Cookie Policy
Version 1.0 · Effective: Draft Draft
This document is a draft under legal review. Fields in square brackets will be completed after approval.
1. What is a cookie?
A cookie is a small text file saved in your browser when you visit a website. Browser storage (localStorage) works in a similar way. In this policy we call both "cookies".
This policy is based on the Turkish Personal Data Protection Authority's Guide on Cookie Practices (2022) and Turkish Law No. 6698 (KVKK). For visitors from the EEA/UK it is also written with the ePrivacy rules and GDPR in mind. The data controller is Barboros Yazılım ve Pazarlama Teknolojileri (BYPT). For general information see the Privacy Policy and the Data Protection Notice.
2. Our cookie categories
| Category | What it does | Consent needed? |
|---|---|---|
| Strictly necessary | Lets you sign in, keeps things secure and makes the service you asked for work | No, always on |
| Preferences | Remembers settings you chose (e.g. video speed) | Yes |
| Analytics | Measures how the site is used | Yes |
| Marketing | Ad measurement and targeting | Yes — not used at the moment |
The legal basis for strictly necessary cookies is performing our contract with you and our legitimate interest in providing the service securely (KVKK Art. 5/2-c and 5/2-f). All other cookies are used only with your explicit consent (KVKK Art. 5/1; for EEA/UK visitors, consent under the ePrivacy rules and GDPR Art. 6(1)(a)).
3. Cookies we use
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
| __Host-sid | Cookie | Keeps you signed in | 30 days | Strictly necessary |
| flash | Cookie | One-time on-screen message | 10 seconds | Strictly necessary |
| mfa | Cookie | Two-factor sign-in step | 5 minutes | Strictly necessary |
| gstate | Cookie | Protection against forged requests (CSRF) for Google sign-in | 10 minutes | Strictly necessary |
| consent | Cookie | Stores your cookie choices | 12 months | Strictly necessary |
| mh-queue | localStorage | Queues your progress while you are offline | Until sent | Strictly necessary (service you requested) |
| mh-rate | localStorage | Your video playback speed preference | Until you clear it | Preferences |
| _ga, _ga_* | Cookie (Google Analytics 4) | Measuring site usage | Up to 14 months | Analytics — only with consent |
Marketing cookies: We do not use any marketing cookies at the moment. If we start using them in the future (for example Google Ads or Meta), we will update this table and ask for your consent separately. [KARAR: update table and consent text if marketing cookies are introduced]
4. How Google Analytics works here
- Google Tag Manager and Google Analytics 4 tags are not loaded at all until you consent to analytics cookies.
- We use Google's "Consent Mode v2" in basic mode. This means no data is sent to Google without consent.
- If you consent, usage data is transferred to Google LLC (USA). On international transfers see section 10 of the Privacy Policy.
4a. On-site experiments
If you consent to analytics cookies, we may place you in an experiment group to measure which of two versions of the site is clearer (for example, the card or price format). No new cookie is used: a hash of the anonymous ID in the consent cookie is used, it is not linked to your account, it is kept for at most 180 days and it is deleted when you withdraw consent. Prices themselves do not change in an experiment. Without consent you see the standard version and are not counted.
5. Embedded videos
Course videos are played through Vimeo, and some through YouTube's privacy-enhanced version (youtube-nocookie). When you play a video, these services receive your IP address and playback data and may use their own cookies or similar technologies. Their own privacy policies apply.
[KARAR: technically confirm which cookies or storage the Vimeo and YouTube players use (e.g. Vimeo "dnt" parameter); if any are not strictly necessary, decide their category and consent flow]
6. The cookie banner and your choices
When you first visit the site you see a cookie banner:
- "Accept all", "Reject" and "Settings" are equally prominent.
- No box is pre-ticked.
- If you choose "Reject", only strictly necessary cookies are used and the site keeps working.
- With "Settings" you can choose each category separately.
You can change your choice or withdraw consent at any time with the "Çerez tercihleri" (cookie preferences) link at the bottom of every page. Withdrawing consent does not affect the lawfulness of earlier processing.
7. Record of consent
To be able to show that you accepted or rejected cookies, we record: a hash of an anonymous ID, your choices, the policy version and the time. This record does not contain your name or e-mail. Retention: [KARAR: retention period for cookie consent proof].
8. Browser settings
You can also delete or block cookies in your browser settings. If you block strictly necessary cookies, some features such as signing in may not work.
9. Changes and contact
We may update this policy; the version number and effective date are shown at the top of the page. If there is a significant change (for example a new cookie category), we will ask for your consent again.
Questions: [email protected].
The Turkish version of this policy prevails if there is any conflict between the two versions.