ISF ad measurement update — 18 September 2026
This update replaces earlier ISF ad measurement wording. When the service is enabled, ISF ad measurement is allowed automatically for verified students entering ISF who have not already chosen No thanks. Existing No thanks choices remain off. SAMI sends Meta one confirmation of ISF entry, a hashed version of the verified phone number and browser information to measure ISF advertising. Hashes are matching identifiers, not anonymous data. The automatic default is recorded separately from a student's explicit choice. Students can choose No thanks using Change ad measurement choice in ISF. This stops unsent reports but cannot recall a report Meta has already received. Portal access is the same either way. General visitor and page-view analytics remain disabled. No advertising cookies or Meta browser pixel are installed; names, documents and study details are not shared. SAMI removes queued matching data after delivery, final failure or expiry and retains the setting and delivery record.
Published version: 10 September 2026.
1. What this policy explains
SAMI uses cookies and browser storage to run sign-in, verification, language choices and other functions you request. Cookies are small values sent with requests to a website. Local storage stays in that browser until removed or expired by the application; session storage normally lasts for that tab's session. Telegram's webview has its own browser storage environment.
This policy concerns SAMI's websites and portal interfaces. It supplements the Privacy Policy, which explains server records, recipients and your rights. Removing a cookie does not delete your SAMI account or the underlying application and payment records.
2. Optional analytics are disabled
SAMI does not activate optional visitor, session, page-view, section-view or click analytics when you accept the terms or register. The retired collection endpoint does not record new usage events. Essential security and operational records continue, including sign-in, consent, application, payment and attendance evidence.
Older versions created a SAMI analytics visitor cookie and local/session storage identifiers. Updated pages remove those legacy identifiers from the browser they run in. This cannot remotely clear every other device or a browser that has not returned. Removing browser identifiers also does not erase historical server records; those records are covered by the retention process in the Privacy Policy.
There is no need to opt into optional SAMI analytics because it is disabled. Necessary storage cannot be disabled through an analytics preference without affecting the underlying function. Your browser still gives you controls over cookies and storage.
3. Sign-in and security storage
The current application sets the following where the relevant action is used:
- sami_access: the signed-in access cookie, with a 30-minute browser lifetime. It is protected from ordinary client-side script access.
- sami_refresh: renews an authenticated session, with a seven-day browser lifetime. Sign-out clears the relevant session cookies; server-side invalidation may make them unusable earlier.
- sami_reactivation: supports the account-reactivation flow, for up to 30 minutes.
- sami_training_access, sami_training_refresh and sami_training_reactivation: separate equivalents for the training environment, using the corresponding lifetimes so training and ordinary accounts do not share a session.
- sami_google_auth_intent, sami_google_auth_account and sami_google_auth_redirect: preserve the requested Google sign-in or reset flow, for up to ten minutes and limited to the callback path.
- sami_telegram_auth_intent, sami_telegram_auth_account and sami_telegram_auth_redirect: preserve the requested Telegram sign-in or registration flow, for up to ten minutes and limited to the callback path.
- sami_telegram_registration: supports completion of a Telegram registration, for up to 15 minutes.
- sami_social_password_reset: supports the verified social sign-in password-reset flow, for up to ten minutes.
- sami_telegram_mode: a session cookie used to keep portal presentation inside the Telegram mini-app. It does not grant account access.
These lifetimes describe cookie configuration, not a promise that access remains valid until expiry or that all server data is deleted then. Cookies are limited to the relevant host or authorised shared domain and use security attributes appropriate to production connections.
4. Terms, language and requested preferences
The sami_terms_accepted cookie remembers the recorded terms version and acceptance reference for up to one year. Versioned local-storage markers and sami_terms_consent_id help the interface recognise the same acceptance. They do not grant permission for analytics or any purpose not described in the acceptance.
The selected language and application country may be remembered for up to one year in cookies, with corresponding local-storage preferences. Portal navigation, table layout and similar display choices may remain in local storage until reset or cleared. These are used to preserve your selected interface settings.
Some requested workflows keep a draft in browser storage. The Telegram mini-app stores a registration draft for reuse for up to one hour in the tab session and clears it on successful sign-in. A return to the draft requires confirmation of the terms again. Avoid entering sensitive information on shared devices and close or clear the session afterwards.
Local-storage values without an implemented expiry can remain until removed by the application or your browser. They should not be described as automatically deleted when you close a tab.
5. Third-party services
Security checks such as Cloudflare Turnstile, chosen sign-in providers, payment services, and external content can process connection or device information and may use their own storage. The values and lifetimes depend on the provider and the function used. These services are not permission for SAMI to restart optional usage analytics.
Read the Third-Party Services Notice before using an external service. A link by itself is different from content loaded directly from an external provider: embedded content can contact that provider when it loads. This policy does not claim that another organisation's site is cookie-free.
6. Managing storage
Use your browser's privacy settings to view, block or delete cookies and site data. You may need to clear separate SAMI subdomains and Telegram webview storage independently. Blocking sign-in or verification cookies can prevent account access; removing language or layout preferences resets those choices.
For help or a question about server-side records, contact info@sami.uz. Clearing browser data is not a cancellation request, privacy deletion request or withdrawal of an external application. Use the appropriate request described in the Privacy Policy or Refund & Cancellation Policy.
7. Changes
If SAMI proposes optional tracking in future, this policy and the relevant controls must be updated before it begins. A prior acceptance of service terms will not be reused as consent for that tracking.