Privacy Notice

Last updated: 16 October 2026

This notice explains how personal data is processed on kopmaz.fyi (the "Site"). It is written to serve both as the information notice required by Turkish Law No. 6698 on the Protection of Personal Data (KVKK, art. 10) and as the transparency notice required by the GDPR (arts. 13-14). The Site shows a Kick stream schedule, YouTube videos, optional Web Push notifications, first-come-first-served game-key giveaways and an embedded appointment booking page.

1. Data controller

The data controller is Fırat Kopmaz (individual). Contact for all privacy requests: firat@nerdnest.ch. Requests are answered within 30 days.

2. Short summary

• The Site uses no analytics, no advertising and no tracking cookies.
• You can browse the schedule and videos without signing in and without giving us any data.
• Data is only stored if you turn on push notifications or take part in a giveaway.
• We only use the cookies that are strictly necessary, so no consent banner is shown. This notice informs you about them.

3. What we process, why, and on what legal basis

3.1 Visiting the Site (hosting and security)

The Site runs on Cloudflare (Workers, D1 database, Turnstile). Cloudflare's edge network processes your IP address and request metadata (for example browser type, requested page, time) in order to deliver the Site and protect it against attacks. We do not build visitor profiles from this data.

Admin and audit logs record technical refusals (for example rejected requests) and administrative actions. They contain no visitor content and are kept for 1 year.

Purpose: delivery, security, abuse prevention. Legal basis: KVKK art. 5/2(f) and GDPR art. 6(1)(f), legitimate interest.

3.2 Schedule and calendar feeds

The stream schedule and the calendar feeds (.ics / webcal) store no personal data about you.

3.3 Web Push notifications ("notify me")

If you click "notify me" and then allow notifications in your browser, we store:

• the push endpoint URL, issued by your browser vendor's push service (Google FCM, Mozilla, Microsoft or Apple);
• the encryption keys belonging to that endpoint;
• your chosen language and the topics you selected (live, reminder, changes).

Purpose: sending you the notifications you asked for. Legal basis: your explicit consent (KVKK art. 5/1, GDPR art. 6(1)(a)), given by clicking the browser permission prompt. You can withdraw consent at any time.

Retention: until you unsubscribe on the Site, revoke the browser permission, or the push service reports the endpoint as invalid, in which case it is deleted automatically. The contents of notifications pass through your browser vendor's push service.

3.4 Google sign-in and YouTube subscription check (giveaways only)

Signing in is needed only for giveaways, which are first-come-first-served; the rules are in the Giveaway and Terms of Use. We request these OAuth scopes: openid, email, profile and https://www.googleapis.com/auth/youtube.readonly.

We receive from Google: your Google account ID ("sub"), email address, display name, profile picture URL, and the answer of the YouTube API subscriptions.list call stating whether you are subscribed to the channel @kopmazfirat (UCgHBc0DTJnwwg9jBJtNSK5Q).

We store:

• your Google account ID, display name and profile picture URL;
• a salted hash of your email address (not the address itself);
• the subscribed yes/no flag and the time of the check;
• a short-lived Google access token (valid at most 1 hour), kept encrypted with AES-256-GCM in your session record, solely to re-check the subscription when you claim a key. It is revoked and deleted at logout or expiry.

We never request or store a refresh token. We never read your subscription list, watch history or any other YouTube data beyond the yes/no answer for this single channel. We never post anything on your behalf, never share this data with third parties and never use it for advertising or for training AI models.

The session record is kept for 30 days. Purpose: verifying eligibility and preventing duplicate or abusive claims. Legal basis: performance of the participation contract (KVKK art. 5/2(c), GDPR art. 6(1)(b)) and legitimate interest in abuse prevention (KVKK art. 5/2(f), GDPR art. 6(1)(f)).

3.5 Giveaway claims

This is not a lottery or a prize draw; there is no element of chance, keys are handed out to the first claimants in order. When you claim a key we store your Google account ID, display name, claim time and which key was given (keys are stored encrypted). Records are kept for 1 year after the giveaway ends, for abuse handling and proof of delivery, and are then deleted.

Claim-attempt records contain your IP address only as a salted SHA-256 hash, for abuse prevention, and are kept for 90 days. The Turnstile bot check runs on these pages.

The site owner's private management system ("HQ") receives a notification with your display name and the time of each claim.

Purpose: running the giveaway, delivery, abuse prevention. Legal basis: KVKK art. 5/2(c) and GDPR art. 6(1)(b) (participation), and KVKK art. 5/2(f) and GDPR art. 6(1)(f) (abuse prevention).

3.6 Embedded content

• YouTube videos use youtube-nocookie.com embeds. Google sets cookies only once you press play.
• Appointment booking (page /randevu) is a Google Calendar appointment booking iframe. Whatever you enter there goes directly to Google and is governed by Google's privacy policy. The Site receives nothing.

4. Cookies

We use only strictly necessary cookies:

• __Host-s: your session after Google sign-in. HttpOnly, Secure, SameSite=Lax; valid for 30 days or until you log out.
• lang: your language choice; valid for 1 year.
• Cloudflare Turnstile may set its own strictly necessary cookie for bot protection.

There are no analytics, advertising or tracking cookies. Because only strictly necessary cookies are used, no consent is required and no cookie banner is shown.

5. Recipients and processors

• Cloudflare acts as processor for hosting, database and bot protection.
• Google (sign-in, YouTube API, Calendar booking, FCM) and the other browser push services (Mozilla, Microsoft, Apple) act as independent providers for the features you choose to use.
• HQ, the owner's private management system, receives the claim notifications described above.

We do not sell personal data and do not share it with anyone else, except where a legal obligation requires it.

6. International transfers

Cloudflare and Google process data outside Türkiye and the EEA, including in the USA. Transfers rely on the safeguards of KVKK art. 9 and GDPR Chapter V, such as standard contractual clauses and adequacy frameworks.

7. Retention

• Push subscriptions: until unsubscribed, revoked or reported invalid.
• Session records and cookie __Host-s: 30 days or until logout; access token at most 1 hour.
• Giveaway claim records: 1 year after the giveaway ends.
• Claim-attempt records with hashed IP: 90 days.
• Admin and audit logs: 1 year.
• Language cookie lang: 1 year.

You can delete your account data at any time with the "Delete my account" button on the giveaway pages, or by email. Deleting the account does not undo a key that has already been delivered.

8. Your rights

Under KVKK art. 11 you may: learn whether your data is processed; request information about it; learn the purpose of processing and whether it is used accordingly; learn the third parties to whom it is transferred; request correction of incomplete or wrong data; request deletion or destruction; request that these actions be notified to third parties; object to an outcome against you produced by exclusively automated analysis; and claim compensation for damage caused by unlawful processing.

Under the GDPR (arts. 15-22) you have the rights of access, rectification, erasure, restriction of processing, data portability and objection, and you may withdraw consent at any time without affecting earlier processing.

Send your application by email to firat@nerdnest.ch, in line with the KVKK "Communiqué on the Procedures and Principles of Application to the Data Controller". We answer within 30 days. You may also complain to the Turkish Personal Data Protection Board (kvkk.gov.tr) or to the data protection authority of your country of residence.

9. Google and YouTube

The Site uses YouTube API Services. By signing in you are bound by the YouTube Terms of Service, and Google's data handling is described in the Google Privacy Policy. You can revoke the Site's access to your Google account at any time at myaccount.google.com/permissions or security.google.com/settings/security/permissions.

"kopmaz.fyi's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

In line with Limited Use, data from Google APIs is used only to verify giveaway eligibility, is not transferred to others, is not used for advertising, is not used to train AI models, and is not read by humans except for security, legal compliance or abuse investigation.

10. Children

Giveaways are for people aged 18 or over. The Site does not knowingly process data of children under 18 for giveaways. If you believe a minor has taken part, contact us and we will delete the data.

11. Changes

The "last updated" date is shown at the top. Material changes will be announced on the Site.

12. Contact

Fırat Kopmaz, firat@nerdnest.ch.