How your personal data is processed

The data controller for your personal data is the operator of the Bit Pazarında Geçmişi Aramak website (bitpazarindagecmisiaramak.com). The site is run on a non-commercial basis; there are no sales, advertising or paid services on it.

You can reach the data controller at iletisim@bitpazarindagecmisiaramak.com.

• Identity and contact: your email address; if you sign in with Google, the name and profile photo on your Google account.
• Password: if you signed up with an email address and a password, your password. It is never stored as plain text, only as an irreversible hash; nobody can see it.
• Profile: your username, display name, short bio and profile photo.
• Content you share: stories, object records (place, year, who it came from, where it is now), tags, photos and comments.
• Interactions: story and comment likes, saved stories, people you follow, reports you send and your report notes.
• Moderation records: content held for review, warnings, suspensions, moderator notes and records of moderator actions.
• Security: session data, sign-in records (including IP address and time), your language preference and short-lived request counters kept to prevent abuse.
• In-site notifications: the notifications shown to you (who liked, commented or followed, on what and when; moderation outcomes) and the ones your likes, comments and follows send to others. When you like a story or a comment, its owner — and when you follow someone, that person — sees your name in their in-site notifications; nobody else sees these notifications.
• Email records: whether the emails sent to you were sent and delivered.

We do not ask for special categories of personal data (such as health, religion, ethnic origin or political opinion). Please do not share such information, or other people’s personal data, in your stories; what you share is published publicly.

When you publish a story with “Don’t show my name”, your name and profile are not shown to other members or visitors. The fact that the story is yours is still stored in the database and can be seen by moderators; it may be disclosed to the competent authorities when legally required.

• Creating your account, verifying your identity and letting you sign in
• Publishing the stories, photos and comments you share; providing likes, saving and following
• Showing in-site notifications: who liked your story or comment, who commented or replied, who started following you, and moderation outcomes
• Applying the community guidelines: automatic checks for language and personal contact details (email addresses, phone numbers), moderation, reviewing reports, warning and notification emails
• Keeping the site and its members safe, preventing abuse and unauthorised access
• Preventing data loss through backups
• Meeting legal obligations and responding to requests from the competent authorities

Your personal data is collected electronically, partly by automated means, when you sign up, sign in with Google, fill in your profile, share stories, photos and comments, and use the site (session and language cookies).

Your personal data is processed on these grounds under Article 5 of the KVKK:

• It is necessary to conclude and perform the membership agreement (Art. 5/2-c)
• It is necessary for the data controller to meet a legal obligation (Art. 5/2-ç)
• For content you choose to share publicly, you have made it public yourself (Art. 5/2-d)
• It is necessary to establish, exercise or protect a right (Art. 5/2-e)
• The data controller’s legitimate interest in community safety and moderation, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f)

Your personal data is not processed for marketing or advertising.

Your personal data is transferred, only as far as needed to provide the service, to these service providers:

• Supabase: database, sign-in and file storage (servers in Frankfurt, Germany)
• Netlify: hosting and running the site (servers in the USA)
• Resend: sending emails
• Lark: the contact and moderation mailboxes (requests and replies you send us)
• GitHub: storing encrypted backups
• Google: only if you sign in with Google, for authentication

Some of these providers are based abroad. Transfers abroad are made with one of the appropriate safeguards set out in Article 9 of the KVKK (for example, standard contractual clauses).

Your personal data may also be transferred to the competent public authorities and courts under Article 8 of the KVKK when legally required. Your data is never sold or shared with anyone for advertising.

• Your account data and the content you share: for as long as your account exists
• Request counters kept to prevent abuse: up to 2 days
• In-site notifications: 90 days
• Backups: encrypted, up to 90 days
• Sign-in records and email delivery records: for the retention period of the service provider concerned
• Records of moderator actions: for the statutory limitation periods, in case of legal disputes
• Records that must be kept by law: for the period the law requires

When you delete your account in Settings, your stories, photos, comments, likes, saved stories, follows, warnings, in-site notifications (both the ones you received and the ones your likes, comments and follows sent to others) and account are permanently deleted. Reports you sent remain without your name or note. Deleted data leaves the backups within 90 days at the latest.

If the site is closed, personal data will be deleted or anonymised, and members will be told by email beforehand.

Under Article 11 of the KVKK you may apply to the data controller to:

• Learn whether your personal data is processed
• Request information about the processing if it is
• Learn the purpose of the processing and whether the data is used accordingly
• Know the third parties in Türkiye or abroad to whom it is transferred
• Ask for it to be corrected if it is incomplete or inaccurate
• Ask for it to be erased or destroyed under the conditions of Article 7 of the KVKK
• Ask for corrections, erasure or destruction to be notified to the third parties it was transferred to
• Object to an outcome against you that results solely from automated analysis
• Claim compensation if you suffer damage because it was processed unlawfully

You can correct your profile in Settings, and delete your account and data yourself on the same page.

In line with the Communiqué on the Procedures and Principles for Applications to the Data Controller, you can send requests about your rights in writing to iletisim@bitpazarindagecmisiaramak.com from the email address registered to your account (so that we can verify your identity). Your request will be answered free of charge within 30 days at the latest; if it involves an additional cost, the fee set by the Personal Data Protection Board may apply.

If your request is refused, you find the answer insufficient or you get no answer in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of your request.

If this notice changes, the date at the top of the page changes too; we also announce important changes by email.