Cookie Policy
1. Purpose and Scope
1.1. This Cookie Policy (the "Policy") has been drawn up in order to explain the scope, purposes and periods for which cookies and similar local storage technologies are used on the personal portfolio site published at the domain https://msgxr.dev (the "Site"), within the framework of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Guidelines on Cookie Practices (2022) published by the Turkish Personal Data Protection Authority (the "Guidelines").
1.2. The Site is a personal portfolio site operated by Muhammed Sina Gün (İstanbul), a natural person, with no commercial sales, membership or advertising activity. Comprehensive information on the processing of personal data is set out in the Privacy Notice under the KVKK separately published on the Site; this Policy governs only the matters relating to cookies and local storage technologies and is complementary to that text.
1.3. Any application or question concerning the Policy may be addressed to contact@msgxr.dev.
2. Definitions
For the purposes of this Policy:
a) Cookie: the small text file that a website places on the visitor's device through the visitor's browser and that can be read on subsequent visits;
b) First-party cookie: the cookie placed by the domain visited directly (msgxr.dev);
c) Third-party cookie: the cookie placed by a domain other than the domain visited;
ç) Strictly necessary cookie: the cookie that is essential for the site, or for a requested function of the site, to operate and the use of which, under the Guidelines, is not subject to explicit consent;
d) Local storage (localStorage): the browser technology that, unlike cookies, allows data to be stored solely on the visitor's device without being transmitted to the server with every request;
e) Visitor: the natural person who accesses the Site;
f) Cloudflare: Cloudflare, Inc., which operates the global infrastructure on which the Site runs.
These definitions apply throughout this Policy.
3. What Cookies Are and What They Do
3.1. Cookies are a standard internet technology that enables a website to recognise the visitor's browser on subsequent requests. Cookies may serve legitimate functions such as maintaining a session, remembering preferences and performing security checks, but on some sites they may also be used to track visitor behaviour and to target advertising.
3.2. As explained in the following articles, on this Site cookies exist only for the legitimate and limited functions in the first category.
4. The Site's Approach to Cookies
4.1. No cookies for advertising, tracking, behavioural profiling or targeting purposes are used on the Site. The Site code contains no Google Analytics or any other third-party analytics script; visitor counting consists of a single aggregate counter containing no persistent trace on an individual basis. The short-lived rate-limiting mechanism operated at the counter endpoints in order to prevent abuse is explained in Article 4.5 of the Privacy Notice under the KVKK.
4.2. The cookies used on the Site consist of those listed in the table in Article 5: the remembering of the language preference, the maintenance of the forum membership session and the security checks of the Cloudflare infrastructure.
4.3. Under the Guidelines, the explicit consent of the data subject is not required for the use of strictly necessary cookies and of cookies that are essential for the provision of a service requested by the user. The Cloudflare security cookies are strictly necessary for the requested form functions to be provided securely. The msgxr_lang cookie, on the other hand, is written only upon the visitor's explicit action of selecting a language; it is assessed as falling within the exemption recognised in the Guidelines for the personalisation of the user interface (a preference cookie set at the user's request). This cookie contains no data other than the language preference, is not used for tracking purposes and is not the subject of any record on an individual basis on the server. As no cookie requiring explicit consent is used on the Site within the framework of this assessment, there is no cookie consent banner on the Site.
4.4. Statement on cookie-like technologies: In addition to cookies, the Guidelines also cover similar technologies such as fingerprinting. On the Site, technical signals relating to the device and browser environment together with fingerprint hashes are processed solely at the moment the contact form is submitted and solely for the purpose of detecting unsolicited messages and automation; in addition, the server may request client hints (Client Hints) from the browser, but this information is recorded only during the submission of the contact form. This processing does not pursue any tracking or advertising purpose, is not used to follow the visitor's navigation on the Site on an individual basis, and its scope, legal basis and balancing test are explained in Article 4.1 of the Privacy Notice under the KVKK.
5. Cookies Used
5.1. The cookie written by the Site code and the cookies that the Cloudflare infrastructure may foreseeably place are shown in the table below; depending on the runtime behaviour of its security mechanisms, Cloudflare may also place additional infrastructure cookies not listed in the table (Article 5.3):
| Cookie | Source | Type | Purpose | Duration |
|---|---|---|---|---|
msgxr_lang | Site (first party) | Preference (user interface personalisation — set by the visitor's language selection action, Article 4.3) | Stores the visitor's language preference; the server reads this cookie solely in order to serve the language attribute of the page (<html lang>) correctly. | 1 year (max-age=31536000); path=/; SameSite=Lax; Secure |
msgxr_forum | Site (first party) | Strictly necessary (forum membership session — set by the server upon the member's act of verifying the sign-in link sent to their e-mail, Privacy Notice Article 4.8) | Carries the forum membership session; the server reads this cookie solely to identify the member on the forum endpoints. As it is HttpOnly, page scripts cannot access it; it is deleted by the server upon sign-out. | 30 days (max-age=2592000); path=/; SameSite=Lax; Secure; HttpOnly |
CF_Authorization | Cloudflare Access | Strictly necessary (security) | Carries an authentication token (JWT) solely for access to the site administration area (/admin); it has no function for the ordinary visitor and does not arise unless a login to the administration area is made. | Determined by the Cloudflare Access policy |
__cf_bm, cf_clearance | Cloudflare infrastructure | Strictly necessary (security) | Bot management and security verification (challenge). These cookies are not written by the Site code; they may be placed by Cloudflare itself on the pages where the Cloudflare Turnstile verification component is loaded (/contact, /guestbook and /forum) or where Cloudflare's security mechanisms are triggered. | Determined by Cloudflare |
5.2. The first-party cookies written by the Site code are limited to two: the msgxr_lang language cookie written on the browser side, and the msgxr_forum session cookie set by the server only when a forum sign-in is verified. No other first-party cookie is written by the Site.
5.3. Whether the Cloudflare cookies mentioned in the table are actually placed, as well as their names and durations, are subject to Cloudflare's runtime behaviour and are determined unilaterally by Cloudflare. For current and detailed information on these cookies, Cloudflare's own cookie and privacy documentation should be consulted; the Site owner has no power of disposition over the technical parameters of these cookies.
6. Local Storage (localStorage) Inventory
6.1. The Site keeps certain visitor preferences and interface states in the browser's local storage area (localStorage), without cookies. These records remain on the visitor's own device and — apart from the language preference exception in Article 6.3 — are not transmitted to the server. The Site does not use the sessionStorage technology at all.
6.2. The full list of local storage keys used is as follows:
| Key | Purpose | Sent to the server? |
|---|---|---|
lang | Language preference | No (but see Article 6.3) |
msgxr_visited_pages | List of pages visited (on-site achievement badge feature) | No |
msgxr_achievements | Unlocked achievements | No |
msgxr_contact_draft | Contact form draft (name, e-mail, message, subject) | No |
msgxr_blog_fs | Blog font size preference | No |
msgxr_last_visit, msgxr_visit_count | Local visit time and count ("welcome back" notice) | No |
msgxr_vim_nav | Whether single-key keyboard navigation (j/k/gg) is enabled | No |
msgxr_term_history_v2 | Command history of the terminal component | No |
msgxr_term_theme | Theme of the terminal component | No |
msgxr_theme | Light/dark theme preference | No |
6.3. Statement on the language preference: The preference in the lang key is mirrored to the msgxr_lang cookie so that the page can be served with the correct language attribute on the server side; the only value the server reads is this preference value.
6.4. Statement on the form draft: The msgxr_contact_draft key stores the name, e-mail, message and subject entered while the contact form is being filled in, solely on the visitor's device, so that they are not lost if the form is left incomplete. This draft is deleted once the form is submitted; for messages of the security notification type no draft is stored at all. There is no question of the draft being transmitted to the server; only the form content actually submitted by the visitor reaches the server.
6.5. Local storage records may be deleted by the visitor at any time by means of the browser's function for clearing site data.
7. Managing Cookies
7.1. The Visitor may at any time view, delete or block cookies, or choose to be warned before a cookie is placed, through the browser settings. All common browsers offer these options in their settings sections (under headings such as "Privacy", "Site data" or similar).
7.2. If cookies are deleted or blocked, the Site remains accessible; however,
a) if the msgxr_lang cookie is deleted, the language preference will not be remembered and may need to be set again on the next visit;
b) if Cloudflare's security cookies are blocked, the form submission functions on pages containing security verification (Turnstile) may not work;
c) if the msgxr_forum cookie is deleted or blocked, the forum session ends; signing in again through the e-mail link is required in order to write on the forum.
7.3. The consequences of the Visitor managing cookie preferences in their own browser are at the Visitor's disposition; the Site owner cannot be held liable for loss of functionality resulting from the blocking of cookies, without prejudice to the mandatory provisions of the law and to cases of intent and gross negligence.
8. Statement on Third-Party Cookies
8.1. There are no third-party cookies belonging to advertising networks, social media plug-ins or tracking services on the Site. All page resources, including fonts, are served from the Site's own domain; no external source such as Google Fonts is used. The Site's content security policy (CSP) is configured so as to allow the browser to communicate only with the Site's own domain and with Cloudflare's verification and infrastructure domains. Although this policy technically permits the endpoints of Cloudflare's measurement service, which operates without cookies, no script belonging to that service is embedded in the Site code; even if that service were active, it operates without placing cookies.
8.2. The only third-party component present on the Site is the Cloudflare Turnstile verification component, loaded on the /contact, /guestbook and /forum pages, which serves to prevent unsolicited automated submissions (spam). In order for the verification to be carried out, this component requires the visitor's IP address and browser signals to be transmitted to Cloudflare and may lead to the placement of the infrastructure cookies referred to in Article 5.
8.3. Cloudflare's own cookie and data processing practices are Cloudflare's responsibility and are subject to the policy texts published by Cloudflare. As the Site owner has no determining authority over these practices, its liability for matters that may arise from them is limited to its own area of choice and configuration, without prejudice to the mandatory provisions of the law.
9. Amendments
9.1. The Site owner reserves the right to amend this Policy unilaterally at any time in line with any changes that may occur in the technical structure of the Site or in the legislation.
9.2. Amendments take effect upon the publication of the updated text on the Site; the "Last updated" date at the beginning of the text indicates the version in force. Visitors are advised to review the current version of this Policy while using the Site.
10. Entry into Force
10.1. This Policy entered into force on the date it was published on the Site and was last updated on July 26, 2026.
10.2. This Policy forms an inseparable part of the Privacy Notice under the KVKK and of the Legal Notice published on the Site and, together with them, constitutes a single whole. Matters not regulated in the Policy shall be governed by those texts and by the relevant provisions of the legislation of the Republic of Türkiye.