Draft — requires lawyer review. This list was extracted on 2026-10-31 from the AltumCode 66biolinks 72.0.0 code (site/app, site/themes, site/plugins: uses of
setcookie,$_COOKIE,set_cookie,localStorage,sessionStorage). Update it whenever the code changes. A decision is pending on the "unique visit counting" cookies (OZET.md, Decision 5). Placeholders are shared with the Turkish version.
Version: 0.1 (draft) · Effective: [YÜRÜRLÜK TARİHİ] · Controller: WebWorks 101 OÜ
1. The short version
- tappon uses no advertising or third-party analytics cookies. No Google Analytics, no Meta pixel.
- Almost all cookies we use are needed for the Service to work and stay secure, or they remember a choice you made (language, theme).
- Fonts and weather come from our own server, so your IP address is not sent to Google.
- If a bio page owner adds their own tracking code (pixel) or embedded content (YouTube, Spotify, maps, etc.), the page owner and that third party are responsible for those cookies (section 6).
2. What is a cookie?
A cookie is a small text file a website saves in your browser. Browser local storage (localStorage / sessionStorage) can serve the same purpose; we call all of these "cookies" here.
3. Strictly necessary cookies (no consent needed)
Needed for the Service to work and stay secure; blocking them breaks login, payment or security features.
| Name | Purpose | Duration |
|---|---|---|
PHPSESSID (session) |
Keeping your session and form security | Until the browser closes |
user_id, token_code, user_password_hash |
Keeping you signed in, only if you tick "Remember me" | [SÜRE: default 30 days] |
login_lockout, register_lockout, lost_password_lockout, resend_activation_lockout |
Temporary lock after repeated failed attempts (brute-force and spam prevention) | Configured lock time (minutes to days) |
link_password_{id} |
Remembering you entered the right password for a protected bio page | 30 days |
link_sensitive_content_{id} |
Remembering you accepted a sensitive-content warning | 30 days |
link_unlocked_{id} |
Remembering you passed the splash screen | 1 day |
cookie_consent_logged, cc_cookie |
Storing your cookie choice (if the banner is on; consent tool: wwcookie, wwcookie.com) | 182 days |
sessionStorage: email_collector_{id}, phone_collector_{id}, contact_collector_{id} |
Preventing the same form being sent repeatedly | Until the tab closes |
4. Preference cookies (created by your choice)
Created only when you make a choice, to remember it.
| Name | Purpose | Duration |
|---|---|---|
set_language |
Your chosen language | 30–90 days |
set_currency |
Your chosen currency | 30–90 days |
theme_style |
Light/dark theme | 90 days |
spotlight_has_results and localStorage (dashboard search) |
Remembering the dashboard quick-search state | 90 days |
dismiss_close_button_{id} |
Remembering you closed an alert on a bio page | Set by the page owner |
| localStorage (blog/tool ratings) | Remembering you already rated a post or tool | Until you clear it |
| sessionStorage (link and QR creation screens) | Not losing a half-filled dashboard form | Until the tab closes |
Admin panel only: dismiss_health_check, dismiss_smtp_setup, dismiss_version_updates, dismiss_inactive_support |
Remembering dismissed admin notices | 5–30 days |
5. Unique visit counting (first-party) — [DECISION 5 PENDING]
| Name | Purpose | Duration |
|---|---|---|
s_statistics_{id} |
Counting whether a bio page/link visit is unique or repeat within the same day | 1 day |
page_view_{id}, blog_post_view_{id}, t_statistics_{tool}, s_digital_wallet_{id} |
Preventing inflated view counts for pages, blog posts, tools and digital wallets | 1 day |
These cookies hold only a number/flag, no identifier, and are never sent to third parties. They may nonetheless not count as strictly necessary. Before launch one of two options will be chosen:
- [SEÇENEK 5A — recommended] Remove these cookies and count unique visits on the server with a 10-minute hash cache; this section is then deleted.
- [SEÇENEK 5B] Keep them but set them only with "Statistics" consent; without consent the visit is still counted, without the unique/repeat split.
6. Third-party cookies added by bio page owners
Bio page owners may add:
- Tracking codes (pixels): e.g. Meta, Google Analytics/Ads, TikTok, LinkedIn, Pinterest.
- Embedded content: YouTube (via the cookieless youtube-nocookie.com domain), Vimeo, Spotify, SoundCloud, TikTok, Twitch, Threads, Google Maps, etc.
When such content loads, the third party may set cookies under its own policy and your IP address is sent to it. The page owner and the third party are the controllers of these cookies; obtaining any required consent is the page owner's duty. tappon offers page owners [KARAR 6: an automatic consent banner on pages with pixels or embeds / a "click to load" placeholder].
7. Affiliate cookie — [KULLANILIYORSA]
| Name | Purpose | Duration |
|---|---|---|
referred_by |
Recognising the referring user at sign-up if you came via an affiliate link | [SÜRE: default 30 days] |
If an affiliate programme is launched, this cookie is not necessary and is set only with your consent.
8. Managing cookies
- Change your choice any time via "Cookie preferences" in the footer. [KULLANILIYORSA]
- Delete or block cookies in your browser settings; blocking necessary cookies may stop you signing in.
9. Contact
Questions: [email protected]. More on personal data: Privacy Notice.