This English version is provided for convenience. If it differs from the Turkish version, the Turkish version prevails.
1. About this policy
This policy explains what the website (https://eventora.com.tr), the web app (https://app.eventora.com.tr) and the iOS and Android mobile apps provided by IRON LABS TEKNOLOJİ ANONİM ŞİRKETİ (“Eventora”, “we”) store in your browser or on your device. It was prepared with the Turkish Personal Data Protection Authority’s Guide on Cookie Practices in mind.
In short: our website uses no cookies at all and contains no analytics or advertising tools. The web app and the mobile apps store only what sign-in, security and the preferences you choose require. We use no cookies or similar technologies for analytics, advertising, or tracking you across other sites.
How your personal data is processed in general is described in the Privacy Policy and the KVKK Privacy Notice.
2. What are cookies and similar technologies?
A cookie is a small text file that a website saves in your browser and can read on later visits. Other technologies serve similar purposes:
- Local storage (localStorage): small records in the browser that stay until you delete them. Unlike cookies, they are not sent to the server automatically.
- Session storage (sessionStorage): records deleted when you close the tab or the browser.
- IndexedDB: a small database in the browser.
- Device storage in the mobile app: information the app saves in its own area on your phone or in secure areas such as the iOS Keychain.
In this policy we call them all “cookies and similar technologies”.
We group them by purpose:
- Strictly necessary: needed for you to sign in, for your session to continue and for the service to be secure. The service does not work without them.
- Functional: remember preferences you choose, such as theme, language or date format. They are created only when you make a choice or use the app.
- Analytics and advertising: we don’t use any.
3. Website (https://eventora.com.tr)
Our website sets no cookies at all in your browser and uses no analytics, advertising or tracking tools. Only when you make a choice, the theme you chose and whether you paused the animations are kept in your browser’s local storage, so they are remembered on your next visit. The language is part of the page’s address (English pages are under /en/) and is not stored separately. This information is not sent to us.
| Name / type | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
eventora-theme / local storage | Eventora | Remembering the light or dark theme you chose | Until you delete it | Functional |
eventora-motion / local storage | Eventora | Remembering that you paused the animations | Until you delete it | Functional |
Demo request page: This page embeds Cal.com’s booking calendar. The calendar loads from Cal.com’s own domain (app.cal.com), and Cal.com may use cookies or local storage on its own domain for the booking form to work. These are covered by Cal.com’s privacy policy. Cal.com is not loaded on any other page of our site.
4. Web app (https://app.eventora.com.tr)
The web app uses Google’s Firebase Authentication and Firebase App Check to sign you in and keep your account secure, and Google reCAPTCHA Enterprise for App Check. Everything the app stores in your browser is listed below.
| Name / type | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
__session / cookie (httpOnly, Secure, SameSite=Lax; api.eventora.com.tr) | Eventora (Firebase session cookie) | Keeping you signed in after you sign in; JavaScript cannot read it | 14 days or until you sign out | Strictly necessary |
firebase:authUser:…:[DEFAULT] / local storage | Google Firebase Authentication | Your sign-in state in Firebase (user id, name, email or phone, sign-in tokens) | Until you sign out | Strictly necessary |
firebase:pendingRedirect:…, firebase:redirectUser:… / session storage | Google Firebase Authentication | Completing a redirect sign-in with Google or Apple | Until sign-in completes or the tab closes | Strictly necessary |
eventora.auth.redirect / session storage | Eventora | Making sure a redirect sign-in is completed when a pop-up was blocked | Until sign-in completes or the tab closes | Strictly necessary |
firebase-app-check-database / IndexedDB | Google Firebase App Check | Storing the token that shows the app is the genuine Eventora app; preventing automated attacks | The token is valid for 1 hour and renews itself | Strictly necessary |
firebase-heartbeat-database / IndexedDB | Google Firebase | Adding the Firebase software’s version and the dates on which it was used to requests made to Firebase | At most 30 entries; older ones are deleted | Strictly necessary |
_GRECAPTCHA / cookie (www.google.com) | Google reCAPTCHA Enterprise | Risk analysis to detect bots and automated attacks | 6 months | Strictly necessary (security) |
rc::a, rc::b, rc::c, rc::d-… / local and session storage (www.google.com) | Google reCAPTCHA Enterprise | Detecting bots and automated attacks | For the session or until you delete them | Strictly necessary (security) |
rsvp-session / local storage | Eventora | The theme and language you chose | Until you delete it | Functional |
i18nextLng / local storage | Eventora | The language you chose or that was detected from your browser | Until you delete it | Functional |
rsvp-preferences / local storage | Eventora | A copy of your date format, time format and time zone preferences (the real value is kept in your account), so the page looks right when it first opens | Until you delete it | Functional |
eventora-current-event / local storage | Eventora | The id of the event you opened last, so the app opens on it next time | Until you delete it | Functional |
eventora-billing-default / local storage | Eventora | The id of the billing profile you chose as default | Until you delete it | Functional |
The functional records in local storage stay only in this browser and are not sent to our servers. When you sign out, your Firebase sign-in record and session cookie are deleted; preferences such as theme, language, date format and the last event opened stay in the browser for your next sign-in.
5. Pages of other providers
At some steps you use a page that belongs to another provider, not Eventora. These pages may set their own cookies on their own domains, under that provider’s cookie policy:
- Signing in with Google or Apple: the pop-up uses Google’s or Apple’s sign-in page and Firebase’s sign-in domain.
- Payment: the payment page where you enter your card details belongs to iyzico; 3-D Secure verification happens on your bank’s page.
- Email links: email verification and password reset links may pass through Firebase’s page.
6. Mobile apps
Our mobile apps use no cookies, but they store some information on your device for sign-in and security. No advertising identifier, analytics tool, location or push notification service is used.
| Name / type | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| Firebase Authentication session / secure device storage (iOS Keychain, the app’s private area on Android) | Google Firebase | Storing your sign-in state and sign-in tokens | Until you sign out or delete the app | Strictly necessary |
| Firebase App Check token / device storage; App Attest and DeviceCheck on iOS, Play Integrity on Android | Google Firebase, Apple, Google | Verifying that the app is the genuine, unmodified Eventora app | Renewed when the token expires | Strictly necessary (security) |
| Google sign-in data / device storage | Storing your sign-in state if you signed in with Google | Until you sign out or delete the app | Strictly necessary | |
eventora-current-event.json / file in the app’s documents folder | Eventora | The id of the event you opened last | Until you delete the app | Functional |
The mobile app follows your phone’s settings for theme and language and does not store them separately.
7. Legal ground and consent
The cookies and similar technologies we use serve only strictly necessary and functional purposes:
- Strictly necessary ones are used to enter into and perform our contract with you (KVKK Art. 5/2-c) and for our legitimate interest in keeping the service secure (Art. 5/2-f).
- Functional ones are created to remember a choice you made explicitly (theme, language, date format, the event you opened) and stay only in your browser or on your device.
Because we use no cookies for analytics, advertising or tracking, we do not ask for your explicit consent and show no cookie consent banner. If we ever add such a cookie, we will ask for your explicit consent before using it and update this policy.
8. How to control cookies
You can see, delete or block cookies and site data in your browser’s settings:
- Chrome: Settings, Privacy and security, Third-party cookies or Site settings, Cookies and site data.
- Safari: Settings (Preferences), Privacy, Manage Website Data. On iPhone and iPad: Settings, Safari, Clear History and Website Data.
- Firefox: Settings, Privacy & Security, Cookies and Site Data.
- Edge: Settings, Cookies and site permissions.
Your browser also lets you delete one site’s data only. To delete what the mobile app stores, you can sign out of the app or remove it from your device.
If you block strictly necessary cookies and storage, you won’t be able to sign in to the web app, or you may be signed out repeatedly. If you delete functional records, only your preferences return to their defaults.
9. Changes and contact
We update this policy when the technologies we use change. The current version is always on this page, with the date of the last update at the top. For questions, write to kvkk@eventora.com.tr.