COOKIE POLICY
Last updated September 25, 2026
This Cookie Policy explains how Toolsy ("Company", "we", "us" and "our") uses cookies and similar technologies when you visit our websites at https://toolsy.io and https://app.toolsy.io (the "Websites"). It explains what these technologies are, which ones we use and why, and how you can control them. For how we handle personal information in general, please read our Privacy Notice: https://toolsy.io/privacy-policy.
What are cookies?
Cookies are small data files that a website stores in your browser. Websites can also keep small pieces of data in your browser in other ways, called local storage and session storage. In this policy we treat them the same way as cookies, and the same choices apply to them.
Cookies set by us are called "first party cookies". Cookies set by other companies whose tools run on our Websites are called "third party cookies".
Our cookie banner
- European Economic Area, United Kingdom and Switzerland: the banner asks for your choice first. Until you choose, only necessary cookies are used and nothing for analytics or marketing is allowed. We treat you the same way if we cannot tell where you are.
- Everywhere else: analytics and marketing are allowed by default and the banner is not shown. You can turn them off at any time with the Cookie settings link (see "How can I change my choice?" below).
- To know which rule applies, our own server looks up the country of your connection's IP address in offline country databases. It uses only the two-letter country code, and neither your IP address nor the country is stored for this check. We only check this while you have not made a choice yet.
- In the banner you can accept everything, reject everything, or switch analytics and marketing on or off separately.
- Your choice is saved in the tsy_consent cookie for 180 days and applies to both toolsy.io and app.toolsy.io.
Cookie categories
- Necessary. Always on. These keep the Websites working and secure, for example remembering your cookie choice, keeping you signed in and protecting our forms from spam. They cannot be switched off in the banner.
- Analytics. Help us understand how people find and use Toolsy: our own anonymous visitor id and visit source, and Google Analytics with cookies.
- Marketing. Advertising and conversion measurement tags, affiliate referral tracking, and the Google consent signals for advertising.
Our own cookies and browser storage
Necessary
- tsy_consent (cookie, toolsy.io and app.toolsy.io, 180 days). Stores your cookie choice in the form v1.aX.mY. "v1" is the format version, "a1" means analytics allowed and "a0" not allowed, "m1" means marketing allowed and "m0" not allowed. For example, v1.a0.m0 means you rejected both. It is only written when you make a choice.
- jwtToken (cookie and browser storage, app.toolsy.io). Keeps you signed in. If you keep "remember me" on, it lasts 30 days. If you turn it off, it is removed when you close your browser. It is deleted when you sign out.
- App preferences (local storage, app.toolsy.io). Small settings such as your "remember me" choice, the sign-in method you used last and your recent searches, so the app works the way you left it.
- __Host-tsy_admin and __Host-tsy_admin_pre (cookies, Toolsy staff only). Used only when a member of the Toolsy team signs in to our internal admin panel. The session ends after 30 minutes without activity or 8 hours at most. The sign-in helper cookie lasts 5 minutes. Customers never receive these cookies.
Analytics (only with analytics consent)
- tsy_aid (cookie, toolsy.io and app.toolsy.io, 400 days). A random anonymous id. It lets us see which page, link or campaign brought a visitor to Toolsy, and it is linked to your account when you sign up or sign in. It is never set without analytics consent and it is deleted when you withdraw. When you open a Toolsy short link (toolsy.io/go/...) and you have allowed analytics, our server may set or refresh this cookie. Without analytics consent it never does.
- tsy_sid (session storage). A random visit id that changes after 30 minutes without activity and is cleared when you close the tab.
- toolsy_attribution (local storage, app.toolsy.io). Where you first came from, such as campaign parameters and the referring website, sent with your sign-up. Without analytics consent it is kept only in memory while the page is open.
- tsy_fwd (session storage, toolsy.io). Carries campaign parameters from toolsy.io to app.toolsy.io when you click through. Without analytics consent it is kept only in memory while the page is open.
- tsy_geo (local storage, app.toolsy.io, 24 hours). Your two-letter country code, so we do not have to look it up again. It never contains your IP address.
Third party tools
We list only the tools that are actually running on our Websites today.
Necessary
- Google reCAPTCHA (app.toolsy.io). Runs on our sign-in, sign-up and contact forms to protect them from spam and abuse.
- Google Sign-In (app.toolsy.io). Loads only if you choose to sign in with a Google account.
- Stripe. Payments happen on Stripe's own checkout page, where Stripe sets its own cookies. See https://stripe.com/legal.
Analytics
- Google Analytics 4 (toolsy.io and app.toolsy.io) and Google Tag Manager (toolsy.io). With analytics consent, Google Analytics uses cookies such as _ga and _ga_*. Without it, see "Google Consent Mode" below.
- Fingerprint (app.toolsy.io, fingerprint.com). Runs only when you sign in or sign up, to detect duplicate or abusive accounts. It recognizes your browser and device and may store its own identifier in cookies or browser storage (names starting with _vid). In the EEA, the UK and Switzerland it only runs with analytics consent, and it never runs if you have declined analytics.
Marketing (only with marketing consent, toolsy.io only)
- Meta (Facebook) Pixel, TikTok Pixel and Quora Pixel. Measure which ads bring visitors and sign-ups.
- Pinterest tag, X (formerly Twitter) tag and Brevo tracker. Loaded through Google Tag Manager, and each one requires advertising consent inside it.
- Rewardful. Records which affiliate partner referred you, so we can credit them.
None of these marketing tags load on app.toolsy.io. None of them load at all if you reject marketing, or while you have not chosen yet in the European Economic Area, the United Kingdom or Switzerland.
Google Consent Mode
Our Google tags (Google Tag Manager and Google Analytics) run in Google Consent Mode (advanced mode). They load for every visitor, a moment after the page has loaded, and they respect your choice:
- Analytics consent controls Google's analytics storage. Marketing consent controls Google's three advertising signals (ad storage, ad user data and ad personalization).
- Without consent, which includes visitors in the European Economic Area, the United Kingdom and Switzerland who have not chosen yet, Google sets and reads no cookies (no _ga, _ga_* or _gcl_* cookies).
- In that case Google receives only cookieless signals: the event, the page and your consent state, without a client id or user id. Google shortens the IP address and uses these signals to estimate conversions in aggregate.
- While advertising is not allowed, ad click ids are removed from these signals. Ad click information may instead be carried in the address of links between our own pages, not in a cookie.
How can I change my choice?
Use the Cookie settings link at the bottom of every page on toolsy.io, or on the app.toolsy.io sign-in page. It opens the banner again, and your new choice applies to both websites.
If you withdraw your consent, we save "v1.a0.m0", delete our tsy_aid cookie and the analytics data we stored in your browser, try to delete the Google Analytics and advertising cookies (such as _ga, _gid, _fbp, _ttp, _epik and the Pinterest and Brevo cookies), and then reload the page. Cookies that other companies set on their own websites can only be removed in your browser settings.
How long do cookies and related data last?
- tsy_consent: 180 days. tsy_aid: 400 days. jwtToken: 30 days, or until you close the browser if "remember me" is off. Staff admin session: 8 hours at most. tsy_sid: until you close the tab. tsy_geo: 24 hours. Other browser storage: until you sign out, withdraw consent or clear your browser data.
- On our servers, the visits and events linked to an anonymous id that never becomes an account are deleted 90 days after we last saw that id. For account holders, detailed product usage events are kept for 400 days.
- Third party cookies last as long as each provider sets them. Please see their own policies.
What about other tracking technologies, like web beacons?
Besides cookies, we use small pieces of code called pixels or beacons. The marketing tags listed above work this way. Our own websites also send a small visit signal to our server, only with analytics consent, so we can see which page or campaign brought a visitor. When you open a Toolsy short link (toolsy.io/go/...), our server counts the click before sending you on. Without analytics consent this happens without any cookie. We never store your IP address, only a keyed one-way hash of it together with your browser type, and click records are deleted after 400 days.
Do you serve targeted advertising?
We do not show ads on our Websites. With your marketing consent, the advertising platforms listed above can use their tags to measure our ads and to show you Toolsy ads on their own platforms. Without marketing consent, their tags do not load.
How often will you update this Cookie Policy?
We update this Cookie Policy when the cookies or tools we use change, or for other operational, legal or regulatory reasons. The date at the top of this Cookie Policy shows when it was last updated.
Where can I get further information?
If you have any questions about our use of cookies or other technologies, please email us at info@toolsy.io or write to us at:
Toolsy
Acıbadem Mah. cecen Sk. Akasya Avm No: 25
Uskudar, Istanbul 34660
Turkey
