Cookie Policy
This policy explains the cookies and similar technologies (including browser storage) used on TenderZoom, what they are used for, and how you can manage your preferences.
What are cookies and similar technologies?
Cookies are small text files that the sites you visit store in your browser. The same logic applies to browser storage such as localStorage and sessionStorage. This policy covers all of them together, because what matters for privacy is not the name of the technology but the fact that information is stored on, or read from, your device.
Categories
We group these technologies into four categories. Nothing outside the strictly necessary category runs before you allow it.
Strictly necessary
| Name | Provider | Type | Party | Purpose | Retention |
|---|---|---|---|---|---|
| tz_consent | TenderZoom | Cookie | First party | Stores your cookie preferences so your choice is applied and you are not asked again on every page. | 6 months |
| sb-<project-ref>-auth-token | Supabase (TenderZoom infrastructure) | Cookie | First party | Carries the authenticated user's session; never created for signed-out visitors. | Session / until token refresh expiry |
| sb-<project-ref>-auth-token-code-verifier | Supabase (TenderZoom infrastructure) | Cookie | First party | Holds the PKCE security verifier for the sign-in flow; created only during login and short-lived. | For the duration of the sign-in flow |
| NEXT_LOCALE | TenderZoom (next-intl) | Cookie | First party | Stores your chosen interface language (Turkish/English) so later pages open in the same language. | 1 year |
| ihale-shell-v3 (Cache Storage) | TenderZoom (Service Worker) | Cache storage (Cache Storage) | First party | Caches the page shell and static assets so pages open quickly and basic content remains available offline. | Until the cache version changes or you clear it |
| tz-chunk-reload:<path> | TenderZoom | Session storage (sessionStorage) | First party | When a new release makes an old file fail to load, reloads the page once to recover and prevents an endless reload loop. | Session (deleted when the tab closes) |
- tz_consent — Applying your choice requires storing the choice itself. Without it a rejection could not be remembered and you would be asked again on every visit.
- sb-<project-ref>-auth-token — Strictly necessary to provide the service the user explicitly requested (signing in and accessing their account). Without it, authentication is technically impossible. It is never created for a signed-out visitor.
- sb-<project-ref>-auth-token-code-verifier — A security measure (PKCE) protecting the authorization code from interception. Required to complete sign-in safely; it serves no tracking purpose.
- NEXT_LOCALE — Required to honour the language the user explicitly selected; it contains no identifier and performs no tracking. NOTE: where the language is auto-detected from the browser rather than chosen, this exemption is weaker — see the open item in docs/privacy-consent-architecture.md.
- ihale-shell-v3 (Cache Storage) — Stores content purely for technical delivery/performance; it holds no user identifier and performs no tracking. Responses the server marks `no-store`/`private` — including pages personalised for a signed-in user — are never written to this cache.
- tz-chunk-reload:<path> — A technical safeguard needed for the site to recover from an error; it stores only a timestamp and no personal data or identifier.
Functional
| Name | Provider | Type | Party | Purpose | Retention |
|---|---|---|---|---|---|
| theme | TenderZoom (next-themes) | Local storage (localStorage) | First party | Remembers your dark/light theme preference. | Until you clear it |
| demoSidebarCollapsed | TenderZoom | Local storage (localStorage) | First party | Remembers whether the tender list sidebar was collapsed. | Until you clear it |
| wsShellCollapsed | TenderZoom | Local storage (localStorage) | First party | Remembers whether the workspace sidebar was collapsed. | Until you clear it |
| intelHubCollapsed | TenderZoom | Local storage (localStorage) | First party | Remembers the intelligence page sidebar collapsed state. | Until you clear it |
| suppliers | TenderZoom | Local storage (localStorage) | First party | Remembers the suppliers workspace sidebar state. | Until you clear it |
| awards | TenderZoom | Local storage (localStorage) | First party | Remembers the awards workspace sidebar state. | Until you clear it |
| ihale_onboarding_dismissed | TenderZoom | Local storage (localStorage) | First party | Marks the dashboard onboarding tour as already shown. | Until you clear it |
Analytics
| Name | Provider | Type | Party | Purpose | Retention |
|---|---|---|---|---|---|
| _clck | Microsoft Clarity (Microsoft Ireland Operations Ltd.) | Cookie | First party | Holds the Clarity user ID and preferences for this site (session replay and heatmaps). | ~1 year |
| _clsk | Microsoft Clarity (Microsoft Ireland Operations Ltd.) | Cookie | First party | Joins multiple page views into a single Clarity session recording. | ~1 day |
| CLID, ANONCHK, MR, MUID, SM (Microsoft/clarity.ms alanında) | Microsoft Clarity (Microsoft Ireland Operations Ltd.) | Cookie | Third party | Third-party identifiers written by Microsoft on its own domain, used to tell browsers apart across Microsoft sites and for analytics. Created only with analytics consent and depending on Clarity's cookie mode. | Governed by Microsoft's policy (e.g. MUID ~1 year) |
Marketing
TenderZoom currently uses no technology in this category.
Third-party services
The following third-party services load only if you allow the relevant category. Until then, no request is made to them at all.
- Microsoft Clarity (Microsoft Ireland Operations Ltd.) — Third-party identifiers written by Microsoft on its own domain, used to tell browsers apart across Microsoft sites and for analytics. Created only with analytics consent and depending on Clarity's cookie mode. (Analytics)
Our consent approach
Non-essential technologies are not loaded until you allow them through an affirmative action. "Reject all" has the same prominence and is as easy to reach as "Accept all". Nothing is pre-ticked. You can withdraw your choice at any time; when you do, the relevant technologies are no longer run and whatever we can delete from your browser is deleted.
An honest note about what cannot be deleted
Our browser-side code can only delete data on our own domain that is exposed to JavaScript. Cookies written by a third party on its own domain, or marked HttpOnly, cannot be removed from here. That is precisely why the real protection is not running these technologies at all without your permission.
Changing your preferences
You can change your preferences at any time using the button below, or the "Cookie Preferences" link in the site footer. You can also manage or delete cookies from your browser settings.
Global Privacy Control (GPC)
If your browser or an extension sends a GPC signal, we treat it as a binding opt-out for marketing technologies. The marketing category is then kept off, and the interface tells you why.
Version and related documents
Consent version of this policy: 1. Your preference is stored in a first-party cookie named "tz_consent", which contains only that preference and carries no identifier or tracking value. If the categories or purposes change materially, the version is raised and you are asked again.