Talkala Cookie Policy

Essential authentication and security cookies

These cookies keep sign-in and account-security flows working. Blocking them can prevent sign-in, disrupt returning from Google sign-in, or stop short verification steps during account creation.

• Sign-in session and protection cookies keep you authenticated, secure account access when you reload pages, and support Google sign-in when you enable it.
• A signed, HTTP-only cookie (about 10 minutes) carries policy acceptance while you finish creating an account or continue with Google sign-in.
• A signed, HTTP-only cookie (about 12 hours) is added after emailed verification succeeds for authorized operator access.

Preference cookies and local storage

These entries remember how the interface should look or behave on your browser. They do not build an advertising profile.

• Desktop sidebar open/collapsed state uses both a cookie and a local preference; the cookie can last up to one year.
• Dialer cleanup preference on desktop uses similar storage patterns and can persist up to one year.
• Light/dark/system theme stays until you change it or delete browser storage.
• Dialer remembers your destination-country preferences locally so repeat visits are faster.
• Profile display tweaks are cached locally after you edit them.
• Restricted operator dashboards can pin important accounts for that browser only.

Temporary storage and cross-tab sync

Talkala also uses short-lived or event-style storage so different parts of the page stay coordinated. Nothing here is intended as permanent account data.

• Session-only browser storage remembers that you already signed in so public-site buttons can behave correctly during that visit.
• Smart Auto Top-up briefly uses browser storage to tell another open Talkala tab that a setting changed, then clears it.
• Older contact records saved only in legacy browser storage may be read once during migration and discarded.

Analytics and advertising

Talkala uses Vercel's hosted analytics for cookie-free aggregate traffic measurement. If you choose Accept in the privacy banner, Talkala also loads Google Analytics to understand site and product usage. Google Analytics remains off when you decline it, and Google advertising storage and personalization stay disabled.

• The consent choice is stored locally as `talkala_google_analytics_consent_v2` until you change it or clear browser storage.
• The current choice covers Google Analytics and starting-page conversion measurement. Earlier choices are not reused for this additional account link; the banner asks you to choose again.
• After acceptance, `talkala_landing_attribution_v1` stores a public page path, a broad traffic category, and a capture time for up to 30 days. `talkala_analytics_choice_v2` carries your choice to signup for up to 30 days. These first-party cookies use SameSite=Lax and Secure on HTTPS. They contain no contact details, payment identifiers, search query strings, or advertising identifier.
• If you sign up, Talkala saves the starting page with the account so later confirmed calls and top-ups can be counted by page. Declining clears the browser attribution and removes the link for the signed-in account. If that account update fails, the banner explains it and lets you retry; browser analytics stays off. When signed out, the account update applies on the next sign-in from that browser. Calling and payment records remain available for account operation.
• After consent, Google Analytics may set first-party cookies such as `_ga` and `_ga_<measurement-id>` to distinguish browsers and sessions. These can last up to two years unless browser or Google property settings shorten that period.
• No advertising pixels are currently used.
• No cross-site retargeting cookie stack is currently used.
• Analytics should not be used to send personal contact details, payment identifiers, message content, or account secrets.

Cloudflare Turnstile security checks

When configured, Talkala uses Cloudflare Turnstile on public and account-security forms so automated scripts cannot overwhelm sign-up, password, verification, or contact flows. The check may observe signals such as coarse network details and basic browser information, similar to other widely used bot protections.

Consent and essential storage

Storage that is strictly necessary for signing in, security checks, account-creation policy acceptance, fraud prevention, day-to-day account operation, or personal choices is treated as essential or preference storage. Google Analytics is optional: the consent notice appears before its tag loads, and rejecting it does not affect calling or account access. Use Cookie settings in the public footer to review or change that choice. Withdrawing consent disables Google Analytics and clears accessible Google Analytics and starting-page cookies. Use Cookie settings while signed in to remove the account page link too.

What happens if you block or clear storage

Sign-in can fail, sessions can end early, Google sign-in can lose its return step, automated security checks can fail, administrator verification cookies can expire sooner than expected, and saved preferences can reset. Clearing browser storage does not delete server-side account, billing, call, number, contact, SMS, support, or wallet records.