleted when you log out.	Yes	No

Functional

Opt-in

They improve your experience by remembering preferences and personal settings.

Cookies in category Functional: name, domain, duration, purpose and third-party presence
Name	Type	Domain	Duration	Purpose	Personal data	Third parties
os:d:install	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Remembers that you closed the invitation to install the app (PWA) and for how long to avoid offering it again.	No	No
os:u:pref:*	Browser local storage (localStorage)	.onstageaps.com	Automatically deleted on logout if you have an account; if you browse without logging in, it remains saved with no automatic expiry	Family of usage preferences for staff managing an event (e.g. automatic update of dashboard and warehouse, active tab in inventory panel). Dynamic key: today includes os:u:pref:inventoryAutoRefresh, os:u:pref:inventoryActiveTab, os:u:pref:dashboardAutoRefresh.	No	No
os:d:tool:setlist	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	The setlist you are creating in the "Setlist builder" tool (songs, duration, key, notes), to find it again if you close the page.	No	No
os:d:ricevid:data	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (you can delete it with the "Clear saved data" button in the tool)	The registry data of your association (name, RUNTS number, address, tax code/VAT number) entered in the 'RicevidAPS' tool, saved so you don't have to re-enter it for every receipt. It does not contain donor data: name, tax code and address of the receipt recipient remain only in the completed form and in the PDF receipt generated on your device, and are never saved here.	Yes	No
os:d:ricevid:counter	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	The serial number of the last receipt generated with 'RicevidAPS', by year, so the numbering starts again where you left off.	No	No
os:d:tool:bracket	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	The bracket you are creating in the "Battle bracket generator" (participants, matches, results).	No	No
os:d:tool:runts-check	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	The state of the checked checkboxes in the 'RUNTS Check' tool checklist.	No	No
os:d:tool:rhyme-history	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Recent searches/bookmarks in the "Rhyme dictionary" (up to 20 entries).	No	No
os:d:tool:beat-trainer-sessions	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	The history of completed sessions in the "Beat Trainer" tool (bpm, pattern, duration).	No	No
os:d:tool:beat-trainer-audio	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Whether the audio of the "Beat Trainer" metronome is on or off.	No	No
os:d:tool:freestyle-stats	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry (remains on the device until you clear your browser data)	Usage statistics for the "Freestyle Generator" (sessions, words, minutes, favourite theme) to show you your progress.	No	No

Analytics

Always on

They measure how the site is used. Part of the data goes to Google Analytics in aggregate form; another part stays on our servers and, if you are signed in, is linked to your account (see section 6 below). They are active from your first visit and stay always on: since 10 September 2026 there is no longer a switch to turn them off, neither in the banner nor via the «Edit preferences» button at the bottom of this page. You can object by writing to privacy@onstageaps.com (see section 9 of the privacy notice).

Cookies in category Analytics: name, domain, duration, purpose and third-party presence
Name	Type	Domain	Duration	Purpose	Personal data	Third parties
_ga	Cookie	.onstageaps.com	2 years (Google Analytics 4 default value)	Statistical identifier for the browser used by Google Analytics 4 to distinguish visits. Active from your first visit and always on: since 10 September 2026 there is no longer a switch to turn it off, neither in the «Customise» panel nor in the cookie banner. You can object by writing to privacy@onstageaps.com.	No	Yes
_ga_<container-id>	Cookie	.onstageaps.com	2 years (Google Analytics 4 default value)	Google Analytics 4 session cookie, used to group together the events of the same visit. Same behaviour as the previous cookie: always on, with no switch to turn it off.	No	Yes
os:d:analytics:visitor-id	Browser local storage (localStorage)	.onstageaps.com	No automatic expiry: it stays until you clear your browser data. Internal statistics have been always on since 10 September 2026, there is no longer a switch that clears it.	A random number assigned to your browser by the site's internal statistics, so we can tell that you have been here before even if you do not have an account. It is not derived from your personal data nor from your device's characteristics (it is not a «fingerprint»): it is drawn at random. If you are signed in, the browsing recorded on the server stays linked to your account.	Yes	No
os:s:analytics:session	Browser session storage (sessionStorage)	.onstageaps.com	As long as the browser tab: closing it ends the visit	Keeps together the pages and actions of the current visit for the site's internal statistics: when it started, the last activity, whether it is your first visit and which site you came from (only the site name, never the full address).	Yes	No

Marketing

Opt-in

Third-party cookies set by embedded content on the site (maps, social posts): they serve to display that content but are not under our direct control.

Cookies in category Marketing: name, domain, duration, purpose and third-party presence
Name	Type	Domain	Duration	Purpose	Personal data	Third parties
Google Maps cookies (map embed)	Cookie	google.com	Does not load until you consent to social embed cookies in the banner; once consented, managed by Google, not known to OnStage	Set by the Google Maps map embedded on the "About us" page (association address in Botrugno) and in the "How to get there" section of each event detail page (event venue), subject to explicit consent: without consent you see only a placeholder with an invitation to activate it, never the iframe.	No	Yes
Instagram/Meta cookies (post embed)	Cookie	instagram.com	Does not load until you consent to social embed cookies in the banner; once consented, managed by Meta/Instagram, not known to OnStage	Set by Instagram posts embedded on the home page ("From our Instagram" section) and, when the edition has linked posts, in the same section of event detail pages, subject to explicit consent: without consent you see only a placeholder with an invitation to activate it. Once consented, the iframe does not start right away: it only mounts when you scroll to the card (or click).	No	Yes

4. How to manage cookies

You can change or revoke your cookie preferences at any time using the button below or through your browser settings.

To disable cookies from your browser, see the guides for: Chrome, Firefox, Safari.

5. Third-party cookies

Statistical cookies (_ga, _ga_<container-id>) belong to Google Analytics 4 and last two years. They are written already on your first visit, before you have made a choice, and stay active whatever you choose in the banner: there is no function on the site to turn them off. You can still exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com — details in the Privacy Policy, section 4. See also Google’s Privacy Policy for information on their processing.

The "About us" page embeds a Google Maps map with the association's address. Every event detail page embeds a similar map, in the "How to get there" section, with the event's venue. The home page embeds posts from our Instagram profile in the "From our Instagram" section, and the same happens on event detail pages when the edition has linked posts.

The map on "About us", the map on event detail pages ("How to get there" section) and the Instagram posts all stay hidden — a placeholder takes their place, with a way to activate them on the spot — until you explicitly consent to social embed cookies, either in the banner or by clicking the placeholder itself.

On the login and registration pages (account and event), the "Continue with Google" button loads a script from accounts.google.com and shows the real button inside a Google iframe: the contact happens already when the page loads, not only on click, and communicates your IP address to Google. On the member registration page it appears instead only if, after submitting the form, your email turns out to already be linked to a Google account.

6. OnStage's own statistics

In addition to Google Analytics, the site keeps its own statistics, which stay on the association’s servers and are not shared with anyone. They are always on, just like Google Analytics: there is no function on the site to stop them. You can exercise the right to object under Article 21 GDPR by writing to privacy@onstageaps.com — details in the Privacy Policy, section 4.

To make them work the site saves two things on your device, listed in the table above under «Statistics»: a random number assigned to your browser (os:d:analytics:visitor-id), which lets us recognise that you have already been here even if you do not have an account, and the identifier of the current visit (os:s:analytics:session), which lasts as long as the browser tab. The random number is not derived from your personal data or from the characteristics of your device: it is drawn at random, and is automatically deleted from your device after the fourteen months of retention described below.

Unlike Google Analytics, these statistics are not anonymous: if you are signed in they stay linked to your account, and they also record the text of the searches you run on the site. What exactly they cover, how long they are kept (14 months) and who may read them is set out in section 9 of the Privacy Policy.

7. Consent retention period

Your expressed preferences are stored for 24 months, in compliance with the 2024 Data Protection Authority measure. Upon expiry a new choice will be requested.

8. Updates

This policy may be updated. In case of significant changes, a new expression of consent will be requested.

Manage your preferences

Change or revoke consent to non-essential cookies.