Cookie Policy
Version 1.1 · Effective date: 23 October 2026
This text explains what is written to your browser when you visit eflatun.ai, and to your device when you use the mobile app. The rule is simple: what the service needs in order to work is always on; measurement and session recording run only if you allow them.
1. What a cookie is
A cookie is a small record that a website leaves in your browser. Local storage (localStorage), session storage and device storage in mobile apps, which do similar work, are also covered by this policy. Below we simply call them all "cookies".
2. Cookies we use
There are two groups on the site: always on (needed for the service to work) and only with your permission (measurement and session recording).
2.1 Always on: strictly necessary and functional
Without these you cannot sign in, pay or stay secure, and the site cannot remember the language and appearance you chose. They cannot be turned off; our legal basis is the performance of the contract and legitimate interest.
| Name / purpose | What it does | Where it is stored | Duration |
|---|---|---|---|
| Session cookies (Supabase Auth) | Remembers that you are signed in | Cookie | For the session; deleted when you sign out |
| Network gateway and attack protection (Cloudflare) | Routes your request to the right server and protects against automated attacks | Cookie | Short-lived; the duration set by Cloudflare |
| Cookie preference | Remembers your choice in the cookie banner | Local storage | Until you change it or delete your browser data |
| Language and theme | Your choice of Turkish/English and light/dark appearance | Cookie and local storage | Until you change it |
| Chat and generation context | Kept on this device so that your latest chat and generation settings are not lost when you reload the page. If you are on a shared computer, we recommend clearing your browser data after signing out | Local storage | Until you delete it or clear your browser data |
| Error logging (Sentry) | When something breaks, sends us the context of the error (page, browser, version, account ID). IP address is not stored and your email address is masked | Error report sent to the server | 90 days on the server |
Why we put error logging in this group: a broken payment, a lost generation or a page that will not open can only be found and fixed with these logs. They collect personal data in minimised form and are not used for advertising or profiling.
2.2 Only with your permission: measurement and session recording
| Name / purpose | What it does | Duration |
|---|---|---|
| Vercel Web Analytics | Measures, in aggregate, how many times pages are viewed, the country and the device type. It does not use cookies; it distinguishes visitors with an anonymous 24-hour hash | 24 hours |
| Vercel Speed Insights | Measures, in aggregate, how fast pages load | Aggregate measurement; not linked to a person |
| Sentry session recording (Session Replay) | Records your on-screen activity with text and images hidden. It runs in sessions where an error occurs and, even without an error, in about one in ten sessions | 90 days on the server |
These are off by default. When you click "Accept all" in the cookie banner, or turn on "Measurement and session recording" in the preferences panel, all three run together. You can withdraw your permission at any time.
2.3 What we do not use
We do not use advertising cookies, third-party tracking pixels (Meta, Google Ads, TikTok), retargeting or cross-site tracking.
3. Mobile app
The mobile app does not use cookies; it keeps your session in the device's secure storage. Error logging (Sentry) also runs in the app; as on the site, it collects personal data in minimised form. Notification permission is given and withdrawn in the device's own settings.
4. How to change your preference
- A cookie banner appears on your first visit to the site. The "Necessary only" and "Accept all" buttons are equally prominent; you make your own choice with "Settings".
- Later, you can change it via the "Cookie preferences" link at the bottom of every page.
- You can delete or block cookies in your browser settings; if you block strictly necessary cookies, you will not be able to sign in.
When you change your preference, the tools you turned off stop working from that moment; data collected earlier is deleted within its own retention period.
5. Personal data
The personal data processed through cookies, the legal bases, where it is transferred and your rights are set out in the Privacy Policy. This policy has been prepared taking into account the cookie guidelines of the Turkish Personal Data Protection Authority.
6. Changes
If we add a new cookie or tool, we will update this text and the table; if a tool that requires permission is added, we will ask you again.
Last updated: 20 October 2026 · Version 1.1