Cookie Policy
Last updated: October 15, 2026
toNikah ("we", "us", or "our") operates tonikah.com, the toNikah web app, and related Android/iOS mobile apps (the "Platform"). We respect your privacy, handle personal data responsibly, and align with Islamic principles of trust, modesty, transparency, and protection of dignity.
This Cookie Policy explains cookies and similar technologies, including local storage, PWA/browser cache, push-token storage, and mobile app device storage. It complements our Privacy Policy.
1. What Are Cookies and Similar Technologies?
Cookies are small text files stored on your device when you visit the Platform. Similar technologies include localStorage, sessionStorage, secure device storage in mobile apps, and browser/PWA cache.
Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), associated rules, and the EU's GDPR / ePrivacy rules, we provide clear notice and obtain consent where required for non-essential storage or tracking.
We do not use advertising or cross-site behavioral tracking. Functional storage supports login, security, language, preferences, and selected features. Performance measurement, when enabled, is described below; non-essential storage or tracking requires consent where applicable.
2. Cookies and Similar Technologies We Use Today
The table below lists the main first-party cookies and browser storage items used on the toNikah website and web app.
| Name / technology | Provider | Purpose | Duration | Essential? |
|---|---|---|---|---|
| app_at, app_rt | toNikah API | Secure login, session refresh, and account protection. These cookies are HttpOnly and cannot be read by JavaScript. | Short-lived access token; refresh token up to about 30 days | Yes |
| NEXT_LOCALE, i18next, i18n | toNikah | Remember your language/locale choice across the website and app. | Up to 1 year | Yes / preference |
| cookieAccepted (localStorage) | toNikah | Remembers that you dismissed the essential-cookie notice. This is a notice preference, not consent to analytics. | Until cleared in your browser | Preference |
| tonikah-theme (localStorage) | toNikah | Remembers dark/light/system theme preference. | Until changed or cleared | Preference |
| Explore filters, tour state, PWA install prompt state (localStorage) | toNikah | Remember in-app preferences, reduce repeated prompts, and improve product usability. | Until changed, completed, expired, or cleared | Functional |
| tonikah:media-guidelines:v1:* (localStorage) | toNikah | Remembers that you acknowledged the profile-image guidelines so the introductory modal is not shown repeatedly. It is not used for analytics, advertising, or cross-site tracking. | Until browser storage is cleared, the storage version changes, or the relevant account context changes | Functional / preference |
| Push notification token cache (localStorage / browser permission state) | toNikah / Google Firebase / Expo / Apple | Supports push notifications only when you enable them. | Until permission changes, token refreshes, or storage is cleared | Optional feature |
Notes: Authentication and core locale items are required to provide the service you request. You can clear browser storage or cookies, but doing so may log you out, reset preferences, or show prompts again.
The browser stores tonikah:device-id for session/device recognition, alongside functional preferences and media-guideline acknowledgements. It remains until browser storage is cleared or replaced. Native apps keep a separate installation identifier in secure storage. These identifiers are not used for cross-site advertising.
3. Third-Party Technologies Used Only for Specific Features
Some third-party services may set cookies or use storage when you choose related features.
| Name / technology | Provider | Purpose | Duration | Essential? |
|---|---|---|---|---|
| Google OAuth | Login/signup with Google when selected. | Managed by Google | Optional | |
| Google Maps / Places | Location search and place selection when you use location features. | Managed by Google | Feature-based | |
| Stripe, Razorpay, PayPal | Payment providers | Secure checkout, fraud prevention, billing, and subscription management. | Varies by provider | Feature-based |
| YouTube video embed | Google / YouTube | Video playback only if you open or play embedded video content. | Managed by Google / YouTube | Optional |
| Adobe Fonts / Typekit | Adobe | Loads Adobe-hosted web fonts used by the Platform interface. When fonts load, the browser sends requests to Adobe. | Managed by Adobe | Used for interface typography; legal classification under review |
| Cloudflare R2/CDN images | Cloudflare | Delivers profile and media images from cdn.enerig.com. | Cache duration varies | Feature-based |
| Google Firebase / Expo / Apple | Google Firebase / Expo / Apple | Google Firebase, Expo, and Apple notification services, depending on the device and delivery route, process push tokens and notification payloads when notifications are enabled. Notification content may appear on your lock screen according to device settings. | Token duration varies | Optional |
Google Maps / Places API: Features using Google Maps or Places API may store cookies or access device/browser data for functionality, preferences, and service delivery. Google manages related choices separately (see how Google uses cookies).
Adobe Fonts / Typekit disclosure: We currently load Adobe-hosted fonts on website, login, and app pages. We do not use Adobe Fonts for analytics, advertising, or behavioral tracking, but Adobe may receive technical request data such as IP address, browser/device details, referrer, and time of request according to Adobe's policies. We disclose this clearly until we can move to self-hosted fonts or another approach.
Vercel Speed Insights, when enabled on web deployments, measures page performance and technical request information. This is separate from advertising. Applicable disclosures and consent requirements must be satisfied before enabling non-essential measurement.
If we introduce analytics, marketing, advertising, or behavioral tracking technologies in the future, we will update this policy and request valid opt-in consent where required before enabling them.
4. Legal Bases, Consent, and Your Choices
Essential authentication, security, and service-preference storage is used to provide the Platform you request. Optional third-party features activate only when you choose to use those features.
For users in the EEA/UK, authentication and security cookies are used on the basis of contractual necessity and the ePrivacy strictly-necessary exemption. Preference storage may rely on contractual necessity or legitimate interests. Non-essential analytics or marketing would require consent.
For users in India, we process cookie and device data as described here in accordance with the DPDP Act. For grievances or withdrawal requests, contact privacy@tonikah.com. Indian payment processing may involve Enumeration Technologies Pvt. Ltd. as described in our Privacy Policy.
The Platform is not directed to minors. Users must be at least 18 years old.
5. Mobile Apps and PWA Storage
Android/iOS apps store login credentials in secure device storage and may cache profiles, messages, inboxes, images, audio, offline messages, preferences, and an installation identifier in app storage. Camera, photo, microphone, location, and notification access is requested for relevant features through device permissions. You can manage permissions in device settings. App cleanup, clearing storage, and uninstalling remove applicable local data; secure credentials are managed separately by the operating system. Legal pages, login, or checkout opened in a browser may use browser cookies.
If you install toNikah as a PWA, your browser may cache app files and images to make the app open faster and work more reliably. Clearing browser site data may remove this cache.
6. Changes and Contact
We may update this policy as the Platform, storage practices, or legal requirements change. Significant updates will be posted here or communicated through the Platform.
Questions, grievances, or withdrawal requests: privacy@tonikah.com
toNikah — Operated by Web Hive UG (and Enumeration Technologies Pvt Ltd. for Indian payments).