Privacy Policy

This text explains how your personal data is processed when you use Caka (caka.app). Caka is not a company; it is an open-source personal project. We operate the site as caka.app, and we are the ones who decide for what purpose and by what means the data is processed. The capacity of data controller within the meaning of Turkish personal data protection law no. 6698 (KVKK) arises from this, and we are the ones the commitments in this text are addressed to.

Let us write down what is missing, too. Article 10 of the KVKK and article 5 of the Communiqué on Informing require the identity of the data controller to be disclosed. The Authority's Guide on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform (no. 60, March 2025) §3.1.1 describes this for natural persons as first name and surname. You will not find a name below: the person who runs Caka chose not to publish their name, because what is at hand is a personal identity rather than a business. The meaning of that is plain — this section does not today fully meet the identity information article 10 asks for and rather than hiding that, we are saying it. As there is no legal entity, commercial activity or registry record either, there is no trade name, tax number or MERSİS number; rather than inventing details for a company that does not exist, we write the situation as it is. When the product is commercialised and a legal entity is established, this section will be updated with that information. Despite this gap, responsibility is not left in the air: the box below is real and read, and your requests are answered within thirty days.

You can see which version of this text you are reading from the version and last-updated date at the top of the page. What happens when we make a change is explained in Changes.

This text covers the following surfaces:

• The caka.app marketing site — all pages that can be browsed without signing in, including the home page and these legal pages.
• Account and dashboard — sign-in, the profile editor, settings and file upload.
• Public Caka profiles — profile pages published publicly at caka.app/username; people without an account who visit these pages are covered as well.
• Support correspondence — the requests you send us by email.

Once you click a link on a profile and go to another site, that site's own privacy policy applies; this text of Caka's does not apply there.

The table below shows the data Caka actually holds. The names in brackets are the names of the tables in the database; we write them so that a field added later cannot quietly drop off the list.

A warning about the GitHub contribution graph: The key of this cache is the GitHub username added to be displayed on a profile, and that account may not belong to the profile owner. In other words, Caka may be processing the public contribution data of a person who has no Caka account at all. Those people can request deletion too; how to do so is written in Your rights as a data subject.

You write the profile content yourself, and once you publish it, it is public. Everything you put there — a phone number, an address, health or belief information — can be seen by anyone on the internet. Caka does not ask for and does not collect special categories of personal data (KVKK art. 6); if you write such information on your profile yourself, you have made it public of your own accord.

Every purpose of processing must rest on one of the legal bases in article 5 of the KVKK. Below we have written out, for each purpose, the sub-paragraph we rely on.

We do not ask you for a blanket, general “I consent to the processing of my personal data” approval. Such an approval would not count as valid consent; all of the processing above rests on the legal bases listed.

All of the data is collected electronically, by partly automated means. We do not collect data on paper. The collection channels:

• Your direct input — the profile editor, settings, file upload and support email.
• Data returned by the identity provider — the name, email and account identifier returned to us when you sign in with Google.
• Automatic server records — session and runtime records created while requests are handled.
• Strictly necessary cookies — the small number of cookies written to your browser to carry your session, secure the sign-in flow and remember the interface language you chose.
• Server-side external calls — fetching the GitHub contribution graph to be shown on a profile from GitHub's public interface.

We do not sell your data and we do not share it with anyone for advertising purposes. The parties the data reaches, and what reaches each of them, are as follows. The first five rows are suppliers we use to run the service; the last row is not a supplier but the owner of the page you are visiting.

What the profile owner cannot see. When you visit a Caka profile the owner sees it in their counters, but they do not see you. Because nothing is written to your device for the measurement and your raw IP address is not stored, not even we can tell whether two visits belong to the same person; that is why there is no “unique visitors” number in the dashboard. This measurement runs only for public profile pages, and the page owner's own visits are not counted as long as they are signed in.

Transfer abroad. The servers of the recipients above are outside Türkiye. Because the application, database, file storage and logs all run on Cloudflare, this transfer is a technical necessity for the service to work at all and happens on every request. We write the situation as it is: these transfers are not today tied to any of the safeguards required by article 9 of the KVKK.

The reasons, one by one. The first step of article 9 is an adequacy decision; the Board has to date published an adequacy decision for no country. The second step is appropriate safeguards, and the most accessible of those is the standard contract published by the Board; but the Turkish text of that contract must be signed by both parties. In Cloudflare's data processing addendum in force (v6.4, effective 3 April 2026) there is not a single reference to Türkiye, to a Turkish text or to the KVKK; the mechanisms offered are limited to the EU standard contractual clauses, the United Kingdom and Swiss addenda, the Data Privacy Framework and Global CBPR. In other words, the counterparty does not sign this text. The undertaking route depends on Board authorisation and cannot be completed unilaterally; binding corporate rules are for a group of companies, and there is no group here. Nor is there an exemption arising from the small size of the transfer.

“Couldn't you just get explicit consent?” No. The exceptions in article 9/6 — including explicit consent — are open only to incidental transfers. Article 16/1 of the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad defines the term: “Transfers that are not regular, that occur once or a few times, that are not continuous and that do not fall within the ordinary course of activity are incidental.” A hosting transfer is the exact opposite: it is continuous and it is the ordinary course of activity itself. Because the incidental condition covers the whole of article 9/6, showing you a consent checkbox would not close this gap, it would only make it look closed. The Authority also states that these exceptions must be interpreted narrowly.

One further detail: signing in with Google runs under Google's consumer Terms of Service, not under a corporate data processing agreement; in that relationship Google is most likely a separate data controller in its own right rather than our data processor.

That is why no mechanism is named in this section. The gap is real, and you knowing about it is better than you assuming there is no transfer at all. Work to tie it to an appropriate safeguard continues; when a route opens, this section is updated and the document's version number increases. Your right to complain to the Personal Data Protection Authority is unaffected by this text.

Link preview images on profiles. On a profile, the preview images of the links the profile owner added are served through our own server. Caka's server fetches the image from the remote site, not your browser. As a result neither your IP address nor your User Agent reaches that site, and that site cannot write a cookie to your browser: the response is built from scratch on our side and the headers the remote site sends are not passed on to you. The request that goes to the remote site contains only the address of the image the profile owner chose; it carries nothing identifying you. For completeness: the first time an image is not yet cached on our server, the timing of that request shows the remote site that the profile was viewed around then — but not by whom.

Embedded players. YouTube and Spotify cards load nothing when the page opens; the cover image comes from our own server as described above. The moment you press play the player is loaded and your browser connects directly to YouTube or Spotify: your IP address and User Agent reach them, they can write their own cookies to your device and they can associate that session with your own account there. This transfer happens directly rather than through us, and each of them is its own data controller; for what becomes of the transferred data, their own policies apply. As long as you don't press the button, none of these requests are made — we built it this way deliberately, and the button says so above it. Details: Cookie Policy.

Apart from these, transfers are made to competent public institutions and organisations only where a legal obligation arises (KVKK art. 8/2-a).

We delete data within the period permitted by the relevant legislation once the purpose of processing has ceased. The periods we know with technical certainty today are:

• Old username: 30 days. When you change your address, the old address redirects to the new one for 30 days and is not given to anyone else during that period; when the period ends the record becomes invalid and the name is released. The same 30-day lock applies when you delete your account, but without the redirect: since there is no page left to redirect to, the address returns not found (404) for that period. The lock row holds only the username and an expiry date; it carries no other data from the deleted account.
• GitHub contribution graph cache: a successful record is considered fresh for 6 hours and then refetched. If the user is not found on GitHub, that negative result is kept for 24 hours. When the graph is removed from a profile the data is not fetched again.
• Session: 7 days. The session cookie and the session record live for 7 days; they end earlier when you sign out. The security cookies in the sign-in flow live for 5 and 15 minutes. The language cookie lives for 1 year and you can delete it at any time from your browser. Details in the Cookie Policy.
• Page statistics counters: kept indefinitely. These rows are counters carrying not a person but a day, a two-letter country code and a block identifier; because they contain no timestamp, identity or IP derivative, they cannot be traced back to a single person. As they are genuinely anonymous they are not subject to a destruction period. Only the last 30 days are shown in the dashboard, but what does that is a display filter, not a deletion: older counter rows remain in the database. If the profile is deleted, these rows are deleted with it.

For the remaining data categories the periods we apply are:

Why three months is three months. Article 5/1 of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data ties the duty to prepare a written retention and destruction policy to the obligation to register with VERBİS. Caka is exempt from that registration obligation (Board decision no. 2025/1572), so the written policy duty does not arise either. But this is not a relaxation, quite the opposite: while those who write a policy benefit from a periodic destruction cycle of no more than six months, article 11/3 sets a stricter rule for those who do not, and orders deletion within three months of the date the deletion obligation arises. The three-month period above comes from that provision; it is not a number we chose.

How long it takes us to conclude your request. Under article 12/1-(a) of the same Regulation we conclude a deletion request within 30 days at the latest. Under article 7/3, records of the deletion operation itself — not the deleted data, but the record of the operation — are kept for at least three years.

Today there is no legislation requiring retention longer than these periods: Caka has no revenue, issues no invoices and keeps no commercial books, so the retention periods of the Tax Procedure Law and the Turkish Commercial Code do not come into play. The day we offer a paid plan, this section changes.

Under article 11 of the KVKK you may apply to the data controller and request the following:

• To learn whether your personal data is processed.
• To request information about it if it has been processed.
• To learn the purpose of processing and whether the data is used in accordance with that purpose.
• To know the third parties, in Türkiye or abroad, to whom the data is transferred.
• To request correction of the data if it has been processed incompletely or inaccurately.
• To request deletion or destruction of the data within the framework of the conditions in article 7 of the KVKK.
• To request that correction, deletion and destruction operations be notified to the third parties the data was transferred to.
• To object to a result arising against you from the data being analysed exclusively by automated systems.
• To claim compensation for damage if you suffer damage due to unlawful processing.

Applying. You can send your requests by writing to hello@caka.app. We conclude your application within 30 days at the latest. To prevent access to someone else's data we may need to verify your identity; writing from the email address registered to your account is usually enough for that. You may also send your request by the other means listed in the Communiqué on the Procedures and Principles of Application to the Data Controller.

Account deletion is self-service. You don't need to write an application to exercise your right to erasure (art. 7 / art. 11-e): under Settings → Account, type your address, confirm, and your account and content are deleted right then. It cannot be undone; no copy stays with us that could bring it back. What is deleted: your profile and layout, the images and documents you uploaded, your page's view and click counters, your session records and your identity provider connection. Your address stays locked for 30 days (see §7). You can also request deletion at the address above instead.

Export is not self-service today. There is not yet a button in the dashboard to download your data with one click. We write this plainly because we don't want to describe a feature that doesn't exist as if it did. If you want a copy, writing to the address above is enough.

People without a Caka account can apply too. If, for example, you are the owner of a GitHub account whose username appears in the contribution graph cache and you want that data deleted, you can write to the same address even without a Caka account.

Caka uses only strictly necessary cookies: the cookie that carries your session, the short-lived cookies that keep the sign-in flow secure, and the cookie that remembers the interface language you chose. There are no advertising cookies, no analytics cookies and no cross-site tracking; visit statistics are measured without cookies and without writing anything to your device, on all pages including public profile pages. That is why we don't have to ask for your approval.

Besides cookies, two tab-specific sessionStorage entries can be created: one remembers your scroll position as you navigate, the other makes an open tab refresh once when a new version of the site is released. Both are deleted when you close the tab and carry no personal data. You can find the name, purpose, lifetime and owner of every entry written to your device, in table form, on the Cookie Policy page.

As the product changes, so does this text: we update it when a new supplier is added, when we start processing a new data category, or when the legal basis of a purpose changes.

With every update the version number at the top of the page increases and the last-updated date is renewed. The versions of these three legal documents are independent of each other: only the date of the document that changed moves, the others stay as they were. When there is a substantial change we also inform users who have an account.

Alongside this text we recommend reading the Terms of Use and the Cookie Policy as well.