Cookie Policy
COOKIE POLICY
Version: v2.0
Effective date: 1 September 2026
Supersedes: v1.0 (29 June 2026)
---
1. SCOPE AND LEGAL BASIS
This policy explains the use of cookies and similar technologies on
`talkunify.com` and its subdomains.
It is governed by the ePrivacy Directive (2002/58/EC as amended) as
implemented in your country, together with the GDPR for any personal
data processed.
Two consequences follow, and they are not the same thing:
- ePrivacy governs *storing or accessing information on your device* —
regardless of whether that information is personal data
- GDPR governs what we then *do* with any personal data
Consent must be freely given, specific, informed and unambiguous, given
by a clear affirmative action (Art. 4(11) GDPR). Pre-ticked boxes,
scrolling and continued browsing are not consent.
---
2. ⚠️ WHAT WE ACTUALLY STORE — an honest note
Most of what this policy governs is not technically a cookie.
Our own application stores almost nothing in cookies. Your session and your
preferences live in your browser's local storage.
This changes nothing legally. The ePrivacy rules apply to *any* storing of
or access to information on a user's terminal equipment — local storage
included. We therefore treat local storage exactly as we treat cookies.
| Technology | How we use it |
|---|---|
| Local storage | Our main method — session, language, theme, cookie choice |
| HTTP cookies | Not set by our own application; set by our security layer (Cloudflare) and, with consent, by measurement tags |
| Pixels / tracking scripts | Only with marketing consent |
We say this plainly because "we don't use cookies" would be technically
true and substantively misleading.
---
3. CATEGORIES
| Category | Default | Consent required |
|---|---|---|
| Strictly necessary | Always on | No — Art. 5(3) ePrivacy exemption |
| Analytics | OFF | Yes |
| Marketing | OFF | Yes |
Nothing is pre-ticked. Analytics and marketing stay off until you turn them
on.
---
4. STRICTLY NECESSARY
Without these you cannot sign in, your preferences are not remembered, and
we cannot protect the platform from abuse. They cannot be switched off and
they are exempt from consent because they are strictly necessary to provide
the service you requested.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| `talkunify_auth` | Local storage | Keeps you signed in | Until sign-out or you clear browser data |
| `talkunify_cookie_prefs` | Local storage | Your cookie choice itself | Until cleared |
| `talkunify_remember_me` | Local storage | "Remember me" preference | Until cleared |
| Language and theme | Local storage | Interface language, light/dark mode | Until cleared |
| `__cf_bm`, `cf_clearance` and similar | HTTP cookie (Cloudflare) | Bot detection, attack filtering | Session – 30 days |
| Cloudflare Turnstile | HTTP cookie (Cloudflare) | Human verification on sign-in and sign-up | Short-lived |
⚠️ Your cookie choice is itself a stored record. Without it we would
have to ask you on every page load.
---
5. ANALYTICS — off by default
Purpose: understanding which pages are used, where people get stuck and
where errors cluster. The purpose is improving the product, not identifying
you as an individual.
| Provider | Tool | Data |
|---|---|---|
| Google | Google Analytics 4 via Google Tag Manager | Page views, session duration, referrer, device and browser type, truncated IP |
Legal basis: consent — Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy.
---
6. MARKETING — off by default
Purpose: measuring advertising performance and showing relevant ads.
| Provider | Tool | Data |
|---|---|---|
| Meta | Meta Pixel via Google Tag Manager | Visit and conversion events, device and browser data |
| Google | Advertising tags via Google Tag Manager | Conversion measurement, remarketing signals |
Legal basis: consent. This category also involves **transfers to the
United States; see our Privacy Policy**, section 6.
---
7. NOTHING LOADS WITHOUT CONSENT — a technical guarantee
This is the auditable part of this policy.
Third-party measurement and advertising scripts pass through a single gate
in our code. Nothing else in the application may inject a third-party script.
As a result:
- Until you consent, no request is made — the script is not added, the
provider's domain is not even resolved, and no cookie is written.
- Even once a container loads, Google Consent Mode v2 sets
`analytics_storage`, `ad_storage`, `ad_user_data` and `ad_personalization`
to `denied` by default. If you allowed analytics only, advertising tags
cannot write cookies.
- If you withdraw consent, loaded tags are stopped and the relevant
cookies are deleted. This is not deferred to your next visit.
- Your choice propagates to all open tabs.
⚠️ Why this is spelled out: our interface once offered a "Reject all"
button that had no technical effect. This policy now describes behaviour
that is enforced in code.
---
8. CHANGING YOUR MIND
You can change your choice at any time:
- "Cookie Preferences" in the site footer
- Profile → Privacy & Consent if you have an account
Refusing is as easy as accepting. "Accept all" and "Reject all" appear
side by side, at the same level and with the same prominence. Refusing does
not require extra clicks, hidden links or a trip into a settings menu.
Dismissing the banner is not consent: until you decide, analytics and
marketing remain off.
If this policy changes materially, we ask again — an old consent does
not carry over to a new scope.
---
9. THINGS YOUR BROWSER LOADS DIRECTLY
⚠️ These are not cookies, but we list them for honesty.
Some interface resources are downloaded by your browser **directly from
third-party servers**. Technically this means your IP address and browser
information reach that provider, even though nothing is stored on your
device.
| Resource | Provider | Purpose |
|---|---|---|
| `challenges.cloudflare.com` | Cloudflare | Turnstile human verification |
These are not consent-based, because they are necessary to display and
protect the page and serve no measurement or profiling purpose. They rely on
our legitimate interest in delivering a functioning, protected website.
✅ On 31 August 2026 the interface fonts and icons were moved to our own server. They were previously downloaded from `fonts.googleapis.com`, `fonts.gstatic.com` and `cdnjs.cloudflare.com`; they no longer are.
On the same date Cloudflare Web Analytics (RUM) was disabled; that script sent a request to `static.cloudflareinsights.com` on every page load.
Measured — clean browser profile, no cookie consent given: `https://talkunify.com/` sends no requests to any third-party host.
So a visitor who gives no consent connects only to our own server. The Turnstile exception above applies to the sign-in and sign-up forms only.
---
10. RETENTION
| Record | Duration |
|---|---|
| Local storage preferences | No expiry — kept until you clear them |
| Cookie choice stored on your account | Until the account is deleted |
| Consent proof record (time, source, IP) | 3 years after account deletion |
| Cloudflare security cookies | Session – 30 days |
| Google Analytics cookies | Up to 2 years (with consent) |
| Meta Pixel cookies | Up to 90 days (with consent) |
⚠️ Local storage has no expiry date. This is its practical difference
from an HTTP cookie and it deserves stating. Clearing your browser data
removes your preferences and the banner will appear again.
---
11. BROWSER CONTROLS
You can block or delete cookies and site data in your browser settings.
⚠️ Blocking strictly necessary storage means you cannot stay signed in, your
preferences are not remembered, and human verification may fail. This is a
technical consequence, not a restriction we impose.
---
12. YOUR RIGHTS
Your GDPR rights, including withdrawal of consent, are described in our
Privacy Policy, section 8. Withdrawal is as easy as giving consent and
does not affect the lawfulness of processing before withdrawal.
Contact: `kvkk@talkunify.com`