Data protection notice

Data controller

Aramızda Kalsın is operated by: [[DOLDURULACAK: veri sorumlusunun unvanı ve adresi]]

What we process

While your account exists, the following is stored in our database:

• Your email address — to create and verify the account and reset your password.
• Your username and display name.
• A cryptographic hash of your password. The password itself is never stored.
• Session records: your IP address and browser user agent, to keep the session secure. Deleted when the session ends.
• Everything you write: stories, replies, and which topic they belong to.
• Your interactions: "me too", "not me", reply votes, "this helped" marks.
• Your preferences: time zone, notification preference, anonymity default.
• Content you report and the reason you gave.

What anonymous posting means — and what it doesn't

We keep it because moderation is only possible this way: if nobody knew who wrote what, there would be no way to stop a harassing account.

Anonymity here is a DISPLAY decision, not a deletion decision. Your visibility never changes on its own — only you change it.

When you post anonymously your name is hidden from OTHER USERS. But your identity is recorded in the database, and a moderator reviewing reported content sees your real username.

Why we process it

• To create and verify your account and keep you signed in.
• To publish what you write and notify you of replies.
• To prevent abuse: rate limits, bot checks, reports and moderation.
• To meet our legal obligations.

Legal basis

Account and content data are necessary to form and perform our terms of use, processed under KVKK art. 5/2-c.

Abuse-prevention data (IP, session records, rate-limit counters) is processed under the legitimate-interest basis in art. 5/2-f.

We do NOT advertise, profile, or sell data to third parties, so no consent is requested for those.

Who it is shared with

We don't sell your data. It is processed only by the providers the app needs to run:

• Neon (database) — Frankfurt, Germany (EU).
• Vercel (hosting and server-side execution).
• Resend — verification and password-reset emails only; your email address.
• Upstash Redis — rate-limit counters; only your user id and a count.
• Cloudflare Turnstile — bot checks; has no access to your content.
• Pusher — live notifications; carries only a notification type and id, never content.

Some of these providers are located outside Turkey, which constitutes a transfer abroad (KVKK art. 9). The database is held inside the EU (Frankfurt).

How long we keep it

• Account and content data: until you delete your account.
• Session records (IP, browser): deleted when the session expires.
• Rate-limit counters: expire on their own within minutes or hours.
• Moderation action log: kept even after your account is deleted — but it holds no personal data, only the action and its target.

Your rights (KVKK art. 11)

To learn whether your personal data is processed; to request information if it is; to learn the purpose and whether it is used accordingly; to know the third parties it is transferred to at home or abroad; to request correction if it is incomplete or wrong; to request erasure or destruction; to request that these actions be notified to third parties; to object to an adverse outcome produced solely by automated analysis; and to claim compensation for damage caused by unlawful processing.

You can exercise the right to erasure right now: "Delete my account" on the Settings page permanently deletes your account and everything you wrote. For other requests: [[DOLDURULACAK: iletişim e-posta adresi]]

Automated decisions

When enough distinct users report a piece of content, it is automatically and temporarily hidden and placed in the moderator queue. This is not deletion; a moderator can undo it, and you are notified.

Nothing else about you is decided automatically: no scoring, no profiling, no automatic account closure.