KVKK notice

Under Article 10 of the Personal Data Protection Law no. 6698 · Last updated: November 2, 2026

1. Data controller

The individual who operates DrawBird is the data controller. You can send your requests and questions on GitHub.

The easiest way is the Contact us form on the site. Choose "My personal data (KVKK)" as the topic.

2. What data we process

• Device identity: An irreversible hash (SHA-256) of the random code your browser makes. We don't ask for an email, phone, real name or password.
• User content: Your drawings, bird names, your artist name (if you write one), your flock names.
• Interactions: Your votes, reports, and the birds you add to your flocks.
• Security data: An irreversible hash of your IP address mixed with a secret key. The IP address itself is not written to the database.
• Server logs: Technical logs of our hosting provider (Cloudflare); they may include the request address, time, country and browser information.

The daily visit counter contains no personal data; it keeps only the total for the day. We don't use cookies. Only your device code and preferences are stored in your browser.

3. Purposes and legal grounds

• Providing the game, showing your birds in the sky, storing votes and flocks: establishment and performance of a contract (KVKK Art. 5/2-c; terms of use).
• Preventing spam, fake votes, inappropriate content and attacks, blocking those who break the rules, reviewing new and reported drawings: legitimate interest (KVKK Art. 5/2-f).
• Requests from authorized institutions and legal retention obligations: legal obligation (KVKK Art. 5/2-ç).

We do not carry out any processing based on explicit consent, marketing messages or profiling.

4. Transfers

• Cloudflare, Inc. (hosting and database): All data is kept on Cloudflare servers; the database is in the Eastern Europe region, and pages are served from servers around the world.
• Telegram (moderation): The picture, name and artist name of new birds, birds awaiting approval and reported birds are sent to the admin's Telegram account.

These providers' servers are abroad; the transfer is made under KVKK Art. 9. We do not sell or hand over your data to anyone else.

5. Retention periods

• Birds, votes, flocks and artist name: until you delete them.
• Submission limit records: at most 1 hour. New account counting: at most 2 days.
• Block records: until the block is lifted, to prevent abuse; network block 24 hours.
• Server logs: as long as Cloudflare's log retention (a few days).

What you write in the contact form, and any contact details you choose to leave, are kept until your request is handled, for at most one year.

6. Your rights (KVKK Art. 11)

You have the right to learn whether your personal data is processed, to request information if it has been processed, to learn its purpose and whether it is used accordingly, to know the persons it is transferred to, to request correction if it is incomplete or incorrect, to request its deletion under the conditions of KVKK Art. 7 and to request that these actions be notified to the persons it was transferred to, to object to a result against you arising from automated analysis, and to request compensation if you suffer damage due to unlawful processing.

Ways you can use right away: On the Profile page you can change your artist name, delete your birds one by one, or permanently delete everything tied to your account with Delete all my data.

7. Applications

For other requests, write through the contact route above; your request will be answered free of charge within 30 days at most. So that we can verify your account, it is enough to add the link of one of your birds from the Profile page. If you are not satisfied with the answer, you can file a complaint with the Personal Data Protection Board.

8. Children

DrawBird is open to users of every age and does not ask children for identity information. We recommend that users under 13 play together with a parent or teacher and do not write their real names as their artist name.