Whiscret
Sign in
Türkçe

Whiscret KVKK Disclosure Notice (Summary)

Last updated: 10 September 2026

Turkish Personal Data Protection Law No. 6698 (KVKK) requires a disclosure notice ("Aydınlatma Metni") in a set format. The binding Turkish version is the KVKK Aydınlatma Metni; this page summarises it in English. Our full Privacy Policy explains everything in more detail.

1. Data controller

Talha Orak, an individual based in Türkiye · Türkiye · talhaorak@gmail.com

2. Data we process

Account data (email, hashed password, username, sign-up date, record of your Terms acceptance and age confirmation); profile data (avatar, bio, social links, 24-hour moods); questions, answers, timestamps, anonymity flag and the sender's account ID when signed in; abuse-prevention data on each question (keyed hash of the IP address, country code, shortened browser identifier); notification records and your email-notification setting; Spotify and X OAuth tokens and account identifiers if you link those accounts; your cookie choice; server logs; and correspondence with us. We do not request or knowingly process special categories of data.

3. Purposes

Creating and securing your account; showing your public profile, answered questions and the public feed; delivering questions to profile owners; keeping anonymous askers anonymous; detecting and limiting spam and abuse; meeting traffic-record and disclosure obligations under Law No. 5651; sending in-app and (if enabled) email notifications; showing Spotify listening data and posting answers to X at your request; running the service securely; answering your requests; and applying the age rules of Law No. 7578. No marketing, advertising or profiling.

4. Legal grounds (KVKK Art. 5)

  • Art. 5(2)(c), necessary for a contract: account, profile, questions, answers, moods, notifications.
  • Art. 5(2)(ç), legal obligation: traffic records under Law No. 5651, consent and age records, rights requests, requests from authorities.
  • Art. 5(2)(f), legitimate interest: abuse-prevention data, server logs, service security, delivering questions sent by guests.
  • Art. 5(2)(e), establishing, exercising or protecting a right: handling reports and legal claims.
  • Art. 5(1), explicit consent: linking Spotify and X (withdraw by unlinking); any optional analytics cookies added later.

5. How data is collected

Electronically, by automatic or partly automatic means: sign-up, profile, question, answer and settings forms; in-app interactions; server records; the cookies and local storage described in the Cookie Policy; and the Spotify and X APIs when you link those accounts.

6. Recipients

Service providers acting on our instructions (Supabase, Inc. for database, authentication, storage and account emails; Railway Corp. for hosting); Spotify AB and X Corp. only if you link those accounts; courts, prosecutors, the Personal Data Protection Board, the Information and Communication Technologies Authority and other competent authorities when legally required; and the public, for the parts of your profile that are public by design. The identity of an anonymous asker is disclosed only when the law requires it or a competent authority orders it.

7. Transfers abroad

Data is stored outside Türkiye: Supabase in Frankfurt, Germany, and application servers in Amsterdam, Netherlands (Railway, europe-west4); Spotify AB is in Sweden and X Corp. in the United States. Transfers rely on the appropriate safeguards in KVKK Art. 9(4), in particular the standard contracts published by the Personal Data Protection Board, which must be notified to the Board within five business days of signature. Transfers to Spotify and X happen at your own initiative and with the explicit consent you give when linking. [LEGAL REVIEW: confirm the Art. 9 mechanism for each recipient and complete the Board notification.]

8. Retention

Account and profile data until deletion; questions and answers until the owner deletes them or the account; moods shown for 24 hours and removed with the account at the latest; abuse-prevention data up to 24 months [LEGAL REVIEW: confirm against Law No. 5651]; OAuth tokens until unlinking; notification records until deletion; cookie choice 12 months; server logs 30 days; correspondence as long as needed to handle the matter and demonstrate compliance.

9. Your rights (KVKK Art. 11)

You may ask us whether your data is processed; request information about it; learn the purpose and whether it is used accordingly; learn the third parties in Türkiye or abroad to whom it is transferred; request correction of incomplete or inaccurate data; request deletion or destruction under Art. 7; ask that corrections and deletions be notified to recipients; object to a result that is against you and produced solely by automated analysis; and claim compensation for damage caused by unlawful processing. You may withdraw consent at any time (for example by unlinking Spotify or X). You can edit most profile data and delete your account yourself in Settings.

10. How to apply

Send your request in writing to Türkiye, by email from the address registered on your account to talhaorak@gmail.com, or via registered electronic mail (KEP), secure electronic signature or mobile signature. Include your name, the subject of your request, your Turkish ID number (or nationality and passport/ID number for foreign nationals), your postal address and, if available, your email address and phone number. We answer free of charge as soon as possible and within 30 days at the latest; a fee set by the Board may apply if the response involves extra cost.

If we reject your request, you find our answer insufficient, or we do not answer in time, you may complain to the Personal Data Protection Board (https://www.kvkk.gov.tr) within 30 days of learning our answer and in any case within 60 days of your application (KVKK Art. 14). You must apply to us before complaining to the Board.

11. Age limit

Whiscret does not provide services to children under 15, in line with the provisions Law No. 7578 added to Law No. 5651. We record your age confirmation at sign-up, may ask for age verification where required, and delete accounts found to belong to children under 15. [LEGAL REVIEW: confirm the age-verification method to be set by the BTK and whether Whiscret qualifies as a "social network provider".]

12. Changes

We update this notice when the service or the law changes. The current version is always published on Whiscret; material changes are also announced in the app and/or by email.