Legal

Privacy Policy

Last updated: 17 September 2026

This notice explains the limited personal data processed when you use evrenbal.com, the purpose and legal basis of each activity, the recipient groups, retention boundaries, and your rights under Türkiye's Personal Data Protection Law No. 6698 (KVKK). PostHog analytics and masked session replay run only after an affirmative choice.

Data controller and scope

Evren Bal is the data controller for evrenbal.com. The direct contact address for privacy questions and requests is hello [at] evrenbal [dot] com. The site has no user accounts, comments, contact form, or newsletter registration. An external service you choose to visit may separately process data under its own notice.

How data is collected

Technical request data is obtained automatically, wholly or partly by automated means, when your browser requests a page through Cloudflare. Analytics events and masked session replay data are collected automatically only after consent. The browser records an analytics choice when you operate the consent controls. Contact data is obtained from the email, X, or LinkedIn message that you voluntarily send.

Site delivery and security: purpose, legal basis, and recipients

A request may include an IP address, date and time, requested URL, HTTP headers, referrer, browser or device information, routing data, and security-event information. It is processed to deliver and cache the requested page, maintain service integrity, diagnose failures, and prevent abuse. The legal basis is the controller's legitimate interest under KVKK Article 5(2)(f), provided that this does not harm the visitor's fundamental rights and freedoms. The recipient groups are Cloudflare, Inc. and its documented subprocessors, for content delivery, routing, caching, availability, and security. This repository adds no custom application request log or visitor database.

Analytics choice record in browser storage

The site writes the JSON record evrenbal_analytics_consent to local storage. It contains only version 3, a choice of granted or denied, and the updatedAt timestamp; it is not copied to a site database or sent as a consent log. The code sets no automatic expiry, so the record remains until you change or withdraw the choice, clear browser data, the browser evicts it, or a later consent version makes it invalid. A malformed, unknown, or outdated record is treated as no decision. “Not now” writes only the value 1 under evrenbal_analytics_consent_deferred in sessionStorage and expires with that browser session; it is not consent. Remembering and respecting the choice relies on the legitimate-interest condition in KVKK Article 5(2)(f), while the analytics and replay processing relies on consent.

Optional PostHog analytics and session replay

Only after you allow analytics, PostHog measures basic page views and records masked session replay so I can understand readership and improve the site. Replay is not a screen video: it reconstructs the page from DOM snapshots and changes and may include visible page text and images, the page URL and title, clicks, scrolling, viewport size, and general browser, device, and operating-system information. All ordinary form and input values are masked; hidden and file inputs are blocked. PostHog may also receive a pseudonymous browser or session identifier, an IP address during collection for routing, security, and approximate-location derivation, and approximate country or region according to the configured project settings. I do not intentionally send names, contact details, or other direct identifiers, and I do not identify visitors by name or email. The legal basis is explicit consent under KVKK Article 5(1); refusal leaves all content available. PostHog and its documented subprocessors are recipient groups for measurement, reporting, replay, support, and security.

PostHog delivery

After consent, a locally bundled PostHog browser library connects to the configured PostHog Cloud EU ingestion and replay services. The site does not use the Google tag, Google Tag Gateway, advertising tags, or PostHog's standalone automatic interaction capture. The replay timeline records clicks and scrolling within the consented session, while the separate autocapture feature remains disabled. The browser may keep PostHog's anonymous or pseudonymous identifier in local storage or a cookie so returning visits can be counted consistently. PostHog processes the forwarded analytics and replay data for measurement and reporting. The configured provider region and project controls do not by themselves determine the legal basis or compliance of an international transfer; that assessment remains separate.

Retention and deletion boundaries

The site itself retains no server-side copy of the analytics choice or analytics events. If Cloudflare Workers Logs is enabled, Cloudflare's current documentation gives invocation-log retention of 3 days on the Workers Free plan and 7 days on Workers Paid, with 7 days as the maximum; the live plan and dashboard state were not verified in this repository review. Cloudflare may separately retain Customer Logs, derived Network Data, and security or contractual records according to the service, contract, necessity, and legal-obligation criteria in its Privacy Policy and DPA; this site does not set those provider-controlled periods. PostHog project retention, deletion, and IP-capture settings are provider-side controls and are not verifiable from this repository; they must be checked in the live project before being treated as current production facts.

Contact messages

If you write to hello [at] evrenbal [dot] com or message through X or LinkedIn, I process the sender information, message content, time, and any material you choose to provide to answer you or handle a rights request. The legal basis is the legitimate interest in responding under KVKK Article 5(2)(f), or the establishment, exercise, or protection of a right under Article 5(2)(e) where the message concerns a legal claim. Recipient groups are the email-infrastructure provider or the social platform you selected, and authorized public bodies where disclosure is legally required. The repository does not identify the mailbox provider or prove a fixed mailbox-deletion schedule; avoid sending unnecessary identity copies or sensitive data.

Recipient groups and transfer purposes

In summary, technical request data may go to Cloudflare and its subprocessors for delivery and security; consented analytics data may go to PostHog Cloud EU and its subprocessors for measurement, reporting, support, and security; contact data may go to the email or social-communication provider you use so the message can be delivered; and limited data may be disclosed to courts or competent public bodies only where legally required. I do not sell personal data or provide it to advertisers for cross-site advertising.

Processing and transfers outside Türkiye

Cloudflare's globally distributed network may process technical request data outside Türkiye, and consented analytics requests are forwarded to PostHog Cloud EU and its subprocessors, which may also involve processing outside Türkiye. Cloudflare's DPA and PostHog's privacy and processing materials describe provider safeguards under their respective legal regimes. Those provider terms or standard contractual clauses do not by themselves prove a valid KVKK Article 9 transfer mechanism. The Authority currently lists no adequacy countries. The controller must separately assess the applicable Article 9 transfer requirements for the configured analytics and site-delivery flows, obtain qualified advice where necessary, and retain the relevant evidence. Analytics consent under Article 5 does not by itself resolve a regular international transfer.

Advertising settings and external-configuration limitation

The intended configuration has no ad placement, remarketing tag, social tracking pixel, user-provided-data collection, or advertising link, and it does not identify visitors by name or email. Session replay starts only after consent. All ordinary form and input values are masked, hidden and file inputs are blocked, and network headers and bodies, network URLs, canvas content, cross-origin iframes, JSON-LD, font collection, and mouse-movement recording are disabled. PostHog's standalone automatic interaction capture remains disabled. PostHog project retention, IP-capture, replay sampling, and other provider-side settings are external dashboard facts, not values enforced or evidenced by this repository. They must be checked again before being treated as current production facts and whenever the PostHog project or collection configuration changes.

Your rights under KVKK Article 11

You may ask whether your personal data is processed; request information if it is; learn the processing purpose and whether the data is used consistently with that purpose; know the domestic or foreign third parties to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Article 7; request notice of correction, deletion, or destruction to third parties that received the data; object to a result against you produced solely by automated analysis; and claim compensation for damage caused by unlawful processing. Analytics data may be pseudonymous or aggregated, so a message account cannot always be matched reliably to the same browser's analytics record.

How to make a KVKK request

Send the request to hello [at] evrenbal [dot] com with the subject “KVKK Article 11 request”. Include your name and surname, a reply address, the specific right and request, and only the supporting information needed to locate the relevant record and verify identity; do not send unnecessary identity-document copies or sensitive data. Requests received at this channel will be handled, and proportionate additional verification may be requested. The statutory procedure also permits a signed written request, KEP, secure electronic signature, mobile signature, or an email address you previously notified to the controller and that is registered in the controller's system. The request will be answered as soon as possible and no later than thirty days, normally free of charge subject to the Authority's tariff. You may also decline or withdraw future analytics through the floating “Analytics Preferences” button at the lower left of the page.

Changes

This policy must be reviewed when hosting, analytics, tags, cookies, browser storage, recipient groups, retention settings, contact methods, or international-transfer safeguards change. The date at the top records the latest content review, not proof that every external dashboard fact was verified on that date.

Contact

For a privacy question or request, write to hello [at] evrenbal [dot] com. X and LinkedIn remain optional alternatives.