Cookie Policy
Last updated: September 2026
What are cookies
Cookies are small text files a website stores on your device. We also use two related browser storage mechanisms - localStorage and sessionStorage - and treat them under the same rules as cookies, because they do the same job.
The three categories we use
We group everything into three categories. Only the first one is set before you decide. Analytics and marketing stay completely switched off until you choose to turn them on.
1. Strictly necessary (always on)
These make the site work: signing in, keeping your session, protecting forms, and remembering the cookie choice itself. They cannot be switched off, and we do not ask for consent for them because the site cannot be delivered without them.
| Cookie / signal | Provider | Purpose | Lifetime |
|---|---|---|---|
| ft_consent | FromTurk (first-party) | Stores your cookie choice so we do not ask again on every page. | 180 days |
| next-auth.session-token / __Secure-next-auth.session-token | FromTurk (first-party) | Keeps you signed in to your buyer, supplier or agent account. | Session / 30 days |
| next-auth.csrf-token / __Host-next-auth.csrf-token | FromTurk (first-party) | Protects sign-in and form submissions against cross-site request forgery. | Session |
2. Analytics (off until you accept)
These tell us which categories buyers actually look at and where pages lose people. We do not use them to identify you individually, and we do not sell this data.
| Cookie / signal | Provider | Purpose | Lifetime |
|---|---|---|---|
| _ga, _ga_* | Google Analytics 4 (Google Ireland Ltd.) | Counts visits, tells returning visits apart and shows which pages and categories are used. | Up to 2 years |
| _clck, _clsk, CLID, MUID | Microsoft Clarity (Microsoft Ireland Operations Ltd.) | Aggregated heatmaps and session replay so we can see where pages confuse people. | 1 day to 1 year |
| FromTurk visitor identifier | FromTurk (first-party) | A random visit identifier for our own traffic counter. It is not linked to your account and no identifier is stored if you decline analytics. | Browser session |
3. Marketing (off until you accept)
Advertising measurement and remarketing signals. We run Google Consent Mode v2, so these signals are transmitted as denied until and unless you accept this category.
| Cookie / signal | Provider | Purpose | Lifetime |
|---|---|---|---|
| Google advertising signals (ad_storage, ad_user_data, ad_personalization) | Google Ireland Ltd. | Measuring whether an advert led to a sourcing request, and building audiences for remarketing. These signals stay switched off unless you accept marketing. | Up to 2 years once enabled |
How we ask, and where
If you visit us from the EEA, the United Kingdom, Switzerland or Türkiye, we show a consent dialogue on your first visit and set nothing beyond the strictly necessary cookies until you answer it. Accepting and rejecting are offered with equal prominence.
Outside those countries we show a dismissible notice instead: analytics is switched on and marketing stays off, and you can turn analytics off at any time from the same panel. Wherever you are, your choice is recorded in the ft_consent cookie and in theft_consent_v1 localStorage entry, and we ask again after 180 days or whenever the categories change materially.
Changing or withdrawing your choice
You can reopen the panel at any time and change any category. Withdrawing consent is as easy as giving it, and it takes effect immediately - the analytics scripts stop receiving data on the spot.
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will stop you from signing in.
Legal basis
For visitors in the EEA and the UK, storing or reading anything that is not strictly necessary relies on your consent under the ePrivacy Directive, and any resulting personal data is processed under Article 6(1)(a) GDPR. For visitors in Türkiye, the same applies under KVKK Article 5(1) (explicit consent), with strictly necessary cookies relying on Article 5(2)(f).
Third-country transfers
Google and Microsoft may process analytics data outside your country, including in the United States, under the EU-US Data Privacy Framework and standard contractual clauses. If you decline analytics, no data is sent to either of them.
Questions
Write to [email protected]. See also our Privacy Policy and KVKK notice.