Privacy policy

Who is responsible for your data

Turkey Travel Forum (https://www.turkeytravelforum.com) is operated by Turkey Travel Forum, based in Türkiye, who is the data controller under the GDPR and the Turkish Personal Data Protection Law (KVKK). For anything in this policy, email hello@turkeytravelforum.com or use the contact form.

The short version

• We store the minimum needed to run a forum: your email, your username, what you post, and short-lived security logs.
• No advertising, no affiliate tracking, no selling or sharing of data for marketing. Google Analytics runs only if you click “Accept” on the cookie banner; otherwise the only cookie is your session.
• Your email is never shown publicly and is used only to sign you in and to reply if you contact us.

Data we process and why

1. Account data

What: email address, username, name, a hashed password if you sign up with one (stored with scrypt; we never see or store the password itself), and the optional profile details you choose to add: avatar, status, bio, location and country, job role and company, website and social-media handles, and interview answers; plus account dates, role and reputation score. If you sign in with Google we also store the Google account identifier and the name and profile picture Google provides; we do not receive your Google password.

Why: to create and secure your account, show who wrote what, and let you manage your profile. Legal basis: performance of the contract with you (the terms of use).

Public: everything on your profile page — username, name, avatar, status, bio, location, country, job role, company, links, interview answers, join date, last-active time, reputation and your posts — is visible to everyone, including search engines. Your email and password are not.

2. Content you post

What: topics, replies, votes, bookmarks, reports you file, and uploaded images, with timestamps. Why: that is the service. Legal basis:contract. Posts are public and are kept after account deletion (see “Deleting your account”). Votes and bookmarks are private to you and are deleted with your account. Reports you file are visible to moderators only.

3. Security and rate-limiting logs

What: your IP address, together with the time and the action (sign-in request, post, report, contact form), and standard web-server logs (IP, URL, browser, timestamp) kept by our host. Why: to limit spam and abuse, to debug problems, and to investigate attacks. Legal basis: legitimate interest in keeping the forum secure. Retention: 30 days, then deleted or anonymised. Moderation actions (who hid what and why) are logged for as long as the account exists.

4. Sign-in emails

When you ask for a sign-in link we store a one-time token tied to your email for 15 minutes, and send the email through Brevo. A session record is kept for up to 60 days of inactivity, or until you sign out or delete your account.

5. Notifications

Replies, mentions and accepted answers create in-site notifications tied to your account. We do not currently send notification emails; if we add optional email digests they will be off by default.

6. Contact form

Your name, email and message are emailed to us and kept in our mailbox for as long as needed to deal with the request, normally no more than 12 months. Legal basis: legitimate interest in answering you, or legal obligation for data-rights requests.

7. Visit statistics (Google Analytics, only with your consent)

What:if you click “Accept” on the cookie banner, Google Analytics 4 records which pages you view, how you arrived (for example from a search engine), your approximate region, device and browser type, using the _ga cookies. IP addresses are not stored by Google Analytics 4. Google signals and all advertising features are switched off. Why: to see which guides and threads help travellers and what to improve. Legal basis:your consent, which you can withdraw at any time via “Cookie settings” in the footer. Retention:14 months. If you click “Decline” or ignore the banner, the Google Analytics script is not loaded at all.

Cookies

Strictly necessary cookies (no consent needed):

• Session cookie (authjs.session-token and a CSRF token) — keeps you signed in. Deleted when you sign out or after 60 days.
• Cloudflare Turnstile — the anti-spam check on sign-in, posting and contact forms may set a short-lived cookie on Cloudflare's domain to tell humans from bots. It is not used for advertising.

Optional, only after you click “Accept”:

• Google Analytics (_ga, _ga_*) — anonymous visit statistics, kept up to 14 months. Choosing “Decline” later in “Cookie settings” stops the script and deletes these cookies.

We do not use advertising or social-media cookies. Your browser's local storage remembers your cookie choice and small UI preferences (for example a dismissed notice); that data never leaves your device.

Processors (who else sees data)

We use a small number of companies to run the forum. Each acts on our instructions under a data-processing agreement:

Google only receives data if you choose “Continue with Google” or accept analytics cookies; the email-link sign-in involves no Google processing. We do not sell, rent or trade personal data to anyone.

International transfers

Hosting and the database are in Germany (EU). Email is sent from the EU. Cloudflare and Google are US companies certified under the EU–US Data Privacy Framework and also rely on Standard Contractual Clauses. The operator is in Türkiye, which means account data is accessed from there for moderation and support; Türkiye is not currently covered by an EU adequacy decision, so this access relies on Standard Contractual Clauses and the necessity of running the service you signed up for.

How long we keep data

• Account data: until you delete the account (then anonymised, see below).
• Posts: indefinitely, as part of the public archive, anonymised after account deletion.
• Security/rate-limit logs: 30 days.
• Sign-in tokens: 15 minutes. Sessions: 60 days.
• Contact emails: up to 12 months.
• Google Analytics data (only if you accepted): 14 months.

Deleting your account

Go to Settings → Delete account. Your email, username, name, avatar, bio, website, country, Google link, sessions, notifications, votes and bookmarks are deleted or replaced with placeholders immediately. Your topics and replies remain, attributed to “deleted user”, because other people's answers depend on them; this is our legitimate interest in keeping threads coherent. If a post contains your personal data, or you have another legal ground, ask us to remove or redact specific posts and we will.

Your rights (GDPR, UK GDPR, KVKK)

You have the right to:

• access the data we hold about you and receive a copy (most of it is visible in Settings and on your profile);
• correct it (edit your profile and posts yourself, or ask us);
• erase it (delete your account; ask us about specific posts);
• restrict or object to processing based on legitimate interest;
• port your data in a machine-readable format — email us and we will send a JSON export;
• withdraw consent where processing is based on consent (currently only Google Analytics — use “Cookie settings” in the footer), and
• complain to your data-protection authority, for example the KVKK Board in Türkiye, the ICO in the UK, or your national authority in the EU.

Write to hello@turkeytravelforum.com from the email address on your account. We respond within 30 days. We may ask you to confirm your identity via a sign-in link.

Security

Connections are encrypted (HTTPS). Passwords are stored only as salted scrypt hashes, sign-in attempts are rate-limited, and changing your password signs out your other devices. Access to the database is limited to the operator and is logged. Uploaded images are re-encoded on our server, which strips metadata such as GPS location before they are published. No system is perfectly secure; if we learn of a breach affecting you we will tell you and, where required, the authorities.

Children

The forum is for adults planning travel and is not directed at children. You must be at least 16 to create an account. If we learn we hold data about a younger child we will delete it.

Changes

If we add a processor or change how data is handled, we will update this page and the date at the top, and announce material changes on the forum before they take effect.