Cookie Policy

1. What is a cookie?

A cookie is a small text file placed on your device by a website to store data between page loads or visits. Cookies can be:

• First-party (set by astropark.xyz) or third-party (set by external services);
• Session (deleted when you close the browser) or persistent (kept until expiry);
• Strictly necessary (the site cannot work without them) or non-essential (analytics, marketing).

We also use localStorage and sessionStorage, which are similar in purpose but stored differently in your browser. For convenience we refer to all of these collectively as "cookies".

2. Categories used by Astropark

2.1 — Strictly necessary (always on, no consent required)

Exempt from consent under Art. 122 d.lgs. 196/2003 because they are technically required for the site to function (authentication, security, cart). You can still disable them via your browser settings, but the site will not work properly.

2.2 — Analytics (opt-in only)

Used to measure aggregate site usage. Loaded only after you accept "Analytics" in the cookie banner.

2.3 — Marketing (opt-in only)

Currently not used. Reserved for future activation; if we activate any marketing pixels, we will request fresh consent and update this policy.

3. Cookie list

The following table lists every cookie / storage item the site sets. Names marked with (legacy) are being phased out and will be removed in a future release.

• astropark_jwt — 1st-party HTTP-only cookie · 24 hours · session authentication (signed JWT). Strictly necessary.
• astropark_csrf — 1st-party (not HTTP-only) · 24 hours · anti-CSRF double-submit token. Strictly necessary.
• astropark_refresh — 1st-party HTTP-only · 30 days · JWT refresh token. Strictly necessary.
• astropark_consent — 1st-party localStorage · 12 months · stores your cookie banner choices (consent record per Garante 10/06/2021). Strictly necessary.
• astropark_cart — 1st-party localStorage · persistent until cleared · stores cart contents on this device. Strictly necessary.
• astropark-jwt (legacy) — 1st-party localStorage · persistent · legacy auth token, in deprecation. Strictly necessary until removed.
• _ga, _ga_<container>, _gid — Google Analytics 4 (Google Ireland Ltd.) · 13 months / 24 hours · anonymous user identification + session tracking. Analytics — opt-in.

No marketing or advertising cookies are currently in use.

4. Manage your preferences

You can change your consent at any time:

• In-page banner: click here to reopen the cookie preferences.
• Browser settings: most browsers let you block or delete cookies — see help pages for Chrome, Firefox, Safari, Edge.
• Google Analytics opt-out: install the Google Analytics Opt-out browser add-on to block GA4 across all sites.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

5. Consent record

Per Garante guidelines, we record (locally and in our consent log):

• the timestamp of your choice;
• the categories accepted and refused;
• the version of the banner shown;

so that we can demonstrate consent if asked. The record is retained for 12 months, after which we re-prompt for consent.

6. Updates

We may update this Cookie Policy as the cookie list changes. Material changes are accompanied by a re-prompt of the consent banner.