Privacy Policy
Last updated: October 16, 2026
This policy explains how personal data is processed on omfkara.com (Turkish KVKK Law No. 6698 and GDPR principles).
1. Controller
OmfKara (omfkara.com) — Türkiye
Contact for any question or request: info@omfkara.com
2. What data do I collect?
| Data | When | Retention |
|---|---|---|
| Name, email, phone (optional), message, project type | When you send the contact form | Up to 2 years after the request is closed; IP address wiped after 90 days |
| Name, email, phone (optional), password (only as an irreversible hash), bio/website | When you sign up | While your account exists; deleted immediately when you delete it |
| Your blog posts and uploaded images/videos | When you submit a post | Until you delete them or close your account |
| Session record (hash of session key, IP address, browser info) | When you log in | Session length (members 30 days, admin 7 days) |
| Security logs (logins, failed attempts, IP address) | On login attempts | 180 days |
| Game score (if you are a member, your best score in the play room; the board shows only your first name and the initial of your last name) | When you play and save a score | As long as you are a member; deleted if you delete your account |
| 101 Okey rooms: your member name (first name and the initial of your last name) or the nickname you type, your chat messages in the room and the game state; visible to the other players | When you play 101 Okey | Deleted within 3 hours at most once a room is idle |
| Visit log: IP address, country, device type, browser and operating system, browser language, the site you came from, the page you viewed and the time | When you browse (no cookies are used) | IP address 30 days, then deleted. Statistics without IP 400 days |
3. Why do I process it?
- To answer contact requests and prepare quotes,
- To run the membership and blog service and review posts,
- To protect the site and accounts against abuse,
- To meet legal obligations,
- To protect the site against abuse such as attacks and spam (IP log) and to understand how many people visit from which country, device and source (statistics),
- Only if you consent: optional analytics.
Legal bases: performance of a contract (membership, quotes), legal obligation, legitimate interest (security and protection of the service) and your consent (analytics cookies).
4. Who do I share it with?
The site is delivered through the Cloudflare network, which processes the IP address of each request for security and performance, and whose servers may be located abroad. For disaster recovery, an encrypted-in-transit backup copy of the database (including member data) and uploaded files is kept in a private GitHub repository (USA) that only I can access.
I do not sell your data or share it for advertising. Data is kept at the hosting provider of this site. System e-mails such as password resets are delivered through the Resend e-mail service; to send them, your name and e-mail address are passed to that provider, whose servers may be located abroad (e.g. Japan, the EU or the US). This transfer happens only to deliver the e-mail. If a post embeds a YouTube video, YouTube's (Google) privacy rules apply when you play it; videos are embedded via youtube-nocookie.com. Data may be disclosed to public authorities when legally required.
5. Your rights
You can ask whether your data is processed, request information, correction, deletion, object to processing and claim compensation for damages.
- On the My account page you can download your data as JSON and permanently delete your account.
- For other requests write to info@omfkara.com; I reply within 30 days.
- You may also complain to the Turkish Personal Data Protection Authority (KVKK) or your local data protection authority.
6. Security
Passwords are hashed (scrypt), connections use HTTPS, the admin account can be protected with two-factor authentication, and forms and uploads are checked for malicious content. No transmission over the internet can be guaranteed to be 100% secure.
7. Children
The site is not directed at children under 13 and I knowingly collect no data from them.
8. Changes
I may update this policy from time to time. The current version is always on this page.
See the Cookie Policy for details about cookies.