1. Introduction

This Cookie Policy explains how [COMPANY NAME] ("[COMPANY NAME]", "we", "us", or "our") uses cookies, local storage, and similar tracking technologies on our website [DOMAIN NAME] and associated services (collectively, the "Service").

This policy is designed to be read alongside our Privacy Policy and Terms of Service. Together, these documents describe how we collect, use, and protect your information.

This Cookie Policy complies with applicable laws and regulations, including:

• EU ePrivacy Directive (2002/58/EC as amended by 2009/136/EC) — "Cookie Directive"
• General Data Protection Regulation (EU) 2016/679 ("GDPR")
• UK Privacy and Electronic Communications Regulations 2003 ("PECR") and UK GDPR
• California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA")
• Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and related Board decisions on cookies

2. What Are Cookies?

Cookies are small text files that are placed on your device (computer, tablet, or mobile phone) by a website when you visit it. They are widely used to make websites work efficiently, remember your preferences, and provide information to website operators.

Cookies are set either by the website you are visiting directly ("first-party cookies") or by third-party services operating on that website ("third-party cookies"). Cookies can be classified by duration:

• Session Cookies: Temporary cookies that are stored only for the duration of your browser session. They are automatically deleted when you close your browser tab or window.
• Persistent Cookies: Cookies that remain on your device for a set period of time defined by the cookie's expiry date, or until you manually delete them. They are activated each time you visit the website that set the cookie.

In addition to cookies, we may also use related technologies including:

• Local Storage and Session Storage: Browser storage mechanisms that allow us to store small amounts of data on your device (e.g., theme preference, language selection) without expiry dates (local storage) or for the duration of a session (session storage).
• Pixels and Web Beacons: Tiny transparent images embedded in pages or emails that allow us to record when you have visited a page or opened an email, and to log your IP address, browser type, and timestamps.
• Device Fingerprinting: A technique that collects information about your device (browser version, screen resolution, installed fonts) to identify your device without using cookies. We use this only for fraud prevention and security purposes.

3. Cookie Consent

When you first visit the Service, you will be presented with a cookie consent banner that allows you to:

• Accept all cookies;
• Reject all non-essential cookies;
• Customize your preferences by category.

Essential cookies (described in Section 4.1 below) are placed on your device as soon as you access the Service without requiring consent, as they are strictly necessary for the Service to function. All other cookie categories require your prior informed consent before being set.

You may withdraw or update your cookie consent at any time by clicking the "Cookie Preferences" link in the footer of any page, or through your account settings if you are a registered user. Withdrawal of consent does not affect the lawfulness of any cookie use prior to withdrawal.

For EU / UK users: Consent is obtained in accordance with Article 5(3) of the ePrivacy Directive and Article 7 of the GDPR. We maintain records of consent, including the date, version of the policy shown, and the preferences selected.

For Turkish users: Cookie consent is collected in accordance with the KVKK Board's guidelines on cookies (published March 2022). Consent is explicit, informed, and revocable at any time.

4. Categories of Cookies We Use

4.1 Strictly Necessary / Essential Cookies

These cookies are required for the Service to function and cannot be switched off. They are set in response to actions made by you — such as logging in, setting your language, or submitting a task. Without these cookies, some parts of the Service will not function correctly.

Legal basis: No consent required — these are necessary for the performance of a contract and for the legitimate interest of providing a secure, functional service (Art. 6(1)(b) and (f) GDPR).

4.2 Functional / Preference Cookies

These cookies enable enhanced functionality and personalization. They remember choices you make to improve your experience. If you disable them, some features may not function as intended.

Legal basis: Your consent (Art. 6(1)(a) GDPR / Art. 5(3) ePrivacy Directive).

4.3 Analytics and Performance Cookies

These cookies collect information about how visitors use our Service, which pages are visited most, how users navigate between pages, and whether any error messages were displayed. All data collected is aggregated and pseudonymized — it is not used to identify you personally. We use this data to improve the performance, usability, and reliability of the Service.

Legal basis: Your consent (Art. 6(1)(a) GDPR / Art. 5(3) ePrivacy Directive).

4.4 Error Monitoring and Debugging Cookies

These cookies help us identify and diagnose technical errors in the Service. They capture error stack traces, browser environment data, and session context when a technical fault occurs.

Legal basis: Legitimate interest in maintaining a reliable and secure service (Art. 6(1)(f) GDPR), and consent for any third-party error monitoring tools.

4.5 Payment and Security Cookies

When you initiate a payment, our payment processor (Stripe) may set cookies on your device to facilitate secure transaction processing and fraud prevention. These cookies are set by Stripe and are governed by Stripe's own privacy and cookie policies.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest in fraud prevention (Art. 6(1)(f) GDPR).

4.6 Marketing and Advertising Cookies

At this time, [COMPANY NAME] does not use marketing or advertising cookies, does not engage in behaviorally targeted advertising, and does not share your data with advertising networks. If this changes in the future, we will update this policy, seek fresh consent where required, and provide clear opt-out mechanisms.

5. Third-Party Services and Their Cookies

Some cookies are set by third-party services that appear on or are integrated with our pages. These third parties have their own privacy and cookie policies, which we encourage you to review. We are not responsible for the content of third-party privacy policies or their data processing practices.

• Google Analytics (Google LLC, USA) — Website analytics. Cookies: _ga, _gid, _ga_[ID]. Privacy policy: policies.google.com/privacy. Google acts as a data processor under a Data Processing Addendum. Data may be transferred to the US under Standard Contractual Clauses.
• Stripe (Stripe, Inc., USA) — Payment processing. Cookies: __stripe_mid, __stripe_sid. Privacy policy: stripe.com/privacy. Stripe is an independent controller of payment data. Data may be transferred to the US under Standard Contractual Clauses.
• Sentry (Functional Software, Inc., USA) — Error monitoring (where enabled). Cookies: sentry_id. Privacy policy: sentry.io/privacy. Data may be transferred to the US under Standard Contractual Clauses.
• Content Delivery Network (CDN) — We use a CDN provider to cache and deliver static assets (images, JavaScript files, CSS). CDN edge nodes may set short-lived technical cookies to optimize routing. These contain no personal information.

6. Cookie Retention Periods

Cookies are retained only as long as necessary for their stated purpose. The following summarizes retention periods by category:

• Session Cookies: Automatically deleted when you close your browser. Used for authentication tokens, CSRF protection, and transient session data.
• Short-Term Persistent Cookies (up to 30 days): Used for authentication refresh tokens and short-lived payment security cookies.
• Medium-Term Persistent Cookies (31 days – 12 months): Used for consent records, language preferences, and first-party analytics identifiers.
• Long-Term Persistent Cookies (12 months – 2 years): Used for Google Analytics identifiers (_ga: 2 years). These are set only with your consent.
• Local Storage (no expiry unless manually cleared): Used for theme preferences, onboarding status, and dashboard layout. This data remains until you clear your browser storage or revoke consent via our Cookie Preferences panel.

When consent is withdrawn, we will delete or disable all non-essential cookies and local storage items controlled by us within a reasonable technical timeframe. Note that third-party cookies (e.g., Google Analytics) must be managed through the respective third party's opt-out tools.

7. How to Manage and Control Cookies

7.1 Cookie Preferences Panel

You can manage your cookie preferences at any time by clicking the "Cookie Preferences" link in the footer of our website, or by navigating to account settings if you are a registered user. From there, you can enable or disable specific categories of non-essential cookies.

Please note that disabling certain cookie categories may impair the functionality of the Service as described in Section 8.

7.2 Browser-Level Cookie Controls

All major web browsers allow you to manage cookies through the browser settings. You can typically:

• View all cookies currently stored on your device;
• Delete individual cookies or all cookies;
• Block all cookies from all websites;
• Block third-party cookies only;
• Allow cookies only from trusted websites;
• Configure your browser to notify you when a cookie is being set.

Instructions for the most common browsers:

• Google Chrome: Settings → Privacy and Security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Apple Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data

Note that blocking all cookies through your browser will prevent you from logging in and using most features of the Service.

7.3 Opt-Out Tools for Third-Party Analytics

You can opt out of Google Analytics tracking across all websites by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

For broader opt-out from online tracking, you may use tools such as:

• Your Online Choices (EU): youronlinechoices.com
• Network Advertising Initiative (US): optout.networkadvertising.org
• Digital Advertising Alliance (US): optout.aboutads.info

7.4 Do Not Track

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want to be tracked. Currently, there is no universal standard for how websites must respond to DNT signals. We respond to DNT signals by disabling analytics and non-essential tracking for that session where technically feasible. We encourage you to use our Cookie Preferences panel for explicit control.

7.5 Global Privacy Control (GPC)

If you use a browser or extension that sends the Global Privacy Control (GPC) signal — a standard supported under CCPA/CPRA for California residents — we treat this as an opt-out of the sharing or sale of personal information for that session, and will suppress non-essential analytics and tracking accordingly.

8. Impact of Disabling Non-Essential Cookies

You are free to reject or disable non-essential cookies. However, please be aware of the following potential impacts:

• Functional Cookies Disabled: Your language preference and theme (dark/light mode) will not be saved between sessions. You will need to re-select these on each visit. Your last-used task configuration will not be pre-populated.
• Analytics Cookies Disabled: We will be unable to measure how the Service is used, which may slow our ability to identify and fix usability issues. Your experience of the Service will not be impaired.
• Essential Cookies Disabled (via browser settings): You will not be able to log in or use authenticated features of the Service. Core functionality will be unavailable.
• Payment Cookies Disabled: You may experience difficulties completing payment transactions. Stripe requires its security cookies to process payments reliably.

9. Cookies and Children

We do not knowingly use tracking or analytics cookies to profile individuals under the age of 16. Where we are aware that a user is under 16, we restrict non-essential cookies to the minimum necessary for the operation of the Service. Parental or guardian consent is required for any non-essential data collection from users under 16, in accordance with GDPR Article 8, UK GDPR, and COPPA (for users in the United States under the age of 13).

10. International Transfers of Cookie Data

Some of our third-party cookie providers (e.g., Google Analytics, Stripe) may process data collected via cookies in countries outside of your jurisdiction, including the United States. Where personal data is transferred internationally, we ensure appropriate safeguards are in place:

• EU/EEA Users: Transfers to the US are made under EU Standard Contractual Clauses (SCCs) as approved by the European Commission under GDPR Article 46(2)(c).
• UK Users: Transfers are made under the UK ICO's International Data Transfer Agreement (IDTA) or equivalent addendum to EU SCCs.
• Turkish Users: International transfers are subject to KVKK Article 9 requirements. We rely on explicit user consent or adequacy safeguards approved by the KVKK Board for transfers to countries lacking adequate protection.

11. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in the technologies we use, legal requirements, or the services we offer. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Display a notice on the Service;
• Where required by law, re-request your consent for any new or materially changed cookie categories.

We encourage you to review this Cookie Policy periodically. Continued use of the Service after any update constitutes acknowledgment of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests related to our use of cookies or this Cookie Policy, please contact us at:

If you are unsatisfied with our response, you have the right to complain to your national data protection supervisory authority:

• EU: Your national DPA — full list at edpb.europa.eu
• UK: Information Commissioner's Office (ICO) — ico.org.uk
• USA (California): California Privacy Protection Agency — cppa.ca.gov
• Turkey: Kişisel Verileri Koruma Kurumu (KVKK) — kvkk.gov.tr