Your Data and Your Rights (draft)

Before publishing

• Account deletion is incomplete today: the web and API paths differ and related records are not all removed — see Security and Privacy. Fix it before promising deletion here.
• Data export does not exist yet. Either build it or describe the request-by-email process below.
• Must match the final Privacy Policy; counsel to confirm the KVKK Article 11 / GDPR wording and response deadlines.

What we keep about you

Data	Why
Name, email address, password (stored only as a one-way hash)	Your account and signing in
Posts, comments, polls you create	Showing them in the forum
Poll votes	Counting results. TODO: state who can see individual votes — treat as sensitive.
Sign-in sessions and app tokens	Keeping you signed in
Technical logs (IP address, time, request)	Security and abuse prevention, kept TODO days

We do not sell personal data.

Your rights

Under Türkiye’s personal data law (KVKK, Article 11) and, for users in the EU, the GDPR, you can:

• see what personal data we hold about you;
• correct it — name and email directly in Profile;
• export it — TODO: self-service export, or request by email;
• delete it — Profile → Delete Account, or by request;
• object to processing and complain to the data protection authority (KVKK Kurumu in Türkiye).

How to make a request

TODO: the address (e.g. kvkk@demostatics.com or privacy@…), what identification we need, and the response time (KVKK: within 30 days).

What deleting your account does

TODO after the deletion fix: which data is removed immediately, what is anonymised (e.g. forum posts shown as “deleted user”), and what must be kept for legal reasons (e.g. invoices).