Privacy policy (Datenschutzerklärung)
Last updated: [Date of last update]
1. Who is responsible
Abdullah ACI, [Street and number], Eskişehir, Türkiye. Email: abdullahaci26@gmail.com. See also the imprint.
2. What we process, and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: name, email address, password (stored only as a salted scrypt hash), badge, optional profile text, sign-up date | Run your account and the platform | Art. 6(1)(b), performance of the user agreement |
Session cookie patina_session and a hashed session record (up to 5 per account) | Keep you signed in | Art. 6(1)(b) |
| Listings and photographs you upload; your name, badge and member-since date shown beside them. Photographs are re-encoded when uploaded, which removes location, time and camera data embedded in the file (EXIF), and are shrunk to at most 2400 pixels on the long side | Publish your listing. These are visible to every visitor. | Art. 6(1)(b) |
| Messages between you and another member, and your acknowledgment of the Archival Notice with its date. If a member deletes their account, the messages they wrote are erased, but the other member keeps their own messages and the conversation (showing “Deleted member” and, for a removed listing, its title and catalog number) so that they can still document an agreement or a dispute | Let members arrange deals; keep each member’s own record; show that the notice was accepted | Art. 6(1)(b) and 6(1)(f) |
| Library correction proposals you file and the curators’ decision | Improve the library | Art. 6(1)(b) |
| Password-reset requests (the email address typed into the form, which may not belong to an account) and one-time reset tokens (stored hashed) | Let a curator help you regain access | Art. 6(1)(b) |
| Counters of attempts, keyed by IP address, email address or member number, kept up to 24 hours | Block password guessing and abuse | Art. 6(1)(f), our interest in security |
| Server, platform and database provider logs (IP address, time, page requested) | Operate and secure the service | Art. 6(1)(f); retention is set by the hosting setup (see section 5) |
We do not use analytics, advertising, tracking pixels or embedded third-party content. Fonts are served from our own server. We do not sell data and do not make automated decisions about you.
3. Cookies
We set one cookie, the session cookie, which is strictly necessary to keep you signed in (HttpOnly, valid up to 30 days or until you sign out). In our assessment this needs no consent banner. We set no other cookies.
4. Who can see your data
Listings are public. Messages are visible to the two members in the thread. Technically, administrators with access to the server and its database can also read them; we only do so to handle abuse reports or legal obligations. Curators can see password-reset requests and Library proposals. Our hosting provider processes the data on our behalf: Vercel Inc. (web uygulaması) ve Supabase Inc. (veritabanı ve fotoğraf depolama, AB bölgesi İrlanda). Where required we have a data processing agreement with them.
When you arrange a deal, you choose what to share with the other member (address, payment details). Do that carefully; we are not part of that exchange.
5. How long we keep data
Account data, listings, photographs and messages stay until you delete your account. Sessions end when they expire or you sign out. Attempt counters are removed after at most 24 hours. Photographs you uploaded but never attached to a listing are removed after at most 24 hours. Reset requests are removed 30 days after they were handled, or after 30 days if nobody handled them; used or expired reset tokens after 7 days. Server and proxy logs are kept for [How long server and proxy logs are kept, e.g. "7 days"]. Backups are kept for [How long backups are kept, e.g. "30 days"], so a deleted account can remain in a backup until that period has passed; backups are not used to restore a deleted account’s data into the live site except after a technical failure, and then the deletion is repeated.
6. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection under the GDPR. To use any of them, write to abdullahaci26@gmail.com. You can delete your account yourself at any time on your profile page ("Delete your account"): it erases your profile, listings, photographs, the messages you wrote and your Library proposals at once. Messages written by the other member in your conversations are their data too, so they stay with them; your name is replaced by “Deleted member”. If you cannot sign in, write to us and we delete it for you. You may also complain to a supervisory authority; ours is [Competent data protection supervisory authority].
7. Security
We use encrypted connections (HTTPS), hash passwords with a salted, deliberately slow function, restrict who can administer the site, limit repeated login attempts, and keep uploads in a separate storage area. No system is perfectly secure; use a password you use nowhere else.
8. Changes
We update this policy when the site changes. The date at the top shows the last revision.