Privacy Policy
Last updated: 2026-07-28
This site is a personal portfolio and publication hub operated by Baha Erdoğan. It collects as little as possible. This page describes exactly what is collected, why, on what legal basis under the GDPR and the Turkish KVKK, and how long it is kept. Questions go to [email protected].
Analytics
Google Analytics 4 measures aggregate traffic. It is off until you agree. The site loads with Google Consent Mode v2 set to denied for analytics, advertising and personalisation storage, so no analytics cookies are written and no measurement occurs unless you press “Accept All” or enable Analytics under “Settings”.
Cookies: _ga, _ga_ZGTWHSMVV7 — written only after consent.
Legal basis: your consent (GDPR Art. 6(1)(a)).
Retention: Google's GA4 default, currently 14 months.
Withdrawing consent: clear this site's data in your browser, or set your choice again from the cookie banner. Your decision is stored locally under cookie-consent and never leaves your device.
Contact form
The name, email address, subject and message you type are emailed to the site owner through Resend, the email provider. They are not written to any database.
Legal basis: steps taken at your request prior to contact (GDPR Art. 6(1)(b)) and legitimate interest in replying (Art. 6(1)(f)).
Retention: for as long as the resulting correspondence is kept.
Comments
If you post a comment, your name and the comment text are stored and shown publicly on the article page. Your email address is used only to notify the site owner so a reply is possible — it is not stored with the comment and is not published.
Legal basis: your consent, given by submitting the form (GDPR Art. 6(1)(a)).
Retention: until you ask for removal. Email [email protected] and the comment will be deleted.
Abuse prevention
To stop the comment and contact forms being flooded, submissions are rate-limited to three per hour. Your IP address is not stored. The counter is keyed on a truncated SHA-256 hash of it, which distinguishes callers without retaining an identifier, and the record expires automatically after one hour.
If bot protection (Cloudflare Turnstile) is enabled, Cloudflare receives your IP address to run that check, as its processor.
Legal basis: legitimate interest in keeping the site available and free of abuse (GDPR Art. 6(1)(f)).
Hosting and logs
The site is served as static files by GitHub Pages, behind Cloudflare. Both process connection data — including your IP address — to deliver pages and to protect against attacks. This happens for every website you visit and is outside the site owner's control.
Legal basis: legitimate interest in delivering and securing the service (GDPR Art. 6(1)(f)).
Processors and international transfers
Google (analytics), Cloudflare (delivery, storage, bot protection), Resend (email delivery) and GitHub (hosting) act as processors. Some are based outside the EEA and may process data there, under the European Commission's Standard Contractual Clauses or an applicable adequacy decision.
No data is sold, and none is shared for advertising.
Your rights
Under the GDPR and the KVKK you may request access to your data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time without affecting what was lawful beforehand.
Write to [email protected]. You also have the right to complain to your national data protection authority — in Turkey, the KVKK Authority (KVKK Kurumu).
Children
The site is not directed at children under 16 and does not knowingly collect their data.
Changes
If this policy changes, the date at the top of the page changes with it.