Privacy & Data Protection Notice

Data controller

enkez is a Türkiye-focused social content aggregator and community platform. It acts as a hosting provider under Law No. 5651 and, for the personal data it processes, as the data controller under Law No. 6698 (KVKK).

The channel for contacting the data controller and for any request mentioned in this notice is the e-mail address given in the “Contact and requests” section below.

Personal data we process

We process only the minimum data needed to provide the service. If you browse as a guest without an account or content, our processing of your personal data is minimal. The main categories we process are:

• Identity and account data: your e-mail address, username, and chosen avatar. Your password is stored by our authentication infrastructure only in encrypted (hashed) form; we cannot see your raw password. Your e-mail address, however, is processed in raw (plain, un-hashed) form by our authentication infrastructure because it is needed for sign-in, account verification, and contacting you.
• Content data: the forum threads you open, your comments, likes, your Forum votes (the upvotes/downvotes you cast), your poll votes (which poll option you chose), follow relationships, the threads you save (a private list only you can see), your profile-hiding preference, private messages (DMs) you send, the reports you file, and the block records you create (who you have blocked).
• Transaction-security data: your IP address and browser/device information — processed for security mostly as an irreversibly masked/encrypted digest (hash); plus your login, logout, and session-refresh events and your last-seen time.
• Moderation and account-security records: the outcomes of reports you file or receive, the hiding/removal applied to your content, and any restriction (suspension) applied to your account.
• Automatically generated data: the notifications shown to you (which may include a short excerpt of the related content) and technical logs kept for the operation of the service.

We do not collect special categories of personal data (health, religion, ethnicity, etc.). Please do not share such data, or other people’s personal information, in your profile or content.

Purposes of processing

• To create your account and provide the service (forum, comments, likes, messaging, notifications, and following).
• To keep your account and the platform secure: detecting and preventing unauthorised access, fake/spam accounts, bots, and abuse.
• To enforce the community rules: assessing reports, running automated content pre-screening, and carrying out moderation decisions.
• To improve the service and produce aggregate/anonymous statistics (e.g. active-user counts and growth); these statistics do not identify you personally.
• To meet our legal obligations (including notices and requests under Law No. 5651).

Legal bases for processing

We process your personal data on the following legal bases under Art. 5 of the KVKK:

• Necessity for the establishment or performance of a contract (opening your account and using the service) — Art. 5/2-c.
• Compliance with our legal obligations (obligations under Law No. 5651) — Art. 5/2-ç.
• Our legitimate interests, provided they do not harm your fundamental rights and freedoms (security, abuse prevention, aggregate statistics) — Art. 5/2-f.
• Your explicit consent where it is required (for example, for certain international transfers).

Sharing and international transfers

We do not sell your data and do not share it with third parties for marketing. To operate the service we use only the following infrastructure and service providers (data processors):

• Cloud hosting and database/authentication infrastructure: providers, mainly in the European Union (Frankfurt) region, where the application and data are hosted.
• Content moderation (AI pre-screening): public threads and comments may be sent to OpenAI to automatically assess whether they breach the rules. Your private messages (DMs) are NOT sent to this screening. OpenAI is based in the United States.
• Bot and spam protection: Cloudflare Turnstile (human verification).
• Social sign-in (creating an account / signing in with Google): if you choose “Continue with Google”, your authentication is handled by Google and your e-mail address and basic account information are received from Google. Google is based in the United States.
• Error and performance monitoring: Sentry — limited technical data (masked/hashed IP and device information, your account identifier, and error details) may be sent to diagnose application errors.
• E-mail delivery: an e-mail service provider (may be US-based), via our authentication infrastructure, for account-verification and password-reset e-mails.

Because some of these providers are located abroad (notably OpenAI, Google, the e-mail service provider, and the error/performance monitoring provider; USA or EU), your personal data may be transferred internationally within the framework of Art. 9 of the KVKK. Transfers are limited to the purposes above and to the required legal safeguards.

How we collect data

We collect your personal data electronically through the website and application — via the forms you fill in and the content you create, and through the server logs generated while the service operates together with browser local storage — by partly automated means.

Retention periods

• Your account and content data: kept while your account is active. When you delete your account or request it, the data is deleted or anonymised, subject to any legal retention obligations.
• Notifications: automatically cleared after about 30 days.
• Private messages (DMs): cleared automatically even while your account is active — read messages in about 2 months (60 days), unread ones within about 6 months (180 days) at the latest; those subject to an open report may be retained.
• Login and security events: held largely in temporary memory and deleted when the server restarts; security-significant events (e.g. unusual sign-in attempts) may be sent to our error/security monitoring provider and retained there for a period. Only your last-seen time and a masked last-IP digest remain on your account.
• Records that must be kept longer by law may be retained for the relevant periods only.

Cookies and local storage

• Strictly necessary session cookie: to keep you securely signed in, only a session-refresh cookie that can be read by the server (HttpOnly) is used.
• Browser local storage (localStorage): used for your theme and language preference, a flag containing no personal data that indicates you have an active session (so the page opens in the correct state on refresh), a temporary cache for performance, and coordination between open tabs.
• Bot protection: Cloudflare Turnstile may use its own technical cookie/token for human verification.

We do NOT use advertising or third-party tracking/profiling cookies. We do not use cookie-based analytics such as Google Analytics; our statistics are aggregate and anonymous.

Your rights as a data subject (KVKK Art. 11)

By applying to the data controller, you have the following rights regarding your personal data:

• To learn whether your personal data is processed and, if so, to request information about it.
• To learn the purpose of processing and whether the data is used in line with that purpose.
• To know the third parties to whom the data is transferred, domestically or abroad.
• To request correction if the data is incomplete or inaccurate.
• To request deletion or destruction under the conditions set out in the KVKK.
• To request that correction, deletion, or destruction be notified to the parties the data was transferred to.
• To object to a result against you arising solely from automated analysis.
• To claim compensation if you suffer loss due to unlawful processing.

Contact and requests

To exercise the rights above, make a request regarding your personal data, or send a notice/complaint under Law No. 5651, our published contact channel is:

ercanli1149@gmail.com

We aim to resolve your request within a reasonable time (as a rule, within 30 days at the latest). We may ask for additional information to verify your identity.

Changes

This notice may be updated from time to time; for significant changes we try to inform the community. The effective date of the current version is shown below.