Cookie Policy

Server request totals without device storage

A separate operational counter can total incoming full-document GET requests to the Arabic and French women's marriage landing pages. It stores only UTC day, a fixed page label and a count, plus one service-wide collection-start timestamp. Ordinary request headers are checked transiently to exclude identifiable bots and prefetches; they are not copied into this counter. It does not set or read cookies, use browser storage, run a tracking pixel, ask the browser for an extra request, identify visitors or read advertising click IDs. This is separate from optional browser analytics and therefore does not use the analytics-choice cookie. Requests can include reloads and shared links and are not unique people or confirmed successful visits. Daily totals are retained for up to 400 days; nothing from this counter is sent to advertising platforms. Existing infrastructure/security logs are described in the Privacy Policy.

1) What a cookie is

A cookie is a small value stored by a browser and returned with later requests to the same service. Some cookies are necessary to keep an account signed in, protect a state-changing request, or remember a setting.

2) Cookies currently used

Security cookies may be replaced earlier when you sign in, sign out, revoke a session, reset credentials, or when Yahalaly rotates them for security. Server-side session, audit, rate-limit, and security records are not browser cookies and are covered by the Privacy Policy.

• access_token — HTTP-only authentication cookie used for a short signed-in session; configured for up to 15 minutes.
• refresh_token — HTTP-only authentication cookie used to renew a session securely; configured for up to 30 days and revocable from account session controls.
• csrf_token — first-party anti-CSRF value used to validate state-changing requests; configured for up to 30 days.
• locale — first-party preference cookie set when you choose an interface language; configured for up to one year.
• yahalaly_analytics_consent — first-party choice cookie containing only the consent version and an analytics true/false choice; configured for up to one year.

3) Optional aggregate analytics and same-tab attribution

Arabic and French marriage landing pages may show randomly selected layouts without creating an assignment cookie. Only if you allow optional analytics, a fixed language/layout label is stored in the current browser tab under yahalaly:landing-experiment:2026-09. It supports daily aggregate comparisons of page views and signup stages, contains no visitor identifier, is not linked to member records, and is removed on decline or when the tab closes. Reloads may show another layout. No experiment data is sent to Meta or Google.

With optional analytics allowed, Facebook links can be reduced locally to fixed labels for Facebook, tagged Facebook advertising, or the Arabic/French Morocco pilot ads. These are ad labels, not inferred member language or location. Only the fixed label is retained in the existing tab session storage. If still present and consent still permits, a first successful email verification or profile completion can increment an anonymous daily counter. A fixed source header is sent only with those existing first-party actions, is not attached to member records, audit logs or individual product events, and is not sent to Meta. Switching tabs/devices or declining analytics can leave later stages unattributed. Declining clears the tab label; raw ad parameters and click identifiers are not stored by this measurement.

Fixed public-image actions can cover published blank prompt cards and the localized women-first campaign card. The image and its fixed QR destination contain no account, profile, member, recipient, or referral identifier. A consented count contains only the fixed page, channel, and requested image-share or image-download action; it does not contain the image, caption, link, destination, delivery, saving, or download completion.

Yahalaly shows equal choices to allow or decline optional first-party aggregate analytics. The tracker runs only after an allow choice and remains disabled when a browser sends Do Not Track or Global Privacy Control, or reports automated-browser operation. On public pages, including this policy, you can reopen Analytics choices and change the setting at any time. A signed-in trusted-invitation action never turns analytics on; its fixed aggregate stages are counted only if the current consent version already records an allow choice.

When allowed, the browser locally reduces an allowlisted campaign value or referring hostname to one fixed channel such as a member-shared public invitation, a shared blank prompt card, a shared Niyyah conversation-builder link, ChatGPT, Reddit, Pinterest, Deenlist, deen.page, Muslim Business Germany, MuslimConnect, Ummah, ummah.build, Built for Muslims, Startup Muslim, Quora, Medium, LinkedIn, SaaSHub, Datteltäter, Islamische Zeitung, Kleinanzeigen, Habiba & Habibi, ZamZam e.V., Commonsplace, YouTube, TikTok, Instagram, a search category, other social, other external, internal, or direct. An unrecognized non-empty campaign source becomes only other external. Only this label is kept in session storage for the current tab; raw referrers, URLs, query strings, campaign names, account identifiers, profile identifiers, and referral identifiers are never placed there. The first label is not replaced by later navigation in that tab.

Public page-view, fixed public-tool-stage (start, use, link share, copy, print, blank-card image-share attempt, or blank-card image-download initiation), signed-in trusted-invitation-stage (prompt view, WhatsApp open, successful native-share handoff, or successful copy), and registration-button-click requests are sent without account credentials, cookies, or a referrer header. Image actions describe a requested browser action, not confirmed delivery, saving, or download completion. Member, profile, recipient, destination, or referral identifiers, invitation text, tool entries and outputs, selections, generated text, and clipboard content are never included. After a genuinely new account is created, the registration request can increment a completed-signup daily total only when the current analytics-choice cookie still says allow and browser privacy signals permit it. Duplicate and rejected attempts do not increment that total. This optional analytics channel is not added to the member, audit-log, or person-level product analytics record.

Separate from optional analytics, a recognized Yahalaly registration link can supply one fixed allowlisted entry-page label that is stored with the new account for registration and activation cohort comparison regardless of the analytics choice. The registration form discloses this when a label is present. It does not store the raw page URL, referrer, campaign text, query string, or anything entered in a public tool. This account-level field is covered by the Privacy Policy; it is not a cookie or same-tab attribution value.

The aggregate table contains no event, visitor, session, or user identifier, exact event time, IP address, user agent, raw referrer, URL, query string, campaign name, device, or country. Its daily totals are retained for up to 400 days. Same-tab attribution is normally removed when the tab closes, and is removed sooner after a decline choice. Yahalaly does not use this measurement to follow a person across sites.

4) Browser controls

You can inspect, delete, or block cookies and site storage using browser settings. Blocking authentication or security cookies prevents sign-in and protected account actions from working. Deleting the locale cookie resets automatic language selection. Deleting the analytics-choice cookie makes the choice panel appear again; choosing decline stops future optional analytics requests and clears the same-tab fixed-channel value.

5) Optional Google Ads registration measurement

Only after separate explicit consent, Yahalaly stores the Google ad-click identifier (gclid, gbraid or wbraid) and its capture time in local storage under yahalaly:ads-click:v1 for up to 30 days. It is not stored with your account. The yahalaly_ads_measurement cookie remembers your yes/no choice for up to one year. The first-party aggregate analytics choice does not grant Google consent.

After a successful first email verification, a brief standalone confirmation page may load Google's advertising measurement tag. Google receives the click identifier, a registration-confirmed event, a random one-time event identifier and technical information such as IP address and browser information. This can reveal interest in Muslim matchmaking. We do not send names, emails, account IDs, verification tokens, profile answers, photos or messages. The tag does not run on registration forms, member profiles or chat pages. No personalised advertising, remarketing, enhanced conversions or member-list uploads are enabled by this integration.

Google may set first-party _gcl_* conversion cookies, configured here for up to 30 days. A one-time handoff in session storage (yahalaly:ads-registration:v1) is consumed before the tag loads and expires after two minutes. A different device or browser, missing consent, an expired click, blocked storage or an ad blocker may prevent a registration being measured. We do not bypass those choices.

Open Privacy choices to withdraw. Withdrawal stops future Google requests and clears Yahalaly's saved click identifier and accessible first-party conversion cookies; it does not undo data already sent to Google or delete cookies on Google's own domains. Do Not Track and Global Privacy Control disable this integration. Google's use of data, including processing outside your country, is described at https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy. Questions or rights requests: privacy@yahalaly.com.

6) Contact and changes

Material changes receive a new effective date. Questions about cookies or browser storage can be sent to privacy@yahalaly.com.