Privacy Policy
Last updated: October 13, 2026
This policy is a privacy notice (aydınlatma metni) prepared under Art. 10 of Law No. 6698 on the Protection of Personal Data ("KVKK"). It explains which data are processed by czay.dev and links.czay.dev, for which purposes and on which legal grounds, and sets out your rights. The site does not require membership and no payments are accepted through the site.
For detailed information on the use of cookies and tracking technologies, see the Cookie Policy.
The student panel (student.czay.dev) used by students taking lessons requires membership and processes different categories of data; it has a separate privacy notice, and this policy does not cover those data.
1. Data Controller
The data controller (veri sorumlusu) under the KVKK is Furkan Özay. Account-level legal identity details are set out in Terms of Use, clause 1.1.
You may send your requests under the KVKK to [email protected]; they will be answered free of charge within 30 days at the latest (KVKK Art. 13).
2. Contact Form Data
Data processed: the first and last name, email address and message content you submit through the contact form. The site does not require membership or opening an account.
Purpose: responding to your request and continuing the correspondence. No newsletter or marketing list is kept through the site, and no bulk emails are sent.
Legal ground: legitimate interest (meşru menfaat) under KVKK Art. 5/2-(f) (responding to the incoming request).
Retention period: the correspondence is kept in the email inbox; it is deleted upon your request.
3. Feedback and Testimonial Data
Data processed: the name, institution/program information, term, rating and comment text you submit when you fill in the feedback form.
Purpose: reviewing the comment and, if approved, publishing it on the site as a testimonial. The form entry is created as an issue in a private repository on GitHub for review.
Legal ground: explicit consent (açık rıza) under KVKK Art. 5/2-(a) — when you submit the form, it is expressly stated that your comment may be published.
Retention period: published comments are kept until you request otherwise; unpublished submissions are deleted after review. Student comments published on the site show only the first name; last names and photos are not kept.
4. Analytics and Cookies
Data processed: page views, referring address, browser and device information, approximate location (at country/city level) and cookie identifiers.
Purpose: traffic analysis and performance measurement. No advertisements are shown on this site. Non-essential cookies run only if you have given your consent; you can switch them on and off by category via the consent banner.
Legal ground: for strictly necessary cookies, legitimate interest under KVKK Art. 5/2-(f); for analytics and performance cookies, explicit consent under KVKK Art. 5/1.
For details and the list of cookies, see the Cookie Policy.
5. Payment and Invoicing Data
No payments are accepted through the site. The site has no shopping cart, online ordering or card payment flow; no card details are collected or stored.
The fee for institutional training and software services is set by the contract with the institution concerned and collected offline by bank transfer/EFT. Invoicing is carried out outside the site and in accordance with tax legislation; the name, surname and invoice details processed in this context are kept in accounting records, not in the site infrastructure.
Legal ground: being expressly provided for by law under KVKK Art. 5/2-(a) (Tax Procedure Law (Vergi Usul Kanunu)).
Retention period: 10 years under the Tax Procedure Law (VUK) (retention of books and documents).
6. Data Transfers (Third-Party Services)
Data are shared in the following categories, for the reasons stated:
- Cloudflare (USA): forwarding messages received through the contact form as emails. Legitimate interest.
- GitHub (USA): creating feedback form entries as issues in a private repository for review. Explicit consent.
- Google Analytics 4 (USA): traffic analysis (only with consent to analytics cookies).
- Cloudflare (USA): site caching and form security verification (Turnstile). When a form is submitted, the IP address and the challenge token are transmitted for verification. Legitimate interest — preventing unwanted/automated submissions.
- Hosting provider: server access logs and infrastructure operation.
The third parties' own privacy policies apply. This site is not responsible for their independent data processing outside the services they provide.
7. Transfers Abroad
The servers of the service providers listed above (GitHub, Google, Cloudflare) are located abroad (USA, EU). Invoice and accounting records are not kept in the site infrastructure and are therefore not transferred abroad.
Under KVKK Art. 9, transfers abroad are carried out on the basis of explicit consent or to countries where adequate protection exists. The service providers referred to are structured to comply with the GDPR.
8. Your Rights (KVKK Art. 11)
Under the KVKK, you have the following rights:
- To learn whether your personal data are processed
- If they have been processed, to request information about it
- To learn the purpose of the processing and whether the data are used in accordance with that purpose
- To know the third parties to whom the data are transferred domestically or abroad
- To request rectification if the data are processed incompletely or inaccurately
- To request erasure or destruction (within the conditions of KVKK Art. 7)
- To request that rectification, erasure and destruction be notified to the third parties to whom the data have been transferred
- To object to a result to your detriment arising from the analysis of the data exclusively by automated systems
- To claim compensation for damages if you suffer damage due to unlawful processing
You may submit your requests to [email protected]. Under KVKK Art. 13, your request will be answered free of charge within 30 days at the latest.
9. Children's Privacy
The Platform is not directed at children under the age of 13, and no personal data are knowingly collected from this age group. Users aged 13-18 may use the service with the consent of their legal representatives.
10. Changes to the Policy
When this policy is updated, the "last updated" date is renewed. Material changes are announced at least 14 days in advance by email and/or in-platform notification. The current version of the policy is always published on this page.