Cookie Policy

Last updated: 9 October 2026

In short

e-kariyerim uses only the three cookies the service needs to work. No advertising cookies, tracking pixels, analytics tools like Google Analytics, or any third-party cookies. That is why no cookie banner appears: there is no optional cookie to ask your consent for. The one exception is the Pro plan checkout: the payment form opens on PayTR's own page and PayTR may use its own strictly necessary cookies there; those cookies are not read on any other page of this site.

Under Turkish data protection law (KVKK), strictly necessary and functional cookies do not require explicit consent — what they require is disclosure. This page is that disclosure.

The cookies we use

Name	Purpose	Type	Duration
__Secure-ek_rt	Keeps you signed in. It holds a random session-renewal token that your browser sends only to our API server's (api.ekariyerim.com) session-renewal and sign-out addresses. No script on the page can read it (HttpOnly), and it is not sent with requests coming from another site (SameSite=Strict).	Strictly necessary — first party	30 days, renewed on each use, but never more than 90 days from when you signed in. Deleted when you sign out.
NEXT_LOCALE	Remembers which language a page opens in (Turkish/English). Our server writes it to match the language in the address bar, and updates it when you switch languages.	Strictly necessary — first party	Session: deleted when you close the browser
theme	Remembers your light/dark theme preference. Written only when you press the theme button, or when you sign in and the preference stored on your account is applied.	Functional — first party	1 year

The language and theme cookies store nothing but a preference and contain no identifier. The token in the session cookie matches your account, but its only job is keeping you signed in: it is not used for tracking or measurement. None of the three is sent to any third party.

Browser storage (localStorage and sessionStorage)

These are not cookies, but they store data on your device in the same way, so we list them here too:

Session profile — aa_user (your name, email address and interface preferences). It lets the right menu appear at once when a page reloads; on its own it signs nobody in. It lives in localStorage and is deleted when you sign out. Session tokens are no longer kept here but in the session cookie above; the old aa_access_token and aa_refresh_token values left in a browser signed in before 27 September 2026 are read and deleted on your first visit.
Sign-in security keys — aa_google_oauth, aa_linkedin_oauth and aa_github_oauth. These are single-use values that block a CSRF attack during a Google, LinkedIn or GitHub sign-in; they live in sessionStorage and are deleted the moment the sign-in completes.
Saved board views — aa_board_views. When you choose “Save this filter” on the applications board, the name you give the view and its filter settings (date range, source and state choices) are kept in localStorage. They are never sent to our server and stay in this browser only; deleting the view deletes them.

The first two are required for the service to work — without them you cannot sign in. The third is functional and is written only when you save a view.

Visit counter

We count how often the site's public pages are opened, and how often a few steps are taken on the site, on our own server. No cookie is used, nothing is written to your browser, and nothing is sent to any third party. Each time, only these four things are added to a counter:

What happened — a page was opened, or one of these steps: a sign-up button was clicked; a sign-up was started, completed, or its password was not accepted; a free tool showed its result (CV scan, benchmark, offer comparison, the "no reply" report); a share button was clicked.
The address of the page it happened on — public pages only. Everything after the question mark (a search term, the key in a password-reset link) is cut off before it leaves your browser.
The page's language — Turkish or English.
Which site you found us from — the domain only (“google.com”, say), never the address on that site or the words you searched for.

When a step is counted, its content is not sent: your CV score, the figures you type, the answers you give or your email address never reach this counter — only "this step was taken on this page".

None of this identifies you: no visitor id, no session id, no IP address and no browser details are stored. Two visits by the same person and one visit each by two people are therefore the same number to us, and a row can be linked neither to an account nor to another row. Even when you are signed in, this request carries none of your account's credentials.

Because no cookie is written, the consent screen promised in “If this policy changes” below is not triggered here — that promise covers optional cookies. We are describing the counter anyway, so you can read what it holds.

If your browser has “Do Not Track” switched on, nothing is counted at all.

Why we count: there is no other way for us to see whether anyone arrives, which article is useful, whether people who use a free tool go on to open an account, or whether people who try to sign up get stuck. Counter rows are aggregate and hold no personal data, so they are kept indefinitely.

Third parties and tracking

None of the following exist on this site:

Google Analytics, Meta Pixel, Hotjar or any comparable analytics/tracking tool.
Advertising cookies, retargeting or profiling.
Embedded third-party content (YouTube, Google Maps and the like) — we use none, so no cookies arrive behind them either.
Externally loaded fonts or scripts: fonts are bundled into our own server at build time, so your browser never calls Google Fonts.

The site's Content-Security-Policy only lets your browser connect to our own server, our own API and the error monitoring service; that list cannot grow quietly.

Error monitoring

We use Sentry so that we can diagnose unexpected errors. Sentry writes no cookie and stores nothing in your browser, but it does create a record when an error occurs. What is sent, where it goes and which legal basis it rests on is set out in detail in the error monitoring section of the Privacy Policy. Session replay and performance tracing are switched off; your browsing behaviour is not tracked.

How to remove cookies

You can delete this site's cookies and site data from your browser's settings at any time, and you can block cookies entirely. The effect: your language and theme preferences fall back to the defaults, and if you also delete the session cookie you are signed out and have to sign in again. Nothing else about the site stops working.

Deleting the data held in your account is a separate matter — you can do that by deleting your account from the Settings page.

If this policy changes

If we ever add an optional cookie for analytics, advertising or anything similar, we will update this page before adding it and turn on a consent screen where each category can be chosen separately and everything defaults to off. No such cookie will be written without your consent.

For everything else we hold about your account, see the Privacy Policy.

Contact

For questions about cookies, write to privacy@ekariyerim.com.