Privacy Policy

1. Who is responsible

The data controller for yangil.net is Eren Yangil, a private individual based in Istanbul, Türkiye. For anything about this policy or your data, email hello@yangil.net.

This policy is written to meet the Turkish Personal Data Protection Law No. 6698 (KVKK), including the information notice required by its Article 10, and the EU General Data Protection Regulation (GDPR) for visitors in the EU/EEA. The Turkish version of this page is the KVKK information notice (Aydınlatma Metni); if the two versions differ for a person in Türkiye, the Turkish version applies.

2. Summary

• Simply reading the site: technical request data only, no cookies set by me, no profiling.
• Analytics are cookieless and aggregated (Cloudflare Web Analytics).
• Your name, email and message are processed only if you contact me.
• I never sell or rent personal data and use it for no advertising.

3. What I process, why, and on what basis

3.1 Visiting the site (technical data)

Pages are served by my web server. Cloudflare runs the domain's DNS and may also sit in front of the server to protect it and deliver content; when it does, requests pass through Cloudflare first. To deliver pages and keep the site secure, the following is processed: IP address, date and time, requested URL, HTTP status, referring page, browser user-agent and approximate country derived from the IP.

• Purpose: delivering the site, preventing abuse and attacks, fixing errors.
• Legal basis: legitimate interest in operating a secure website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
• My server logs: IP addresses are shortened before they are written (IPv4 to the first two octets, IPv6 to the first 32 bits), cookie headers are dropped, and logs are deleted automatically after 14 days.
• Cloudflare: when it sits in front of the server, it processes request data as my processor and keeps it under its own retention rules (see Cloudflare's privacy policy ).

3.2 Analytics

I use Cloudflare Web Analytics to see aggregate page views, referrers, countries, browser and device types and page load performance. It does not use cookies or local storage, does not fingerprint visitors and does not track you across sites. I only see totals, never individual visitors.

• Purpose: understanding which pages are useful and keeping the site fast.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

3.3 Contact form

When you use the form on the contact page, your name, email address and message, plus the confirmation that you ticked the consent box, are sent from your browser to Web3Forms, which emails them to me. Web3Forms technically receives your IP address in the process. Nothing from the form is stored on my server.

• Purpose: reading and replying to your message.
• Legal basis: steps you asked for before a possible contract and my legitimate interest in answering enquiries (GDPR Art. 6(1)(b) and (f); KVKK Art. 5(2)(c) and (f)). The transfer abroad relies on your explicit consent (KVKK Art. 9; see section 5).
• Is it required? No. Name, email and message are needed to reply, but you can always email me directly instead.

3.4 Email

Email you send to hello@yangil.net is forwarded by Cloudflare Email Routing to a Gmail mailbox operated by Google. Form messages are sent by Web3Forms straight to that same mailbox. I process the content of the email, your address and any data you choose to include, for the same purposes and on the same legal basis as in 3.3. Please do not send sensitive personal data (health, beliefs and similar); I do not need it.

3.5 Things this site does not do

• No user accounts, newsletters, comments or payments.
• No advertising, retargeting or social media pixels.
• No embedded third-party content: fonts, images and scripts are served from yangil.net itself, apart from the Cloudflare analytics script.
• No automated decision-making or profiling with legal or similar effect.

4. Who receives data

Beyond these providers, data is shared only if the law requires it, for example on a binding request from a court or authority, or to establish or defend legal claims.

5. Transfers outside Türkiye and the EU

All providers above process data outside Türkiye, and some outside the EU/EEA (mainly the USA).

• KVKK: technical data for site delivery and security is transferred under the safeguards those providers offer. Contact form data is transferred on your explicit consent, which you give by ticking the box on the form (KVKK Art. 9). Without it the form will not send; emailing me directly remains open to you. You can withdraw consent at any time for the future by emailing me.
• Possible risks: the destination countries may not offer protection equivalent to Türkiye's or the EU's, their authorities may be able to access the data under local law, and enforcing your rights there may be harder. Please weigh this before sending the form.
• GDPR: transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses included in the providers' data processing terms.

6. How long data is kept

7. Your rights

Under KVKK Article 11 you may ask whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; learn the third parties it is transferred to in Türkiye or abroad; request correction of incomplete or inaccurate data; request erasure or destruction under Article 7; request that third parties are notified of correction or erasure; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

Under the GDPR you have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21), and you may withdraw consent at any time without affecting earlier processing.

To use any right, email hello@yangil.net from the address concerned, or send a signed letter. I reply free of charge as soon as possible and within 30 days at the latest. I may ask for information to confirm your identity before acting.

You may also complain to a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK) , in the EU/EEA the authority of the country where you live or work.

8. Security

The site is served only over HTTPS with HSTS, a strict set of security headers and a content security policy. The server is hardened (key-only SSH, firewall, intrusion banning), and only the deploy pipeline can change site files. No system is perfectly secure, but I take reasonable technical and organisational measures for a site of this size.

9. Children

This site is not aimed at children. Please do not send personal data if you are under 16. If a child has contacted me, email me and I will delete the message.

10. Links to other sites

Links to GitHub, LinkedIn and project demo sites lead to services with their own privacy policies. When you follow a link, the other site only learns that you came from yangil.net, not which page.

11. Changes

If what this site does with data changes, this page will be updated and the date at the top will change. Significant changes will be noted here.

See also the Cookie Policy and the Terms of Use.