Cookie and Similar Technologies Policy

1. What Are Cookies and Similar Technologies?

Cookies are small text files stored by your browser when you visit a website. Similar technologies allow a website or app to store information on your device, such as your language or appearance preferences.

The mobile app stores sign-in information in your device's secure storage and preferences in app storage. It does not use browser cookies to keep you signed in. This policy covers these forms of storage as well as website cookies.

2. What Do We Use Them For?

We distinguish the records needed to provide the service from optional usage statistics. Remembering that you declined optional statistics does not give permission to collect them.

• Security and sign-in: keeping you signed in, completing sign-in through services such as Google or Apple, and preventing unauthorised requests. A short-lived security record also protects the screen where you make your privacy choices; it is not used to measure your activity.
• Your preferences: remembering settings you request, such as language and appearance, and whether you have declined optional usage statistics.
• Optional website usage statistics: where this option is available and you consent, recording information such as the features you use, time spent and technical errors to understand and improve the service. Temporary identifiers and device records support this process. These records do not include the content of your messages, reviews or searches, and are not used to target advertising.
• Optional mobile usage statistics: where available, the app offers a separate consent choice for similar information about app use and technical performance. Your website choice does not enable mobile collection, and your mobile choice does not enable website collection.
• Completing a withdrawal request: if your change cannot reach our servers immediately, we temporarily keep only the information needed to retry it. Collection stops on your device while the request is pending; this record cannot enable it again.

3. How Long Are Device Records Kept?

• Short-lived sign-in and privacy-choice security records: up to 10 minutes. Sign-in session records follow the service's session rules; language and appearance records remain until changed, expired or removed, depending on their function.
• The website record remembering that you declined optional usage statistics: up to 180 days. It does not contain an identifier that distinguishes you from other users and does not permit collection.
• Website consent and related device records: up to 180 days. Signing out, changing accounts, withdrawing consent or no longer meeting the consent requirements stops collection. If consent expires or the purposes and processing conditions it covers change, collection remains off until a new valid choice is made.
• Usage information waiting to be sent from the website or app: up to 24 hours. Website records used only for the current session or open tabs are short-lived. Mobile consent and installation records remain until consent is withdrawn or becomes invalid, the account changes or app data is removed.
• A pending withdrawal request is kept only until the server confirms it and device cleanup is complete. If a backup cookie is needed to retry a website request, its maximum lifetime is 180 days. Collection remains off throughout.
• Withdrawal stops new collection; deletion of previously collected information from our servers may finish later. A record used only to track completed account-related analytics deletion is kept for up to 90 days. Other server retention periods and limited exceptions are explained in the Privacy Notice.

4. How Can You Manage Your Choices?

Optional usage statistics remain off until you give separate, explicit consent. Reading the Privacy Notice or accepting the Terms or Community Rules does not give this consent. The choice is not preselected, and declining it does not prevent you from using the core service.

Where this option is available, it is offered only to signed-in members who have declared that they have reached their 18th birthday, accepted the current Terms and received the current privacy information. Age eligibility relies on your declaration; this step does not ask for an identity document or date of birth. Optional usage statistics remain off for guests and accounts that have not completed these steps.

You can manage the website choice using the preference controls on this page and the mobile choice in the app's Settings. You can withdraw consent as easily as you give it. The two choices are separate.

When you withdraw consent, collection stops on your device and the related optional records are cleared. If server cleanup is still pending, the preference screen shows this and retries the request without restarting collection. Previously used tracking or preference records are removed during cleanup and cannot be used as a new consent choice.

You can also manage or delete cookies through your browser and remove local app data through your device settings. Blocking records needed for sign-in or security may prevent the relevant features from working. Deleting device records alone is not a request to delete information already held on our servers; use the privacy controls or contact us to exercise your rights.

5. Legal Grounds and Service Providers

We process the information needed for sign-in and requested functions where necessary to perform the service agreement under Article 5(2)(c) of the Turkish Personal Data Protection Law (KVKK). Proportionate security measures rely on our legitimate interests under Article 5(2)(f), provided your fundamental rights and freedoms are protected. Optional website and mobile usage statistics each rely on your separate, explicit consent under Article 5(1).

These records are used for the purposes determined by BITESCORE. Service providers supporting functions such as hosting, storage and sign-in may process relevant information. The Privacy Notice explains the controller's identity, recipient groups, purposes of transfer, processing outside Türkiye and your rights. Giving optional analytics consent does not replace the safeguards required for transfers abroad.

6. Updates and Contact

This inventory is reviewed when providers or purposes change. A new optional category will not be activated before the required information and choice are provided. Questions may be sent to legal@bitescore.co.

7. Cookie Details

The names below help you identify these records in your browser. They are set by BITESCORE. for the purposes described above; they are first-party records. The optional records are created only when the relevant consent requirements are met.

• __Host-bs_session: keeps you signed in; until the session expires or you sign out.
• NEXT_LOCALE: remembers your language choice; up to one year.
• google_oauth_state, google_oauth_next; apple_oauth_state, apple_oauth_nonce, apple_oauth_next, apple_oauth_purpose: complete and protect a sign-in or account-confirmation step you request through Google or Apple; up to 10 minutes. These are BITESCORE. records, separate from cookies on those providers' own websites.
• bs_web_telemetry_presentation: protects the privacy-choice request; up to 10 minutes. bs_web_telemetry_preference: remembers a refusal; up to 180 days, without an identifier that distinguishes you from others.
• bs_web_telemetry_subject: supports the website usage-statistics choice after explicit consent; up to 180 days, subject to the earlier stopping conditions above.
• bitescore:web-telemetry:queue:v1: temporarily holds information waiting to be sent; up to 24 hours. bitescore:web-telemetry:session:v1 and bitescore:web-telemetry:leader:v1: coordinate the current session and open tabs. These are browser-storage records rather than cookies.
• bitescore:web-telemetry:withdrawal:v1: retries a pending withdrawal request until confirmation and device cleanup. If needed, bs_web_telemetry_withdrawal_pending serves the same limited purpose as a backup cookie for up to 180 days. Neither allows further collection.