Privacy Policy

1. What data do we process?

• Account: display name, e-mail address and password (the password is stored only as an irreversible hash), plus the photo and social links you add to your profile.
• Sign-in with Google: we receive only your verified e-mail address, your name and your Google account ID. We never see your Google password.
• Comments: the comment text and, if you comment without signing in, the name and e-mail address you enter. Your e-mail address is not shown publicly.
• Contact form: your name, e-mail address, subject and message.
• Newsletter: your e-mail address, language preference, and confirmation and unsubscribe dates.
• Technical data: your IP address and browser information (User-Agent) in security and error logs. The post view counter stores only which post was read and when; it does not identify you.

2. Why do we use it?

Legal bases: performance of a contract (your account), your consent (newsletter), our legitimate interest (security and abuse prevention) and legal obligations.

• To create your account, let you sign in and verify your e-mail address.
• To publish and moderate your comments.
• To answer messages sent through the contact form.
• If you opted in, to send the newsletter about new posts. Every e-mail contains a one-click unsubscribe link.
• To protect the site and accounts against abuse (login attempt limits, bot checks, logs) and to fix errors.

3. Cookies and browser storage

We do not use advertising or tracking cookies. Only those needed for the site to work are used:

• Session cookie: a secure cookie that JavaScript cannot read, used to renew your session after you sign in (up to 30 days).
• csrf_token: protects session renewal and sign-out requests.
• NEXT_LOCALE: remembers your language.
• Browser storage: your theme preference (light/dark) and a small marker so a post is not counted twice in the same session.
• The bot check (Cloudflare Turnstile) may use its own cookies or similar technologies on forms.

4. Who do we share data with?

We do not sell your data. To run the site we use the following providers; each processes only what its task needs:

• Hosting and server infrastructure.
• Cloudflare: content delivery, security and bot checks (Turnstile).
• Google: only when you use "Sign in with Google".
• E-mail delivery service: to deliver verification, password reset and newsletter e-mails.

5. International transfers

Some of these providers may process data outside Turkey. Transfers are made in line with the conditions of the applicable law.

6. How long we keep data

• Account data: until you delete your account. Deleted accounts may be kept restorable in the admin panel to guard against accidental deletion; you can ask for permanent deletion through the contact form.
• Comments and contact messages: as long as needed or until you ask us to delete them.
• Newsletter: until you unsubscribe; the unsubscribe record is kept so we do not e-mail you again.
• Application logs (may contain IP and User-Agent): 30 days. Expired session records are deleted shortly after they expire.

7. Your rights

Under Turkish data protection law (KVKK, article 11) and, where applicable, the GDPR, you can ask whether your data is processed, request information, ask for correction or deletion, object to processing and claim compensation for damage. You can edit your details on your profile page and unsubscribe from the newsletter with one click. For other requests use the contact form; we answer within 30 days. You may also complain to the data protection authority.

8. Security

Connections are encrypted with HTTPS, passwords are stored irreversibly, login attempts are limited and two-step verification is supported for administrator accounts. No system is entirely risk-free; if we find a breach we will report it as the law requires.

9. Changes

We may update this policy. For important changes we update the date on this page and, where needed, inform you separately.