Cookie Policy

Cookies are small text files your browser stores when you visit a website. PQC Imza uses the cookies the Service needs to work and, only if you allow it, Google Analytics cookies that show us how the public pages and the dashboard are used. We use no advertising or tracking cookies.

On your first visit a cookie banner asks for your choice. Rejecting analytics is one click, exactly like accepting it, and the analytics switch under "Preferences" starts off. Until you accept, Google's script is not loaded and nothing is sent to Google. Change your cookie settings: you can do this at any time, from the "Cookie settings" link at the foot of every page.

Strictly necessary cookies

Cookie	Purpose	Lifetime
pqc-imza-session	Holds your session and language choice; recognises you once you are signed in.	Ends after 2 hours of inactivity
XSRF-TOKEN	A security token that stops other sites acting on your behalf (CSRF protection).	2 hours
remember_web_…	Keeps you signed in; removed when you sign out.	Until you sign out, at most 400 days
sign_in_locale	During Sign in with Apple, carries your language so the page you return to from Apple opens in it.	10 minutes; removed once you are signed in
zx_consent	Remembers your cookie choice, with the version of this policy and the date, so we do not ask again on every page.	6 months

The legal basis for these cookies is that they are necessary to provide the service you asked for (KVKK Art. 5(2)(c)). You can block cookies in your browser, but you will then be unable to sign in or sign documents.

Analytics cookies (only with your permission)

Cookie	Purpose	Lifetime
_ga	Google Analytics 4 (Google LLC, USA): tells one browser's visits apart.	2 years
_ga_5P2X21YMVX	Google Analytics 4 (Google LLC, USA): keeps the state of a visit.	2 years

They are set only on the public pages (home, pricing, blog, sign-in, these legal pages) and on the dashboard and credits pages, and only after you accept analytics. Pages that show your documents or signatures never load Google Analytics: documents, the document builder and its AI assistant, a document's payment pages, signing, the profile, document verification and the admin area. With your permission Google receives the address of the page (without its query string, and with ids and tokens removed) and its title, the page you came from, browser and device details, an approximate location derived from your IP address, and sign-up, checkout and purchase events (amount, currency, product and an order number; never a document, your name, email address or card details). Google signals and ad personalisation are off. Google Analytics keeps user- and event-level data for at most 14 months.

The legal basis is your explicit consent (KVKK Art. 5(1); GDPR Art. 6(1)(a) where it applies). The data is transferred to the United States, for which Türkiye's Personal Data Protection Board has not adopted an adequacy decision, so it may not be protected there as it is in Türkiye; the transfer rests on your consent. Withdrawing it stops analytics on that page, keeps it from loading again and deletes the _ga cookies the site can remove. Saying no does not affect your use of the Service.

Third parties

• Stripe: when you pay, you are sent to Stripe's own page. Stripe uses its own cookies to prevent fraud; they are governed by Stripe's privacy policy.
• Google: Google sign-in happens on Google's pages under Google's policies. Google Analytics runs only with your permission, as described above. Our fonts are served from our own site, so loading a page sends no request to Google Fonts.

For how your personal data is processed, see the Privacy Policy and, for users in Türkiye, the KVKK Notice.