TALEMARK KVKK DISCLOSURE NOTICE
Last updated: 27 July 2026 Effective date: 27 July 2026 Document version: 1.0
This Disclosure Notice is prepared to inform persons who use the Talemark mobile application and the connected services offered by Talemark about how their personal data is processed under Turkey's Personal Data Protection Law No. 6698 (the Personal Data Protection Law, "KVKK").
This text is not an explicit consent or a user agreement. For optional data processing activities that require explicit consent, a separate choice based on your free will is offered.
1. Data controller
Within the scope of Talemark services, your personal data is processed by Gökhan Kara in the capacity of data controller.
- Service and brand: Talemark
- Personal data and privacy requests: privacy@talemark.app
- General support: support@talemark.app
2. Categories of personal data processed
Depending on how you use Talemark and on your preferences, the following categories of personal data may be processed.
2.1 Identity, account and contact data
- Email address
- Username
- Account creation, account status and sign-in method information
- Email verification and password reset transaction records
- If you sign in with Google, the name, email address and profile picture shared by Google
Your Google password is not accessed and other content in your Google account is not requested.
2.2 Profile data
- Profile photo and profile banner
- Biography
- Social media or internet links
- Language preference
Your username, profile photo, profile banner, biography and social links may be public depending on the user's preference and the structure of the relevant feature.
2.3 User content and culture journal data
- Film and book journals
- Ratings and log dates
- Reviews and replies
- Lists and list items
- List comments
- Book quotes
- Likes and favorites
- Follow and follower relationships
- Reading progress
- Reading goals
- Agenda and personal notes
Review, public list, comment, quote, favorite and follow information may be shown to other users within the scope of community features. Reading progress, reading goals and agenda notes, on the other hand, can be viewed only by the account holder unless otherwise clearly stated in the product design.
2.4 Community safety and moderation data
- Blocking records
- Reports submitted or created about a user
- The reported content and the reason for the report
- Moderation reviews and decisions
- Records of warnings, content hiding, restriction, suspension and account closure
- Appeals and appeal outcomes
- Transaction dates and audit records
2.5 Device, notification and transaction security data
- Firebase Cloud Messaging notification token
- Operating system and application version
- The device's general technical characteristics
- Application language and notification preferences
- Information on the creation, renewal and invalidation of the notification token
- IP address
- Request time, response status and security logs
- Approximate region information based on the device country code
The approximate region information may be used only to filter the "where to watch" results by country and is not saved to the profile as precise location. Talemark does not access precise GPS location.
2.6 Analytics data
Only if you give explicit consent, the following data may be processed through Firebase Analytics:
- Usage events such as sign-up, sign-in, search and content creation
- Interactions with application screens and features
- Device and operating system information
- Approximate region
- Pseudonymous technical identifiers generated by Firebase and tied to the application installation
Your email address, username or Talemark account ID is not sent to Firebase Analytics and the setUserId feature is not used. Nevertheless, Firebase may process pseudonymous technical identifiers in order to distinguish the application installation.
You can change your analytics preference at any time from the application settings. Not giving analytics consent does not prevent you from benefiting from Talemark's core features.
2.7 Error and diagnostic data
In order to detect errors occurring in the release version of the application and to ensure service stability, the following technical data may be processed through Sentry:
- Stack trace and error message
- Application version
- Operating system and device model
- Error time
- The technical process flow in which the error occurred
Email address, username or Talemark user ID is not intentionally added to Sentry records. Appropriate filtering and masking measures are applied in order to reduce unexpected transfers of personal data.
2.8 Legal transaction and compliance data
- The version of the Terms of Use and Community Guidelines that was accepted
- Date and time of acceptance
- Personal data requests and the responses given to them
- Account and data deletion transaction records
- Records relating to requests of competent institutions or judicial authorities
The presentation of the Talemark Privacy Policy or this Disclosure Notice is not an explicit consent operation.
Talemark does not request special categories of personal data from the user. However, it is possible for the user to write, at their own choice, information such as health, belief, political opinion or similar into free-text fields such as biography, review, comment, quote or private note. It is recommended that special categories of data that are not necessary for the use of the service not be shared.
3. Purposes and legal grounds of processing personal data
Personal data may be processed for the following purposes, relying on the personal data processing conditions regulated under Article 5 of the KVKK:
| Purpose of processing | Examples of data processed | Legal ground |
|---|---|---|
| Creation, verification and management of the user account | Email, username, sign-in and account information | Necessity of processing, provided that it is directly related to the establishment or performance of a contract |
| Provision of the film and book journal, review, list, favorite and follow features | User content and social relationship data | Necessity for the establishment or performance of a contract |
| Display of the public profile and community content | Username, avatar, biography, reviews, lists and comments | Necessity for the establishment or performance of a contract; processing in accordance with the intention to make public with respect to data disclosed by the user |
| Sending email verification and password reset messages | Email address and transaction content | Necessity for the establishment or performance of a contract |
| Sending the community notifications activated by the user | Notification token and notification preferences | Explicit consent |
| Conducting optional usage analytics | Usage events and pseudonymous technical identifiers | Explicit consent |
| Detecting application errors and ensuring service stability | Error, device and diagnostic data | The processing being mandatory for the legitimate interest of the data controller, provided that it does not harm fundamental rights and freedoms |
| Rate limiting, account security and prevention of abuse | IP address and security logs | The processing being mandatory for the legitimate interest of the data controller |
| Reviewing reports and enforcing the Community Guidelines | Report, content and moderation records | The processing being mandatory for the performance of a contract, legitimate interest and the establishment, exercise or protection of a right |
| Keeping contract acceptance and compliance records | Document name, version and time of acceptance | The processing being mandatory for the data controller to fulfill its legal obligation and for the establishment, exercise or protection of a right |
| Responding to personal data requests | Application and verification information | The processing being mandatory for the data controller to fulfill its legal obligation |
| Responding to requests of competent institutions and judicial authorities | Records within the scope of the request | Being expressly provided for in laws and the fulfillment of a legal obligation |
| Conducting legal disputes | Relevant account, transaction and moderation records | The processing being mandatory for the establishment, exercise or protection of a right |
Not giving consent for processing based on explicit consent, or later withdrawing the consent you have given, does not prevent you from benefiting from Talemark's core functions. The withdrawal of consent does not affect processing lawfully carried out before the date of withdrawal.
4. Method of collecting personal data
Your personal data may be collected through wholly or partly automated methods via the following channels:
- Talemark registration, profile and content creation screens
- Google sign-in service
- In-app usage and transaction records
- Device and operating system interfaces
- Firebase Cloud Messaging
- Firebase Analytics if explicit consent is given
- Sentry in the event of an application error
- Supabase database, authentication, storage and server functions
- Email, support and report channels
- Competent institutions and legal processes
The legal grounds for collecting personal data are explained in Section 3, matched with each purpose of processing.
5. Transfer of personal data
Your personal data may be transferred to the following groups of recipients, only to the extent necessary to provide the relevant service and in accordance with the conditions set out in Articles 8 and 9 of the KVKK:
| Recipient or group of recipients | Purpose of transfer | Data that may be transferred |
|---|---|---|
| Supabase | Provision of database, authentication, file storage and server functions | Account, profile, user content, images, notification token and technical records |
| Google Firebase Analytics | Usage analytics based on explicit consent | Usage events, pseudonymous application installation identifiers and technical device data |
| Google Firebase Cloud Messaging | Delivery of notifications activated by the user | Notification token and device-related technical data |
| Sentry | Error and crash diagnostics | Stack trace, error context, device and operating system information |
| Resend | Sending verification, password reset and other transactional emails | Recipient email address, subject and email content |
| Google Sign-In / OAuth | Provision of the authentication service if chosen by the user | Name, email and profile picture shared by Google |
| TMDB | Provision of film search results and film data | Search term and necessary query parameters transmitted through the proxy |
| Google Books | Provision of book search results and book data | Search term and necessary query parameters transmitted through the proxy |
| Other Talemark users and internet users | Provision of the public profile and community features | The profile and content the user has shared publicly |
| Competent public institutions and judicial authorities | Fulfillment of legal obligations and responding to official requests | Personal data limited to the scope of the request |
| Legal, audit or technical advisors | Protection of legal rights, investigation of security incidents or audit | Limited data necessary for the relevant service or dispute |
TMDB and Google Books queries are sent through Talemark's server-side proxy services. Talemark does not transmit the end-user IP address or the Talemark account ID directly to these providers; however, the search term typed by the user and the technical parameters necessary for the result are sent to the relevant provider.
Personal data is not sold and is not shared for third parties' own advertising purposes.
6. Transfer of data abroad
Talemark's main database is hosted in Supabase's Frankfurt, Germany (eu-central-1) region.
The systems of service providers such as Supabase, Google, Firebase, Sentry, Resend, TMDB and Google Books may be located outside Turkey, or data may be processed in these providers' infrastructures in different countries.
Transfers of data abroad are carried out relying on whichever of the conditions set out in Article 9 of the KVKK is applicable; in particular, an adequacy decision, standard contracts providing appropriate safeguards or other transfer mechanisms recognized under the Law. Explicit consent is requested only under the conditions foreseen by the KVKK and where necessary as a separate legal ground.
You can request information about the transfer mechanism used, the recipient country and the categories of data transferred from privacy@talemark.app.
7. Retention and deletion
Personal data is retained for the period necessary for the purpose of processing and within the framework of applicable legal obligations.
The main retention criteria are as follows:
- Account and profile data, for as long as the account is open
- User content, until deleted by the user or until the account is closed
- Notification tokens, until notifications are disabled, the token becomes invalid or the account is deleted
- IP and rate-limiting records, ordinarily not exceeding 24 hours
- Firebase Analytics user and event data, for as long as explicit consent continues and within the configured retention period of a maximum of 2 months
- Sentry error records, ordinarily no more than 30 days
- Resend email delivery data, ordinarily 30 days
- Report and moderation records, as a rule up to 3 years after the transaction is completed; in the event of an ongoing dispute, until the process ends
- Security backups, a maximum of 30 days within the scope of the configured backup cycle
When the account is deleted, the profile, authentication account, user content, private journal data and images uploaded to Talemark storage are deleted from the active systems. Records in security backups created before the deletion may remain for a limited period until the backup cycle is completed.
Records that must be retained by law, compliance records showing that the deletion has been carried out, or limited data necessary for an ongoing dispute may be kept throughout the relevant period.
8. Your rights under the KVKK
Under Article 11 of the KVKK, in relation to your personal data, you have the right to:
- Learn whether your personal data is processed,
- Request information if your personal data has been processed,
- Learn the purpose of processing your personal data and whether it is used in accordance with its purpose,
- Know the third parties to whom your personal data is transferred domestically or abroad,
- Request the correction of your personal data if it has been processed incompletely or inaccurately,
- Request the deletion or destruction of your personal data within the scope of the conditions in Article 7 of the KVKK,
- Request that the correction, deletion or destruction operations be notified to third parties to whom the data has been transferred,
- Object to a result arising against you as a result of the analysis of the processed data solely through automated systems,
- Claim compensation for the damage if you suffer damage due to the unlawful processing of your personal data.
9. Method of application
You can send your requests under the KVKK to privacy@talemark.app from the email address registered and verified in your Talemark account.
Your application must contain the following information:
- Name and surname
- The Talemark username and registered email address to which the application relates
- The subject of the request
- The necessary information and documents supporting your request
- The contact information to which you want the response sent, if any
In order to conclude the application securely and to protect the data of other persons, reasonable additional information may be requested to verify your identity or that the account belongs to you. Identity information or copies of identity documents beyond what is necessary are not requested.
Applications are concluded free of charge as soon as possible and, as a rule, within 30 days at the latest, depending on the nature of the request. If the operation additionally requires a cost, the tariff determined by the Personal Data Protection Board may be applied.
If the application is rejected, the response given is found insufficient or no response is given within the time period, you can lodge a complaint with the Personal Data Protection Board within the periods foreseen in the KVKK.
10. Changes to the text
This Disclosure Notice may be updated when Talemark features, personal data processing activities, service providers or legal requirements change.
For significant changes:
- The last updated date and document version are changed,
- to the extent necessary, information is provided within the application or by email,
- if there is a processing activity requiring new explicit consent, explicit consent is requested separately.
The presentation or updating of this Disclosure Notice does not mean that blanket explicit consent has been given to personal data processing activities.
11. Contact
Regarding your personal data, this Disclosure Notice or your rights under the KVKK, you can reach Talemark at:
- Personal data and privacy requests: privacy@talemark.app
- General support: support@talemark.app