Privacy & Cookie Policy

Privacy & Cookie Policy

This policy explains what personal data Yudum collects when you use our website and IRC network, why we collect it, how long we keep it and what rights you have. It is written to satisfy both Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and, for visitors located in the European Economic Area and the United Kingdom, the General Data Protection Regulation (GDPR).

Who is responsible. Yudum is an independent, non-commercial chat community operated from Türkiye. Yudum is the data controller for the processing described here. You can reach us at any time through our contact page.

1. Where your data is processed

Our main web and IRC server is hosted with OVH in Lille, France, and our radio server with Hetzner in Helsinki, Finland. Both are inside the European Union, so the core service involves no transfer of your data outside the EEA. Two exceptions are described in section 5.

2. What we collect

Automatically, when you visit:

• IP address and the approximate region derived from it
• Browser type, operating system and device information
• Pages visited, time spent and interactions
• The referring site, where your browser sends one

Only if you provide it: your nickname, password (stored only as a bcrypt hash — we never see or store the password itself), e-mail address, and anything you choose to add to your profile such as a display name, short biography, location, avatar or links.

Your date of birth is asked when you create an account. It is used only to check the age limit and is never shown to anyone; your profile shows only your age, and only if you switch it on.

What you write: messages you post in public channels, in the social feed, and in comments are stored so the service can work. Private messages are stored only until delivered or, if the recipient is offline, until they are read.

3. Why we process it, and on what legal basis

• To provide the service you asked for — account creation, sign-in, chat delivery, profile display. Legal basis: performance of a contract (GDPR Art. 6(1)(b)); KVKK Art. 5(2)(c).
• To enforce the age limit — your date of birth is used only to check that you are 18 or over. Legal basis: performance of a contract — our terms require users to be 18 or over (GDPR Art. 6(1)(b)); KVKK Art. 5(2)(c).
• To keep the network safe — IP addresses are used for rate limiting, flood and spam protection, ban enforcement, and detection of open proxies and anonymising networks. Legal basis: our legitimate interest in protecting the community and the service (GDPR Art. 6(1)(f)); KVKK Art. 5(2)(f).
• To send you service e-mail — account activation and password reset only. We do not send marketing e-mail. Legal basis: performance of a contract.
• To show advertising and measure the site — only with your consent, given through the cookie banner. Legal basis: consent (GDPR Art. 6(1)(a)); KVKK Art. 5(1). You may withdraw it at any time.
• To meet legal obligations — where Turkish law requires us to retain or disclose specific records. Legal basis: legal obligation (GDPR Art. 6(1)(c)); KVKK Art. 5(2)(ç).

4. Cookies

Strictly necessary cookies keep you signed in and remember basic preferences such as your chosen theme. These are required for the site to work and are set without consent.

Advertising cookies may be set by Google AdSense to show and measure ads. These are set only after you accept them in the cookie banner. If you decline, only the strictly necessary cookies remain.

You can also block or delete cookies in your browser settings. Some features may then stop working correctly.

If you join the chat without an account, your answer to the age question is remembered in your browser's local storage for a limited time. The date itself is not stored.

5. Third parties

• Cloudflare — sits in front of the site as a reverse proxy and protects it against attacks. It processes your IP address and request metadata.
• Google AdSense — serves advertising, but only where you have accepted advertising cookies. Google acts as an independent controller for that processing and may transfer data to the United States under the EU–US Data Privacy Framework. Google's own privacy policy applies.
• proxycheck.io — receives the IP address of a connecting visitor so we can detect open proxies, VPNs and Tor exit nodes used for abuse. No other data is sent.

We do not sell your personal data, and we do not share it with anyone else except where the law obliges us to.

6. How long we keep it

• Accounts that are never verified are warned on day 4 and deleted on day 7.
• Verified accounts are kept for as long as they exist. Inactivity alone does not delete them.
• Your date of birth is kept for as long as your account exists and is deleted with it.
• If you delete your account, your personal data and profile are removed. Comments you left are not deleted but are anonymised — the author becomes “deleted user” and no longer links to a profile, so the conversation others took part in stays intact.
• Moderation and ban records are kept even after account deletion. Otherwise a banned person could simply re-register to escape a sanction. These records hold no profile content — only what is needed to enforce the decision.
• Security logs are kept for a short period and only for the purposes in section 3.

7. Security

Traffic is served over HTTPS, and the IRC network accepts TLS connections only. Passwords are stored as bcrypt hashes and are never recoverable, not even by us. Access to the servers is restricted to the administration.

8. Your rights

Under KVKK Art. 11 and GDPR Arts. 15–22 you may ask us to confirm whether we process data about you, obtain a copy of it, have it corrected or erased, restrict or object to processing, and receive it in a portable format. Where processing rests on consent, you may withdraw that consent at any time without affecting what was lawful beforehand.

Send any request through our contact page. We answer within 30 days.

If you believe we have handled your data unlawfully you may complain to the Turkish Personal Data Protection Authority (KVKK Kurumu). If you are in the EEA or the UK you may instead complain to your own national supervisory authority.

9. Age limit

The service is for people aged 18 and over. We ask for your date of birth when you create an account, and once when you join the chat without one. We do not knowingly process personal data of anyone under 18; if we learn that an account belongs to someone under 18, the account is suspended. If you believe a minor has given us personal data, contact us and we will remove it.

10. Changes

We may update this policy. The current version is always published on this page, and the date below tells you when it last changed.

Last updated: 11 September 2026.