This policy explains how AnyRun (the Platform) uses cookies and similar device storage, and how you can control them. It sits alongside the Privacy Policy. It lists every cookie the site sets.

Cookies are small values a site stores in your browser so it can recognise your session on the next request: that's how "stay signed in" works anywhere on the web. Privacy law splits them into two camps: a strictly necessary cookie is one the service you asked for cannot function without, and everything else (analytics, preferences, marketing) is optional and needs your consent first.

Five families of first-party cookie, and no third-party cookie unless you accept analytics. AnyRun sets each cookie below; none is an advertising identifier.

• Sign-in cookies (sb-…, sometimes split into numbered parts): our authentication provider's session cookies. They hold your session token. HttpOnly (page scripts cannot read them), Secure (HTTPS only), SameSite=Lax. They last while you're signed in, refresh as you use the site and end when you sign out. Strictly necessary.
• Your analytics choice (ar_consent) stores the single word all or necessary for 12 months, and nothing else. Storing your refusal is the only way to honour it without asking again on every visit. Secure and SameSite=Lax; it is set by the banner in your browser, so page scripts can read it. Strictly necessary.
• Which role you arrived as (ros_ctx) is a preference cookie. It remembers whether you last used AnyRun as a runner or inside a particular organiser's console, so signing in returns you where you were. It holds the word athlete or an organiser's public web address, no name, no id, nothing about what you did. Up to a year; HttpOnly and SameSite=Lax. Not strictly necessary: the site works without it, you land in the wrong place first.
• Bot-check clearance (__Host-ros_clr): set for 30 minutes after you pass a "prove you're human" check, so the check doesn't reappear on the next page. It holds an expiry timestamp and a signature: no identifier, nothing about you. HttpOnly, Secure, SameSite=Lax. Strictly necessary: it is the security check itself. It used to be called ros_clr, and a browser that passed a check before the change may still show that name until it expires.
• A remembered device (__Host-anyrun_device): set only when you enter a two-factor code and tick “remember this browser” at the check, so we can skip asking again here for the next few days. Leave the box unticked and nothing is set, and if this browser was already remembered, leaving it unticked forgets it. It holds 32 random bytes and nothing else: no name, no account id, no device fingerprint. We store only a one-way hash of it, so the value in your browser is the only copy. Up to 400 days; HttpOnly, Secure, SameSite=Lax. Strictly necessary: it exists to run the sign-in security check, and "forget every remembered device" in your account settings makes it inert immediately. This cookie used to be called anyrun_device. If you see that name in your browser it is the same cookie, and it is replaced the next time you enter a code.

If you're signed out and browsing events, the Platform works without setting any tracking state at all: the only values you might pick up are the bot-check clearance if you're challenged, and your own answer to the consent banner.

No picture, font or script on a public page comes from a host that is not named here or on the sub-processor list. Sponsor logos and event photographs are served from AnyRun’s own storage even when the organiser supplied a web address for them. Three requests do go elsewhere: the bot check loads from Cloudflare, the map tiles on a course map come from OpenStreetMap, and the measurement container loads from Google once you have accepted analytics. Each of the three is described on the sub-processor list.

A value we do not set, and you should still know about. Cloudflare protects this site from automated traffic, and to do that it adds its own small script to every page. It loads from /cdn-cgi/challenge-platform/… on our own address and reports signals about your browser back to Cloudflare, so it can tell a person from a bot. It belongs to Cloudflare: we do not receive what it collects into our own systems and we cannot read it. It runs before the consent banner is answered, deliberately, because it is a security control in the same family as the bot check above. There is no switch for it on our side; it is part of how the site is kept up.

The entry form draft is stored on your device and is not a cookie. While you're filling in an entry form, your browser keeps the form in its session storage (the tab's own scratchpad) so that a session that lapses mid-entry, or a sign-in round trip, doesn't cost you ten minutes of typing.

What that draft holds: everything you have typed so far, which includes your date of birth, your emergency contact's name and phone number, your distance and wave, your consent ticks, any add-ons and any team details.

Where it goes: nowhere. Session storage is not sent with requests the way a cookie is: it does not leave your browser as part of this mechanism, and we cannot read it from our side. It is scoped to that one tab, it is deleted the moment your entry is created, it expires after 24 hours, and closing the tab ends it. If you want it gone sooner, clearing site data for anyrun.net removes it along with everything else.

AnyRun uses one optional layer: product analytics and advertising measurement for AnyRun itself. It arrives through Google Tag Manager: a container that loads the measurement tags we use: Google Analytics 4, Google Ads conversion measurement and Microsoft Clarity (anonymised heatmaps and session replays, with text inputs masked). Where one of them isn't switched on, it sets nothing and sends nothing. We use them to understand how the product is used and to measure our own advertising. No advertiser can pay to reach you here, and sponsors do not receive your data. This layer measures us; you are not its subject.

The container is inside the gate. Tag Manager can be given a new tag without changing this website's code, so the promise here is about the container as a whole: it is not requested, loaded or run until you accept, and anything ever added to it inherits that gate. If a future tag would collect something this policy doesn't describe, this policy changes first.

None of it runs until you say yes. The consent banner appears before any optional cookie exists; declining ("necessary only") is exactly one click, nothing is pre-ticked, and the tools stay fully off. Without your acceptance, these cookies are not set. When the layer is off platform-wide, the banner doesn't appear at all.

• Google Analytics / Ads cookies (names beginning _ga, _gcl): distinguish returning visitors and attribute our own ad campaigns. Set only after consent; lifetimes are set by Google (up to about 13 months for analytics identifiers). With consent, Google signals is on. Where you are signed in to Google with ads personalisation switched on, your visits may be joined across your devices and reported to us as aggregated demographics and interests, with no individual named.
• Microsoft Clarity cookies (_clck, _clsk): link the heatmap/replay session. Set only after consent, and Clarity runs only on public pages: it is left out of your account and of an organiser console, so a session replay records public pages alone.
• Where the data goes: Google and Microsoft process this telemetry partly in the United States, as sub-processors. See the sub-processor list and the Privacy Policy.

Nothing here is a preference cookie. Your settings live in your account. The one preference we do keep in a cookie is ros_ctx, listed in the inventory above; it is first-party, it goes to no third party, and it has nothing to do with this layer.

To know how many people visited an event page, our servers compute a keyed hash from the visit that folds in the current date, so one day's visitors cannot be linked to the next day's: the same visitor produces a completely different, unlinkable value tomorrow, and the count can't follow anyone across days. Nothing is stored on your device, and your raw IP address and browser signature are not written to our database. It counts visits without learning who visited, which is why it needs no cookie and no banner. It is still disclosed as personal information handling in the Privacy Policy, because a reader is entitled to know either way.

The same daily hash tells us that one visitor tapped one sponsor's link once, so a second tap on the same day isn't counted again. It is swept on the same 90-day horizon as the visit counts, and the click record beside it holds no visitor name.

A non-essential cookie arrives with its consent banner before that cookie is ever set, with "reject" exactly as easy as "accept" and nothing pre-ticked, and the technical default is denied: the measurement tools load in a denied state and store nothing until the moment you accept (Google's Consent Mode v2).

Change your analytics choice any time: clear your choice below and the banner asks again on the next page.

Clear my analytics choice

Your browser can also list, block or delete cookies for any site, including this one: check its privacy settings. One caveat: blocking or deleting the sign-in cookies signs you out, because they are the mechanism that keeps you signed in.

A material change to how we use cookies bumps this document's version (currently 2026-09) and the effective date at the top of this page, and, per the commitment above, any move beyond strictly necessary cookies is released with a consent control. Questions: support@anyrun.net.