Short answer
Data controller: WebTrustEngine (webtrustengine.com) — see the Privacy page for the full notice.
Nothing is written until you accept. The default state is declined: as long as you have not pressed “Accept all”, no measurement cookie is set, no persistent record of ours is created and no request leaves for Google. (One exception is outside our package — see “Cookies your hosting provider sets” below.)
If you accept, Google Analytics 4 (measurement ID G-3BK71Z6VVY) is loaded and writes two cookies — _ga and _ga_3BK71Z6VVY, each lasting about two years. What it measures is more than page views: With consent, GA4 Enhanced Measurement may emit file_download for a clicked link whose extension is on its default list, including common PDF, CSV and TXT targets. SVG, MD, WebP and PNG are not covered by default, and this site has no custom download tracking. The event records a qualifying click, not proof that a transfer completed.
Your decision itself is kept in localStorage under the key wte-riza — not a cookie, and never sent to the server. It holds three fields: your decision, its timestamp, and the version of the text you agreed to. The text version currently in force is 2026-08-20. It is valid for 12 months, and it also expires as soon as this text is published in a new version — in both cases the box appears again and measurement does not restart on its own.
The data is not anonymous. GA4 assigns your browser a client identifier, so the data is pseudonymous: you are not asked who you are, but the same browser is recognisable across visits. Ad personalisation and Google Signals are switched off in code.
Why a hard gate?
An analytics cookie is not “strictly necessary”; under Turkish data-protection law it requires explicit consent. So the measurement code is not merely set to a “denied” mode — it is not loaded at all until you accept. Google’s Consent Mode “denied” state is deliberately not used, because in that state a cookieless ping still reaches Google and your IP address still leaves the country.
The principle the engine teaches in its own privacy/cookie readiness domain is applied here: a banner shown while measurement already runs in the background is exactly what this site does not do. Declining is as easy as accepting — the two buttons are the same size, colour and weight, nothing is pre-selected, and closing the box is not consent.
What the banner asks — and what it does not
The box asks one thing only: may we measure your visit? There is a single category, because the site embeds no external player, map, video or font — there is no second purpose to ask about, and asking consent for something that does not exist would be misleading.
You can change your mind at any moment: the “Measurement preference” button in the footer of every page reopens the box. If you switch to declined, the _ga cookies are deleted and the page reloads, so measurement stops immediately.
If your browser blocks persistent storage (private mode, for instance), the box says so instead of failing silently — and measurement is not started, because a consent that cannot be recorded cannot be proven.
Embedded content
Pages embed no external players, social widgets or iframes; hence there is no surface where third parties could drop cookies. Video-related sections consist only of text and downloadable files.
Beyond the consented page-view count, improvement still leans on direct feedback (e-mail), server-side aggregate request counts and the public measurements of independent tools. Decisions are made by measuring the surface, not by following the individual — the site applying to itself the governance principle it describes.
Technical verification
Anyone can verify this independently. Before you accept: in browser dev-tools no _ga cookie exists and the Network tab shows nothing going to googletagmanager.com. After you accept: the same tabs show the _ga and _ga_3BK71Z6VVY cookies and a request to googletagmanager.com. After you switch to “Necessary only”: those cookies disappear again. Note that the hosting provider’s own script (below) may place its cookies regardless of your choice — so “Cookies” will not necessarily be empty, and we do not claim it will be.
For those taking verification one step further: the page source contains no line writing document.cookie and no construct producing Set-Cookie; the interface JavaScript does only menu, search and copy work, and the consent logic lives in a single readable file, assets/js/riza.js. Wherever doubt remains, the source code has the last word — and on this site, the source says the same thing the claim does.
For the more rigorous: not a single line in the page source writes document.cookie, and no Set-Cookie header originates from the site's files. The possibility of the hosting layer injecting a technical cookie of its own cannot be reduced to zero — that honest limit is stated here too; if you detect one, report it via the security page's channel and the configuration will be corrected.
What is a cookie? A short definition
A cookie is a small text file a site writes to your browser and reads back on later visits — used to keep sessions open, remember preferences or measure behaviour. The definition sits here only to make one thing plain: this site has none of those three needs and therefore runs none of that machinery.
Cookies your hosting provider sets
The site is served by a hosting provider (GoDaddy / secureserver) that appends its own traffic script — img1.wsimg.com/traffic-assets/js/tccl.min.js — to every HTML page as it is delivered. That script writes cookies of its own, typically _tccl_visitor, _tccl_visit and _scc_session.
Three honest points about it. It is not part of our package: the files we publish contain no such line, and you can confirm that by comparing the published archive with the served page. Our consent gate cannot block it, because it is added after our files leave us. And it does not feed Google Analytics — declining measurement still means no data reaches Google.
Removing it requires a request to the hosting provider; that request is open on the owner’s side. Until it is done, this page tells you it exists rather than pretending the browser stays empty.
How to turn measurement off
1 — On this site (primary route). Press “Measurement preference” in the footer of any page and choose “Necessary only”. The _ga cookies are deleted immediately and nothing further is sent.
2 — Browser settings. Blocking cookies, clearing site data or using a private window also stops it; nothing else on the site breaks, because no other feature depends on storage.
3 — Google’s own opt-out. The browser add-on at tools.google.com/dlpage/gaoptout disables Analytics across all sites.
If this ever changes
Should the cookie set ever change — a strictly necessary cookie, a new category, a different measurement provider — this page is updated first with the name, purpose and lifetime, and only then does the code change; per release discipline the change enters the manifest records. That order is a commitment, not a habit.
The engine's cookie lens
On reviewed sites the engine asks: is there a visible cookie notice, does the notice match actual behaviour, which domains do third-party calls reach? This page is those questions answered for this site: the notice exists (this page), behaviour matches it (nothing before consent, exactly the two declared cookies after), and the only third-party call — googletagmanager.com — is named here and happens solely with consent.
The consent gate has a cost and we do not hide it: visitors who decline are not counted, so the figures are an undercount rather than a complete picture. It is a deliberate trade — the visitor's right not to be tracked was valued above the completeness of the measurement.
Two frequent questions
'How do you remember my language?' We don't: language travels in the address (/ and /en/), nothing is written to your browser. 'Are my downloads tracked?' With consent, GA4 Enhanced Measurement may emit file_download for a clicked link whose extension is on its default list, including common PDF, CSV and TXT targets. SVG, MD, WebP and PNG are not covered by default, and this site has no custom download tracking. The event records a qualifying click, not proof that a transfer completed.