Cookie policy

Last updated: 27.10.2026

Metoraz AI & Consultancy · İzmir, Türkiye · info@thefinly.com

Scope

This policy describes the cookies actually set on www.thefinly.com, following the KVKK Authority Cookie Guideline (2022) and the GDPR / ePrivacy approach. The codebase has no localStorage or sessionStorage keys. There are no marketing, analytics or other non-essential trackers. Therefore no consent banner is shown.

Cookie and storage table

The rows below come from the middleware, the locale action and Auth.js (Credentials, JWT) defaults. OAuth-only PKCE or state cookies are not used.

NEXT_LOCALE
Purpose
Remembers the interface language (tr/en/de). Set by middleware and the language switcher.
Duration
1 year
Type
Strictly necessary
authjs.session-token, __Secure-authjs.session-token
Purpose
Keeps the signed-in session as a JWT. Set by Auth.js. On HTTPS production the __Secure- prefix is used.
Duration
Up to 12 hours; the session ends after 30 minutes without activity
Type
Strictly necessary
authjs.csrf-token, __Host-authjs.csrf-token
Purpose
Auth.js CSRF token that protects authentication requests. Production may use the __Host- prefix.
Duration
Session (browser session)
Type
Strictly necessary
authjs.callback-url, __Secure-authjs.callback-url
Purpose
Auth.js cookie that holds the post-login redirect URL.
Duration
Session (browser session)
Type
Strictly necessary

Name	Purpose	Duration	Type
NEXT_LOCALE	Remembers the interface language (tr/en/de). Set by middleware and the language switcher.	1 year	Strictly necessary
authjs.session-token, __Secure-authjs.session-token	Keeps the signed-in session as a JWT. Set by Auth.js. On HTTPS production the __Secure- prefix is used.	Up to 12 hours; the session ends after 30 minutes without activity	Strictly necessary
authjs.csrf-token, __Host-authjs.csrf-token	Auth.js CSRF token that protects authentication requests. Production may use the __Host- prefix.	Session (browser session)	Strictly necessary
authjs.callback-url, __Secure-authjs.callback-url	Auth.js cookie that holds the post-login redirect URL.	Session (browser session)	Strictly necessary

How to control cookies

These cookies are required for sign-in and language. You can delete them in the browser; that may sign you out or cause language to be chosen again from Accept-Language. There is no stored consent preference because there are no optional trackers.

Changes

If a non-essential cookie or tracker is added, this table will be updated and an opt-in banner with equally prominent Accept and Reject actions will be added. The preference will be stored and re-openable from this page.