Choose which cookies stay, which ones go.
Four categories, granular control. Essential cookies are always on — without them the booking engine can't issue a ticket. Everything else is a choice you make, change any time. Preferences save to this browser and travel across every Istanbul Tourist Information domain.
Always on Strictly necessary — booking engine won't run without these 3 cookies
Keep the session alive, remember slot selection, verify payment at checkout. No tracking, no identifier beyond session ID. Locked because turning them off means the site literally can't complete a booking.
| Name | Domain | Purpose | Expires |
|---|---|---|---|
| _iti_session | .istanbul-tourist-information.com | Session ID for cart + checkout | On close |
| _iti_csrf | .istanbul-tourist-information.com | CSRF protection | Session |
| _iti_consent | .istanbul-tourist-information.com | Remembers this preference panel | 12 months |
Optional Functional — language, currency, audio-guide preference 3 cookies
Remember your interface language, currency, and audio-guide language. Used only for personalisation, never read by advertisers. Off means defaults (English, EUR) every page load.
| Name | Domain | Purpose | Expires |
|---|---|---|---|
| _iti_locale | .istanbul-tourist-information.com | Interface language | 12 months |
| _iti_ccy | .istanbul-tourist-information.com | Last-used currency | 12 months |
| _iti_audio_lang | .istanbul-tourist-information.com | Audio-guide language preference | 12 months |
Optional Analytics — anonymous usage statistics 4 cookies
GA4 with IP anonymisation, ad-signals disabled, demographics off. We see how many arrive, where they drop off — not who they are. Sentry crash reports with PII scrubbing.
| Name | Provider | Purpose | Expires |
|---|---|---|---|
| _ga | Google Analytics 4 | Unique anonymous visitor ID | 24 months |
| _ga_* | Google Analytics 4 | Session state | 24 months |
| _ga_gid | Google Analytics 4 | Short-lived session ID | 24 hours |
| _sentry | Sentry.io | Crash fingerprint — no PII | 14 days |
Optional Marketing — retargeting and campaign attribution 3 cookies
If on, we tell Meta and Google Ads you visited. They use that to re-show our cistern tickets. Off by default — opt-in, not opt-out, regardless of your country's legal minimum.
| Name | Provider | Purpose | Expires |
|---|---|---|---|
| _fbp | Meta Pixel | Retargeting + attribution | 90 days |
| _gcl_au | Google Ads | Conversion attribution | 90 days |
| _iti_utm | Istanbul Tourist Information | UTM source + campaign last-touch | 30 days |
What happens behind each cookie you allow.
Every category triggers a specific data flow. Here's the chain from cookie set to data used — or deleted.
Cookie set on our domain when you consent. Lives in browser storage, not our server.
Sent back to us on each request. Used only to identify session or preference.
Analytics feed into GA4 anonymised. Marketing into Meta / Google as opaque IDs.
At expiry or consent revocation. Downstream data purged per vendor retention.