Cookie policy

The cookie we always use

Why this counts as strictly necessary: one audit sends dozens of requests to the target site and spends roughly a minute of server time. Without a limit the service cannot stay free. The cookie exists to keep the service running, not to measure or market anything.

tp_day

Counts your free audits for the day — three of them. Its contents are two numbers: today’s date and how many audits you have run. It is signed on the server so it cannot be edited, it is HttpOnly so no script on the page can read it, and it expires by itself at midnight. It contains no identity, no IP address and nothing about the site you audited, and it cannot be used to follow you across sites.

Only if you connect the Search Console dashboard

These two belong to the dashboard alone. They are never written while you use the audit tool; they exist only if you start the “Connect with Google” step yourself.

tp_gsc

Holds the refresh token Google issued you, encrypted with AES-256-GCM. It is HttpOnly so no script on the page can read it, and Secure so it travels only over HTTPS. It expires by itself after 90 days, and “Disconnect” deletes it at once. The token is never written anywhere on the server.

tp_gsc_state

A single-use random value that stops the round trip to Google being tampered with (CSRF protection). It lives 10 minutes and is cleared once you return. It carries no identity.

What we do not use

• Statistics, measurement or advertising cookies: none are written.
• No session cookie, because there is no session: there is no login and no account.
• No localStorage or sessionStorage. The audit report lives only in the open tab’s memory and disappears when you reload.
• No Google Analytics, Tag Manager, Meta Pixel or any comparable tracking script is added to the page.
• Your language choice travels in the URL — /tr and /en — not in a cookie.

How to verify it

Open your browser’s developer tools and look at the Cookies list under Application (or Storage): tp_day appears only if you have run an audit, and tp_gsc only if you connected the dashboard. Browsing the pages writes no cookie at all, which you can check from a terminal:

curl -sSI https://teknikprime.online/en | grep -i set-cookie
# no output — the cookie is written only when an audit runs

The one external request, which sets no cookie

The page’s typefaces load from Google Fonts. That request sets no cookie, but it does mean your browser connects to Google, and your IP address is visible to Google in that connection. We say the same on the privacy page; self-hosting the fonts is on our roadmap.

Why there is no consent dialog

Cookie consent is required for cookies that are not strictly necessary to deliver the service the user asked for. We have no measurement, profiling or advertising cookie. The audit cookie counts the allowance for an audit you started; the dashboard cookies exist only because you asked to connect Google, and are written at the moment you do. Both are strictly necessary to the thing you requested, so there is nothing to ask about in advance. If measurement is ever added, this page and the privacy text change first, and only then is the corresponding consent mechanism added — in that order.