Privacy Policy

Updated: 4 November 2026

İlkay Beydah Sağlam is the controller of this personal website. Contact work@beydahsaglam.com for privacy and personal-data requests. This policy covers reading the site, small applications, the contact form and administrator access.

Reading the website

Vercel serves pages and files. Infrastructure providers may process IP addresses, request URLs and technical headers to deliver and secure the service. Their operational logs are separate from the custom counters below and follow the relevant provider terms. This policy does not claim that all network traffic is anonymous.

Cookie-free aggregate counters

Custom measurement stores a date, a public page path, language, event category and total count. Categories cover page views, material activity and predefined error signals. This table does not store visitor or session identifiers, advertising profiles, raw IP addresses, browser identifiers, referrers, URL queries, form or chat content, or exception messages. Counts do not represent unique people.

Optional browser counters are not sent when Do Not Track (DNT) or Global Privacy Control (GPC) is enabled. The preference below also lets you disable them in this browser. Only an on/off setting is stored locally. Reports are restricted to the administrator. Daily cleanup removes view aggregates after 90 days and error aggregates after 30 days.

Security and error signals

Rate-limited endpoints use a keyed hash derived from connection information to discourage abuse. This short-lived security counter is not used to analyse visitors and contains no raw IP address. Expired counters are cleaned regularly; daily cleanup gives the longest window an approximate 72-hour upper bound. A hash is not assumed to be anonymous merely because it is hashed.

Custom error reporting records only predefined categories and daily totals. It does not send message contents, free-form error descriptions or stack traces to the custom table. Vercel operational logging is a separate infrastructure service.

Contact form and email

The form collects your name, email address and message. Supabase stores the message in an administrator-only inbox; Resend may deliver a notification to the owner's mailbox. Domain email is routed through Cloudflare Email Routing to Google Gmail. Sending a message does not subscribe you to marketing. Do not include identity documents, payment details, health information or unnecessary sensitive data.

Correspondence is considered for as long as needed to handle the request and any relevant legal obligations. An application record and an email copy can exist separately; removal requests are considered across those sources. The 30/90-day automatic counter retention does not apply to correspondence.

Information kept in your browser

Theme and measurement preferences are stored in this browser. Checklist selections and calculator inputs stay in the open page's memory; their values are not sent to measurement. A local music file selected in the application is not uploaded. A question moved from the homepage to Agent is read from one-time browser session storage and then removed. Avoid putting private information in URLs: query data can become part of infrastructure requests.

Administrator access uses Supabase Auth session cookies. Ordinary visitors do not need an account. Clearing browser storage removes local preferences and may end an administrator session.

External media and AI

Local audio does not autoplay. If you choose to open a YouTube or Spotify player, that provider may process connection information under its own rules. External players are not loaded before that choice. Source and social links are subject to the destination site's policy when opened.

Gemini is currently disabled; the site does not forward chat messages to a model provider. The provider and data flow must be disclosed before this feature is enabled.

Providers and processing outside Türkiye

Vercel supplies hosting and server functions; Supabase supplies the database and administrator authentication; Resend supplies contact notifications; Cloudflare supplies DNS and email routing; Google Gmail supplies the receiving mailbox. These services may use infrastructure outside Türkiye. International personal-data transfers are subject to the applicable conditions and safeguards under Article 9 of Turkish Law No. 6698. This notice does not replace any required agreement, notification or other legal arrangement, or certify that such arrangements have been completed.

Requests and changes

Send information, correction or deletion requests to work@beydahsaglam.com. The Personal Data Notice explains rights and applications. This policy is updated when the data flows change. The Vercel, Supabase, Resend and Cloudflare privacy notices describe their own processing.