Privacy Policy

a) Contact form

• Your name, email address, subject and message
• The time you confirmed on the form that you have read the Privacy Policy (on the Turkish-language form, also the KVKK Notice)

Your full message is forwarded to us in a notification email, and you receive an automatic acknowledgement email. If your request is not answered within 24 hours, your name and the subject are sent to the administrator’s Slack notification channel as a reminder. Your IP address is not added to the form record.

b) Project quote form

• Name and email address; optionally phone number and company name
• Project type, name and description, target platform, budget range, timeline, priority and requested features
• How you heard about us and the time you confirmed that you have read these notices

A summary of the request (name, email, project name and type, budget, timeline) is forwarded to us in a notification email, and you receive an acknowledgement email. If the request is not answered within 24 hours, your name and the project name are sent to the administrator’s Slack notification channel as a reminder. Your IP address is not added to the form record.

c) KVKK request form

• Name and email address; optionally phone number and identity verification details
• Request type and your description
• The IP address from which the request was sent (for the security of the request)

Your request is forwarded to us in a notification email, and you receive an acknowledgement email containing your request number.

d) Newsletter subscription

• Your email address, the form you subscribed through, your language and status
• The time you confirmed your subscription (as proof of consent)
• Newsletter statistics (from the newsletters sent to you only, for your confirmed subscription): number of opens and clicks, time of last engagement

Subscription uses double opt-in. After you submit the form, you receive a confirmation email. Its link opens a page, and your subscription starts only when you press the “Confirm my subscription” button on that page. The link is valid for 7 days. Records that were never confirmed (awaiting confirmation, unsubscribed before confirming or undeliverable) are deleted after 14 days. Your IP address is not stored in the subscriber record.

Every newsletter contains a one-click unsubscribe link, and your email client’s “unsubscribe” option (List-Unsubscribe) also works. Reporting a newsletter as spam also unsubscribes you. When you unsubscribe, your record is marked “unsubscribed” and your name (if any), newsletter statistics and tags are deleted. Your email address is kept only to prevent further newsletters from being sent to you; the time of your confirmation remains in the record as proof of the consent you gave. Event records of the emails already sent to you (section e) are kept separately for 13 months.

If the newsletter permanently cannot be delivered to your address (for example, the mailbox no longer exists), sending stops and the record is marked “undeliverable”; temporary delivery failures do not change the record. A confirmed record stays in this state until you unsubscribe or ask for it to be deleted. If the address becomes reachable again, sending may resume on the basis of the consent you gave earlier; this is not done if you have unsubscribed. If the form is submitted again with this address after you unsubscribed or after a delivery failure, the record awaits confirmation again: your name, tags and newsletter statistics are deleted, and nothing is sent until you confirm again. Because anyone who knows the address can submit the form, the earlier confirmation and unsubscribe times stay as proof until you confirm again; a record that was never confirmed is deleted entirely if it is not confirmed within 14 days.

e) Emails we send

Emails sent on behalf of the Site (form and request acknowledgements, confirmation emails and newsletters) are delivered through Resend. For each email we record the recipient address, subject, template and events such as sent, delivered, opened and clicked; for clicks only the link address is kept, without query parameters. Opens and clicks are measured with Resend’s tracking pixel and link redirect (links.muhittincamdali.com). Resend sees your IP address and browser details when this happens; we do not store them.

f) Chatbot

Messages you type into the chat window are sent to Google LLC’s Gemini service (USA) to generate a reply. Only the message texts (the last 10 messages as context) are sent to Gemini; your IP address, identifiers and browser details are not.

We use Gemini’s free tier. Under the Gemini API terms, content submitted on this tier and the generated replies may be used to improve Google’s products and services and may be read by human reviewers. Please do not enter personal data such as your name, email address or phone number, or any confidential information, in the chat.

If you have given analytics consent, the conversation is stored for 90 days: the messages, visitor and session identifiers, a coarse device family (e.g. “Chrome/Windows”), a keyed hash of your IP address, the page where you started the chat and the language. Without consent, the conversation is not stored. The chat history is also kept only in the open browser tab and is deleted when you close it.

g) Analytics (only with your consent)

If you allow analytics in the cookie preferences, our own measurement tool creates a visitor identifier (mc_visitor_id) and a session identifier (mc_session_id) in your browser. Together with these identifiers, the following data is sent to muhittincamdali.com/api/analytics, i.e. the same server that hosts the Site (Hetzner, Germany); it is not sent to a third-party analytics company:

• Pages you visit, time spent on them and scroll depth
• Referring address and campaign (UTM) parameters
• Device type, operating system, browser family, screen size, browser language and colour scheme
• Links and buttons you click (element type and description, first 100 characters of its text, link address, click position)
• Names of the form fields you reach (not the values you enter), the subject type you choose on the contact form, searches on the blog and code copying
• Browser error messages and page performance metrics
• The country derived by Cloudflare from your IP address and a keyed hash of your IP address (the IP address itself is not stored)

When you decline or withdraw consent, both identifiers are deleted from your browser immediately and measurement stops.

h) Identifier-free measurement (no consent required)

Even without analytics consent, an identifier-free, aggregate measurement runs to check that the Site works properly. It records: page path, scroll depth (25%, 50%, 75%, 100%), repeated or ineffective clicks and their position, an in-page description of the clicked element, slow interactions, whether the page is visible or in the background, clicks on consulting links, browser error messages, browser window size, device and connection type, language and the country code derived by Cloudflare from your IP address.

These records contain no visitor or session identifier, and your IP address is not stored. If you have consented, your visitor and session identifiers are added to the same events. Without consent, no persistent visitor identifier is created for measurement; the only exception is the cookie set when you like a post so that the like is counted once (see j).

i) Achievement notifications

When you unlock an achievement anywhere on the Site, the name of the achievement and the page language are reported to the server; achievements unlocked earlier in your browser but not yet reported are reported at the same time. If you have given analytics consent, your visitor identifier is added; otherwise a new random identifier is used for every notification, so notifications cannot be linked to you. Your IP address is not recorded. Achievements already reported are marked in your browser (mc_achievements_reported) so they are not sent again; this marker is not an identifier and is not sent to the server.

j) Blog engagement

When you like a post, a mc_visitor_id cookie containing a random identifier is set in your browser (1 year; readable only by the server) so that the like is counted once, and the post, this identifier and the action type are recorded. If you have given analytics consent, post views are counted uniquely the same way. Bookmarks are kept only in your browser.

k) Error reports

When an error occurs on the Site or the server, error details are sent to Sentry (Functional Software, Inc., USA); event data is stored in Sentry’s EU (Germany) region. Sent data: error message and stack trace, page address and referrer (without query parameters), browser, operating system and language, and the navigation and click steps before the error. In addition, a session summary showing whether the visit ended without errors is sent on each visit; no persistent identifier is created in your browser for this. IP addresses and cookies are not stored; only the country is derived from the IP address. Session replay is not used.

l) Security logs

Our server logs every request with the IP address, date and time, requested address, response code, referrer and browser details (access log). To prevent abuse, rate-limit records (IP address) and application error logs (which may contain an IP address) are kept. The chat service records abuse events, such as exceeding the rate limit, with a keyed hash of the IP address and a coarse device family.

m) Admin login

Admin panel login attempts are stored with the IP address and browser details to prevent unauthorised access.

n) Data that stays on your device

Your theme, language and sound preferences, game high scores, achievement progress, like and bookmark markers and your Google Fonts choice are kept only in your browser and are not sent to the server (except the achievement notification above). The full list is in our Cookie Policy.