Cookie Policy
URly / urly.tr
Authoritative English version • Effective date: [INSERT EFFECTIVE DATE]
This Policy describes cookies and similar technologies used by URLy.
1. Essential cookies
URLy may use session and authentication cookies, CSRF/security-related session state and language or preference cookies.
2. Persistent technologies
Some preferences may be stored beyond a single session where needed for functionality.
3. Third-party tracking
URLy does not currently use Google Analytics, third-party advertising pixels or comparable third-party cross-site advertising/tracking platforms for user tracking.
4. Server-side analytics
URLy may process access and click information through its own infrastructure. Server-side analytics is not itself a browser cookie.
5. Browser controls
Users can disable or delete cookies through browser settings. Essential functionality may stop working.
6. Do Not Track
Do Not Track is not standardized across all environments; URLy does not promise a particular technical response to every DNT signal.
7. Future changes
If non-essential third-party tracking or advertising is introduced, this Policy and any required consent mechanism will be updated.
Session lifecycle
Session cookies may expire when a session ends or after a security timeout. Authentication cookies may be invalidated after password changes, account suspension, logout or suspected compromise.
Security attributes
All production cookies issued by URLy (including PHPSESSID, app_lang, and urly_terms_agreed) strictly enforce the Secure attribute (transmitted exclusively over encrypted TLS/HTTPS connections) and SameSite=Lax protection. Sensitive session and authentication cookies additionally enforce HttpOnly to prevent unauthorized access via clientside scripts.
CSRF protection
Where state-changing requests require CSRF protection, URLy may use session-bound tokens or equivalent safeguards. CSRF tokens should not be treated as authentication credentials.
Language preference
A language preference cookie may be used to remember the selected interface language. This is a functionality preference rather than advertising tracking.
Cookie rejection
Blocking all cookies may prevent login, account management or other essential functions.
Third-party content
A third-party destination opened after a Short Link may set its own cookies. Those cookies are controlled by the destination operator, not URLy.
Consent
Where applicable law requires consent for a non-essential cookie, URLy should obtain and record consent before setting that technology.
Policy review
Cookie inventories should be reviewed when the frontend, authentication stack, analytics implementation or third-party integrations change.