o_OS_MAN/ personal space↖ Back to the desktop
~/privacy

Privacy & Cookies

Updated 19 September 2026 · Personal data notice / KVKK aydınlatma metni

This is Osman's personal website. Osman (osmank.com) is the site owner and data controller. For privacy questions or requests, email cesur@osmank.com.

What is collected, and why?

  • Guestbook: your chosen name or nickname, message, submission date/time and a browser identifier. Your name, note and timestamp are public. The friends’ wall stores the same information, linked to a backroom session instead; it is visible to the owner and anyone with backroom access. Avoid sensitive information or other people's personal details.
  • Reactions: the post, selected reaction, timestamp and browser identifier, to remember your choice and allow one reaction per browser per post. Only totals are public.
  • Backroom and security: submitted passwords are checked, not saved as entered. The database holds hashed session tokens, expiry and password-version information. Login protection uses a hash of your IP address, attempt counts and timestamps; hashing does not make this anonymous. Community writes also create rate-limit counters.

Information arrives electronically through your browser, forms and requests. Under KVKK Article 5, publishing the details you deliberately make public relies on Article 5(2)(d). Necessary operation of requested features, access protection and abuse prevention rely on legitimate interests under Article 5(2)(f), subject to your rights and freedoms. This notice is information, not a request for blanket consent.

Cookies and your device

The site has no advertising, analytics, fingerprinting or session-replay code. Its first-party storage supports the features below:

  • visitor cookie: a random browser identifier for notes, reaction choices and rate limits. Set when the community API loads, including when you first view the guestbook or reactions; expires after 365 days. It is not an account or your name.
  • __Host-backroom cookie: keeps you signed in after unlocking the room. Expires 400 days after the latest authenticated request, unless you log out earlier. Both cookies are HttpOnly and Secure on HTTPS; the visitor cookie uses SameSite=Lax and the backroom cookie SameSite=Strict.
  • localStorage: saves theme/CRT/rainbow and Matrix settings, background effects and a chosen background image, keyboard shortcuts, and music volume, track, shuffle and repeat settings. These preferences and the background image stay in your browser; the site does not upload them. They have no set expiry.

You can clear or block site storage in your browser. This resets preferences and remembered reactions and can prevent interactive features from working. Log out to revoke a backroom session. Clearing cookies alone does not delete database records. Terminal files and command history last only until the page reloads.

Retention

Notes and reactions have no automatic expiry; they remain until removed. Click your selected reaction again to delete it, or contact me about a note. Public rate-limit records have no automatic cleanup. Backroom counters older than a day and expired or password-invalidated sessions are cleaned up on the next successful login, so physical deletion can happen later than expiry. Logout deletes the current session, not your notes.

Infrastructure and logs

Production uses Vercel for hosting/functions and Turso for the database. Hosting handles technical request data such as IP addresses, browser headers, paths and timestamps. The application logs operational errors; it does not deliberately log passwords or request bodies. Provider log and backup retention depends on service plans and settings; this site does not define a fixed period for them. See Vercel's privacy policy and Turso's privacy policy.

Fonts load from Google Fonts, which receives your IP address and request headers to deliver them (Google's information). These providers may process data outside Türkiye, including in the US. Social profiles and the external video open only if you follow their links; they are not embedded. RSS is a public feed, with no email subscription list.

Your rights and contact

Under KVKK, you can ask whether your data is processed, request information about its use and recipients (including abroad), request correction or deletion where applicable and notification to recipients, object to adverse results from solely automated analysis, and seek compensation for unlawful processing. There is no automated profiling here.

Email cesur@osmank.com, identifying the note or post concerned. Do not send your password or session cookie. I may need proportionate information to verify a request. KVKK applications must be answered as soon as possible and within 30 days. You may complain to the KVKK Board after first applying to the controller, subject to the statutory deadlines.