Cookie Policy

Cookies are small text files saved in your browser when you visit a site. Whispi uses two kinds of cookies: strictly necessary cookies for the site to work, and analytics cookies (Google Analytics) that run only with your explicit consent. It does not use advertising, retargeting or profiling cookies.

This policy explains the cookies and similar technologies (local storage, push registrations) used on whispi.io and its subdomains. It has been prepared on the basis of the Personal Data Protection Authority's Guide on Cookie Practices and supplements the KVKK Privacy Notice. The data controller is Hertz Teknoloji Medya Yayıncılık Pazarlama ve Ticaret A.Ş.

The following cookies are strictly necessary: the site does not work without them, or cannot perform a function you have asked for. Under the Guide, explicit consent is not required for strictly necessary cookies; if they are turned off, the related function does not work. Analytics cookies are explained separately in section 4.

• Session cookie (__Secure-whispi.session_token)

  Purpose

  Recognising a signed-in Member and keeping the session open

  Duration

  30 days

  Set by

  Whispi

• Guest cookie (whispi.guest)

  Purpose

  Letting a guest asker write follow-ups to their own question and enforcing blocks

  Duration

  1 year

  Set by

  Whispi

• Cookie preference (whispi_consent)

  Purpose

  Remembering your cookie preference

  Duration

  1 year

  Set by

  Whispi

• Language (NEXT_LOCALE)

  Purpose

  Remembering the interface language you chose

  Duration

  1 year

  Set by

  Whispi

• Theme (theme)

  Purpose

  Remembering your light/dark theme preference

  Duration

  1 year

  Set by

  Whispi

• Cloudflare security cookies

  Purpose

  Bot and attack protection, security verification

  Duration

  Between the session and 1 year

  Set by

  Cloudflare

The session and guest cookies are set as httpOnly and Secure; that is, they cannot be read by scripts in the browser and are only sent over an encrypted connection. The cookie preference, language and theme cookies are not httpOnly so that the interface can read them, and they contain no personal data. Only a digest (hash) of the guest cookie, not the cookie itself, is stored on the server.

Important note about the guest cookie: If you later sign in to an account from the same browser, the questions, blocks and cookie preference linked to your guest cookie are transferred to your account. If you do not want this, clear your cookies before signing in.

Cloudflare Turnstile. Cloudflare Turnstile is used for bot verification for guest questions, guest image uploads, registration, password resets and forms. Turnstile generates a verification token by sending certain features of your browser and your IP address to Cloudflare; it does not show a CAPTCHA and does not track you across sites.

Klipy (GIFs). GIFs in a question or answer are loaded directly from Klipy's servers. When you view a page containing a GIF, your browser sends a request to Klipy; with this request, your IP address and browser information reach Klipy. Whether Klipy sets its own cookies is governed by Klipy's policy.

Web push notifications. If you turn on push notifications, your browser (the push service of Google, Apple or Mozilla) generates a subscription address, and this address is stored at Whispi. The notification content is end-to-end encrypted; the push service only sees the address and the time of sending. You can cancel the subscription at any time from your browser settings or Whispi settings.

Sign in with Google. When you sign in with Google, Google uses its own cookies; these are governed by Google's privacy policy. Whispi cannot access these cookies.

Local storage. Whispi keeps some interface settings in your browser's local storage (localStorage): your theme preference, a maintenance announcement you dismissed, notification permission prompts and in-app browser notices you postponed, your recent searches, the state of the profile sharing tip, your Broadcast Mode link and your Broadcast Mode display settings (text size, theme, layout, position, duration, language). The email address you enter during registration and an analytics event waiting to be sent after sign-in are kept in session storage (sessionStorage) only while that tab is open. This data stays only on your device, is not sent to the server and is deleted when you clear your browser data. Because the Broadcast Mode link is a secret link, we recommend clearing your browser data if you used Broadcast Mode on a shared computer.

Whispi does not use any advertising or behavioural tracking technology. Ads are placed manually by the team; impressions and clicks are kept only as totals, with no record per person or IP address.

Whispi uses Google Analytics 4 to understand how the site is used. These cookies work only with your explicit consent: in the cookie notice shown on your first visit, the analytics option is off by default, and no analytics cookie is placed unless you turn it on. Not giving consent does not restrict any function of the site.

• _ga

  Purpose

  A random identifier to tell visitors apart

  Duration

  2 years

  Set by

  Google

• _ga_<property ID>

  Purpose

  Keeping the session state

  Duration

  2 years

  Set by

  Google

Data sent to Google Analytics: page view and interaction events, approximate location (city level), device and browser information, and a randomly generated cookie identifier. Google Analytics 4 does not store IP addresses. Whispi does not send Google Analytics any data that reveals your identity, such as your username, email or question content, and keeps Google Signals / advertising features turned off. The data is processed by Google LLC (USA); the legal basis for the transfer abroad is your explicit consent, and the details are in section 6 of the Privacy Notice.

You can withdraw your consent at any time:

• Members: by turning off the Analytics cookies switch under Settings > Questions & privacy > Cookies.
• Guests: from the "Cookie preferences" link at the bottom of the page.
• Everyone: by deleting cookies starting with _ga in your browser or by using Google's browser add-on.

When consent is withdrawn, no new data is sent; data collected earlier is deleted automatically in Google Analytics after 14 months.

Within Whispi: You can set and change your preference through the cookie notice shown on your first visit and, for Members, through Settings > Questions & privacy > Cookies. For Members, only the latest preference is stored on the account, together with its date. A Guest's preference is kept only in the preference cookie (whispi_consent) of their own browser; if you open an account from the same browser, this preference is transferred to your account.

From your browser: All modern browsers let you view, delete and block cookies. If you block strictly necessary cookies, you cannot sign in, cannot write follow-ups as a guest and your preferences are not remembered.

• Chrome

  Settings path

  Settings > Privacy and security > Third-party cookies / Site data

• Safari

  Settings path

  Preferences > Privacy > Manage Website Data

• Firefox

  Settings path

  Settings > Privacy & Security > Cookies and Site Data

• Edge

  Settings path

  Settings > Cookies and site permissions

Push notifications: Can be turned off from Whispi settings or from your browser's site permissions.

Strictly necessary cookies are processed under KVKK Art. 5/2-c (performance of a contract) and Art. 5/2-f (legitimate interest: secure and functional operation of the site). Analytics cookies are processed under KVKK Art. 5/1 (explicit consent); consent is given when you actively tick the analytics option in the cookie notice, and a record of it is kept.

Data collected through cookies is kept in your browser for the cookie durations given in the table above, and on the server side for the periods in section 7 of the Privacy Notice (session records, guest record, cookie preference).

To exercise your rights regarding cookies and your personal data, you can apply to kvkk@whispi.io. The details are in the KVKK Privacy Notice.

This policy is version 1.0 and is effective as of November 13, 2026. If a new type of cookie or a new third party is added, we will present it for your explicit acceptance at sign-in or in the cookie notice; we announce other significant changes with an in-app notification; for minor corrections only the version and date on this page are updated.