1. What Is a Cookie?
Cookies are small text files that websites place in your browser. They can be used to keep your site session active, remember your preference settings, measure usage statistics, or display advertising.
Other technologies used for the same purpose as cookies (localStorage, sessionStorage, web pixels, SDKs) also fall within the scope of this policy.
2. Cookie Categories
In line with the KVKK Cookie Guidelines (2022), cookies are divided into 4 categories:
2.1. Strictly Necessary Cookies (Essential)
Required for the core functions of the service: signing in, security, preserving your language/theme preference. Loaded without consent because they fall under KVKK Art. 5/2-c (performance of a contract).
2.2. Functional Cookies
Optional experience improvements such as personalization, recently visited pages, and "remember me". Requires opt-in (explicit consent).
2.3. Analytics Cookies
Anonymized/aggregate usage statistics for product development. Platforms such as PostHog, GA4, and GTM. Requires opt-in (KVKK Art. 5/1).
2.4. Marketing / Targeting Cookies
For ad targeting and conversion measurement. Platforms such as Google Ads and Meta Pixel. Requires opt-in.
3. Cookies We Use
3.1. Strictly Necessary Cookies
| Name | Purpose | Retention | Type |
|---|---|---|---|
access_token | Keeps the user session active | 7 days | HttpOnly cookie / localStorage |
refresh_token | Session renewal | 30 days | HttpOnly cookie |
guest_token | Analysis quota for a logged-out user | 30 days | localStorage |
csrf / session protection | Protection against request forgery (CSRF), session integrity, and confirmation of the two-factor authentication (2FA) session | Session duration | HttpOnly cookie |
theme | Light/dark theme preference | Indefinite (until the user clears it) | localStorage |
cookie_consent_v1 | Your cookie preference settings | 12 months | localStorage |
3.2. Functional Cookies (Opt-in)
We currently use no active functional cookies. If any are added, this list will be updated and your consent will be requested again.
3.3. Analytics Cookies (Opt-in)
| Provider | Purpose | Retention | Notes |
|---|---|---|---|
| PostHog (EU / Frankfurt) | Page views, session behaviour (password/email fields are masked) | 1 year | Loaded only if you give consent |
| Google Analytics 4 (if any) | Visit statistics | 14 months | Activated only if an ID is entered from the admin panel; not triggered without consent |
| Google Tag Manager (if any) | Tag management system | Depends on the tags it contains | If an ID is entered from the admin panel |
3.4. Marketing Cookies (Opt-in)
We currently use no active marketing/targeting cookies. When the providers below are enabled in the future, they will be loaded only with your Marketing consent; this list will be updated and your consent will be requested again.
| Provider | Purpose | Retention | Notes |
|---|---|---|---|
| Google Ads (future) | Conversion measurement, retargeting | Per Google's standards | When enabled, loaded only with consent (not yet active) |
| Meta Pixel (future) | Facebook/Instagram ad targeting | Per Meta's standards | When enabled, loaded only with consent (not yet active) |
3.5. Web Push Subscription
Browser push notifications are actively offered on our site. This feature is not a cookie; it relies on your browser's push subscription.
| Name | Purpose | Retention | Notes |
|---|---|---|---|
web push subscription (browser push token) | To deliver notifications such as analysis results and support replies to the browser | Until the subscription is cancelled | Activated only with your explicit browser-level permission (opt-in); it is associated with a service worker. You can withdraw the permission at any time from your profile settings or your browser |
4. Third-Party Cookies
The analytics and marketing providers above may also set their own cookies. These cookies are subject to the privacy policy of the relevant provider:
These providers' servers are located outside Turkey: PostHog (EU / Frankfurt), Google (USA) and Meta (USA). These transfers are carried out on the basis of Standard Contractual Clauses (SCC) and the notification made to the KVKK Authority. For details on cross-border (overseas) transfers, see the KVKK Privacy Notice, Article 7.
5. Consent Management (CMP)
On your first visit, you will see a Cookie Preferences banner at the bottom of the screen. Three options are offered:
- Strictly Necessary Only: Only the cookies required for the service to operate are loaded. No analytics, marketing, or functional cookies are loaded.
- Accept All: All categories are enabled.
- Manage Preferences: You can make a separate on/off (toggle) selection for each of the four categories below:
- Strictly Necessary: Always active, cannot be turned off.
- Functional: Optional experience improvements.
- Analytics: Anonymized/aggregate usage statistics.
- Marketing: Ad targeting and conversion measurement.
Analytics and marketing scripts (e.g. PostHog) are loaded only after you give consent to the relevant category; no script is triggered for categories you have not consented to.
Your selection is stored in your browser's localStorage under the cookie_consent_v1 key for 12 months. When the period expires or the version of our cookie policy changes, the banner is shown again.
To change your current preference, use the cookie preferences link/button at the top of this page; the cookie banner reappears and you can save your new preference.
6. Browser Settings
You can also manage cookies through your browser. If even strictly necessary cookies are rejected, some parts of the site (session, registration, payment/wallet transactions) may not work.
7. Retention Period
The retention period of each cookie is specified in the tables above. General rules:
- Session cookies: Deleted when the browser is closed
- Persistent cookies: Until the period determined by us or by the browser
- Preference cookie: Renewal is requested after 12 months
- Analytics data: At most 1 year on the provider side, then anonymization
8. Contact
If you have questions about our cookie policy or experience an issue with consent management, you can reach us at iletisim@bunayorumum.net.
Related pages: KVKK Privacy Notice · Explicit Consent Statement · Terms of Use
