Privacy Policy
1. Who we are
Sinefil Forum ("we", "us") operates this forum. For any question about this policy or your data, contact us at privacy@sinefil.org — this is the one address for every privacy-related request.
2. What we collect
- Account data: username, email address, password (stored and hashed by our authentication provider, Supabase — we never see it in plain text).
- Profile data you choose to add: avatar, website, location, occupation, interests, signature.
- Content you post: topics, replies, drafts, reactions, and reports you file.
- Activity data: which topics/forums you watch, your read/unread state, your last-seen time, notification preferences, and — briefly — your IP address when it's used to rate-limit sign-in and account-recovery attempts against abuse. It's kept only for the few minutes that check needs, never stored long-term.
- Standard hosting/security logs our infrastructure providers (below) keep as part of running the service — we don't control their exact retention, but we don't use them for anything beyond running and securing the forum.
We do not collect payment information, government ID numbers, or any data from anyone we know to be under 13.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR/KVKK) |
|---|---|
| Running your account and displaying your posts | Performance of the contract you accept by registering (our Terms) |
| Keeping the forum secure (rate-limiting, ban enforcement) | Our legitimate interest in preventing abuse |
| Sending you notification emails you opted into | Your consent — each type is opt-in or has a one-click unsubscribe |
| Responding to a legal obligation (e.g. a lawful data request) | Legal obligation |
4. Who we share it with
We don't sell your data. It's shared only with the providers that run this service on our behalf, each acting as our data processor:
- Supabase (database, authentication, and file storage) — hosted in the EU (Frankfurt).
- Vercel (web hosting) — hosted in the EU (Frankfurt).
- Resend (delivery of the notification/account emails you request or opt into).
- Sentry (error monitoring, so we can find and fix bugs — it sees technical error details, not your posts).
Some of these providers operate internationally; where a transfer outside the EU/Türkiye happens, it's covered by that provider's own Standard Contractual Clauses or an equivalent safeguard.
5. How long we keep it
We keep your account and content for as long as your account exists. If you delete your account (see below), we:
- clear your personal fields (email, avatar and its image file, signature, website, location, occupation, interests) and your last-seen time immediately,
- delete your activity data: the topics and forums you watch, your read/unread state, the notifications you received, your drafts, your reactions, and your blocks (both the ones you made and the ones others made of you), and switch off notification emails,
- keep your username and your public topics and posts, reassigned to this forum's "deleted user" placeholder — the same treatment for self-deleted and admin-deleted accounts, so that other members' discussions stay readable. Records of moderation and reports that involve your username (for example a report you filed) are kept for the forum's own safety records,
- delete your linked login for real.
All of this happens at once: either everything above is done, or — if something goes wrong — nothing is, and you can simply try again.
We don't keep a separate copy of data we've just deleted beyond our existing operational backups' own short retention window — used only for disaster recovery, never browsed for individual records.
6. Cookies
We use only a small number of first-party, strictly necessary or functional cookies:
- Sign-in session (set by our authentication provider) — keeps you signed in.
- Language preference — remembers whether you're using the site in English or Turkish.
- Anonymous view/read counter (signed-out visitors only) — a random id used only to avoid double-counting a topic's view count.
None of these are advertising or analytics cookies, and none are shared with a third party for tracking. Because of that, no cookie-consent banner is shown — if that ever changes (e.g. we add analytics), this policy and that decision will be updated first.
7. Your rights
Under KVKK (Turkish Law No. 6698) and the GDPR, you have the right to:
- know whether we process your data, and access it — see "Your data" in Account Settings for an instant, self-service copy,
- request correction of inaccurate data — most fields are editable directly in Settings,
- request erasure of your account — see "Danger Zone" in Account Settings, self-service and immediate,
- object to or restrict certain processing, and
- lodge a complaint with your national data protection authority (in Türkiye, the KVKK Board; in the EU, your local supervisory authority).
To exercise any right this page doesn't already let you do yourself, email privacy@sinefil.org.
8. Security
Passwords are hashed by our authentication provider and never stored or seen by us in plain text. All traffic to this site is encrypted (HTTPS). Access to the underlying database is restricted by row-level security and role-based permissions, and backups are encrypted.
9. Children
This forum isn't directed at children, and registration isn't intended for anyone under 13 (or the minimum age required by your local law, if higher).
10. Changes to this policy
We may update this policy as the forum changes. Material changes will be reflected here with an updated effective date.
11. Contact
This is a first draft, written to reflect what this forum's software actually does. It has not yet been reviewed by a lawyer — treat it as a good-faith starting point, not final legal advice.