Privacy / Datenschutz

Who is responsible

FORTUNE ENTERTAINMENT MEDYA ILETISIM SANAYI TICARET ANONIM SIRKETI is the proposed controller for this notice, subject to confirmation of the operating arrangements. Its address and privacy contact are still missing; see the Imprint.

This draft covers the current early-access build. Applicable GDPR and Turkish KVKK requirements, including representative and registration obligations, require confirmation against the company’s establishment and actual operations.

Information you provide

Account: email address, account identifier, sign-in verification and session information. You can sign in with a password or with one-time email codes. Passwords are stored by our authentication provider only as a one-way hash; we never see or store them in readable form.

Application: first name, last name, username, last-name visibility choice, whether you join as an artist or a fan (shown on your profile to members), music-industry interests, optional learning goals, membership status, and the time of your adult confirmation. Your date of birth is checked by the server for 18+ eligibility; the application does not save it.

Optional audio: a recording of up to 60 seconds, converted in your browser to a WAV file, with its duration and storage reference. Uploading audio is not required to join. Do not include sensitive personal information or other people’s recordings without permission.

Personal space: your chosen theme, background, layout and biography. The featured artist profiles and community posts are illustrative.

Invitations and friends

When a member creates an invitation, they provide the recipient’s email. We store that email, the inviter’s account identifier, a hash of the invitation token, expiry, creation time and acceptance details. The source of an invited person’s email is the inviting member, even if the recipient never opens the link.

Members can create 5 invitations in any rolling 24-hour period; admins can create 100. Links expire after seven days and are bound to the invited email. The site currently creates links for members to share; it does not automatically send invitation emails.

Accepting creates a mutual friendship with the inviter. Each friend can see the other’s first name and username, plus last name only when its owner chooses to show it, and can remove the connection. Hidden last names remain in the private application and are not included in friend-list responses. Friendship does not expose private applications, email addresses or recordings.

Member posts, pictures, comments and hunts

Publishing shares your text, processed picture, first name, username and any opted-in surname with admitted members. Shared links do not bypass membership checks. Pictures are decoded and converted to WebP; image metadata is removed. Other members may still save or screenshot visible content.

Hunt creators provide clue text, answers and a final reveal. Answers are stored as salted hashes. Each player’s step is stored so only the current clue and, after completion, the final reveal are returned to that player.

Reports contain the reporter’s account identifier, content reference, reason and time and are available to admins. Publishing, comments and hunt attempts are rate-limited using per-account counters.

Removing a publication or comment hides it from members; it does not immediately erase the underlying record or picture. No scheduled retention cleanup exists yet. The operator must define and implement retention and erasure for these new data categories before launch.

Purposes and proposed legal bases

The draft GDPR basis for requested account, application, optional recording storage and membership features is Article 6(1)(b): providing the requested service or taking requested steps before it. Supplying optional audio does not authorise public use.

Security, quota enforcement and preventing invitation abuse are proposed legitimate interests under Article 6(1)(f). Storing a non-user’s email for an invitation needs a documented balancing assessment and an Article 14 information process before launch.

No advertising or newsletter consent is collected in the current build. If optional tracking or marketing is introduced, it needs a separate lawful basis and, where required, prior consent. The corresponding KVKK processing conditions must be assessed separately; a GDPR basis is not a substitute.

Who receives data

Authorised operators and the infrastructure providers needed to run the service may process data for their assigned tasks. See Data processing for provider status.

The current implementation keeps recordings in a private bucket and serves them through authenticated endpoints. Operators with privileged infrastructure access may access them; this is not end-to-end encryption.

Hosting and authentication providers may process IP addresses, request information, device/browser details and security logs. Their deployed configuration, access arrangements and retention periods must be confirmed.

Location and international access

The selected Supabase project is in the Paris region (eu-west-3). This alone does not mean every support, email, logging or administrative operation stays in the EU.

Netlify is the planned host. Provider subprocessors, access from outside the EEA, any access by the operator from Türkiye, and the applicable GDPR/KVKK transfer arrangements must be documented before launch. No transfer mechanism is represented here as already executed.

Retention and deletion

The current build has no scheduled purge for applications, accounts or invitation history. Seven-day invitation expiry disables the link; it does not delete the stored email.

You can delete your saved recording from the application form and remove a friendship in My Space. A replacement recording replaces the active file. Provider backups may retain older copies according to their configured lifecycle.

The operator must set and implement specific review/deletion periods for inactive applications, expired invitations, logs and backups. The final notice must state those periods or meaningful criteria. Account deletion and export currently require an operator process; no self-service account-deletion button is claimed.

Your choices and rights

Where GDPR applies, you may request access, correction, erasure, restriction and applicable portability; object to processing based on legitimate interests; and withdraw consent for processing that actually relies on consent. Withdrawal does not invalidate earlier lawful processing.

You may complain to a competent data-protection authority, including where you habitually live or work in the EU. A verified request channel and the relevant supervisory contact must be added before launch.

Where KVKK applies, rights include learning whether data is processed, seeking information and correction, requesting deletion when applicable, learning recipients, and challenging adverse results produced solely through automated analysis. The required application and complaint procedure must be completed for the operator.

The current code applies age, quota and token checks. It does not implement advertising profiles, automated audio scoring or AI admissions decisions.

Changes

Material feature changes, including anonymous public visibility, paid courses, ads, analytics or newsletters, require an updated notice before those uses begin.