Cookie Policy

1. What Are Cookies?

Cookies are small text files that websites store in your browser. Essential functions such as keeping you signed in and remembering your cart are provided by cookies.

2. Our Approach: Strictly Necessary Cookies Only

Komshia adopts privacy by design. For this reason, only strictly necessary cookies are used on the Platform. Strictly necessary cookies do not require consent under the law; for transparency, we nevertheless list all of them below.

This does not mean that we measure nothing: we do measure page views and page-loading speed, but that measurement uses no cookies and therefore adds no cookie to the list below (section 5).

3. The Cookies on This Site

The list below is exhaustive: these are all the cookies the Platform writes. Cookies marked “for the duration of the session” are deleted when you close your browser.

• Session cookie (__Secure-authjs.session-token): used to authenticate you when signed in; stored for 30 days. HttpOnly, Secure, SameSite=Lax.
• CSRF protection cookie (__Host-authjs.csrf-token): protects your forms against forgery; for the duration of the session. HttpOnly, Secure, SameSite=Lax.
• Sign-in return cookie (__Secure-authjs.callback-url): keeps track of which page to return you to once sign-in completes; for the duration of the session. HttpOnly, Secure, SameSite=Lax.
• Cart cookie (komshia_cart): remembers your cart when shopping without an account; stored for up to 90 days. HttpOnly, SameSite=Lax.
• Language cookie (locale): remembers the language (TR/BG/EN) you picked with the language button on the page; stored for 1 year. SameSite=Lax.
• Language cookie (NEXT_LOCALE): holds, on the server side, the language read from the language prefix in the address; for the duration of the session. SameSite=Lax.

3.1. Why Are There Two Language Cookies?

They carry the same information but come from different places. The “locale” cookie is written in your browser by the language button on the page and remembers your preference permanently; the “NEXT_LOCALE” cookie is written by the framework that renders the page (next-intl) based on the language prefix in the address (/tr, /bg, /en). If your preference conflicts with the prefix in the address, we redirect you to the address of your preferred language. Both hold only a language code and contain no identity data.

4. What We Do Not Use

• We do not use advertising or targeting cookies.
• We do not use third-party analytics/tracking cookies (Google Analytics etc.); the visitor measurement we do run is cookieless (section 5).
• We do not use social media tracking pixels.

5. Cookieless Visitor Measurement

Visitor measurement (Vercel Analytics and Speed Insights): We use the built-in measurement tools of our hosting provider, Vercel, to see how often pages are viewed and how quickly they load. These tools use no cookies, write nothing to your browser and do not track you across sites; they create no persistent identifier and no user profile. What is measured: the address of the page you viewed, the referring address, country, device type, operating system, browser, screen size and page-loading speed values. Your IP address is not stored; it is processed only momentarily to derive the country and a daily-rotating, irreversible hash — so visitor counts are approximate and you are not recognised the next day. The data is shown in aggregate, is not used for advertising and is not sold. Because no cookies are used, this measurement does not require a cookie consent banner.

6. Third-Party Cookies (Payments)

At the payment step you are redirected to the secure payment pages of Stripe or iyzico. These providers may use their own necessary cookies for payment security and fraud prevention; see the relevant provider’s cookie policy for details.

Payment institutions are not the only third party: our hosting provider Vercel is a third party too and operates the visitor measurement described in section 5. That measurement, however, uses no cookies and writes nothing to your browser; its files are also served from the same origin as komshia.com.

7. Managing Cookies

You can delete or block cookies in your browser settings. However, if strictly necessary cookies are blocked, sign-in, cart and checkout functions will not work.

8. Legal Basis

Strictly necessary cookies are used without consent under GDPR Art. 6(1)(f) (legitimate interest) and the "strictly necessary" exemption in Art. 5(3) of the ePrivacy Directive, as well as KVKK Arts. 5/2-c and 5/2-f.

9. Changes and Contact

If our cookie usage changes, this page will be updated; if a cookie requiring consent is added, your consent will be obtained first. Questions: .