Membership privacy notice

1. Data controller

Bumba Teknoloji Limited Şirketi ("Bumba", "we"), Ataşehir, İstanbul.

Contact and data protection requests: bilgi@bumbagroup.com

2. What this notice covers

It covers the data processed in connection with membership (accounts) on all Bumba websites and mobile apps. Each website and app keeps your account separately. An account you open on one website and its data are passed to another Bumba website only if you allow it (section 9, "Between Bumba websites"); otherwise websites do not see each other's members.

If a website processes data not listed here, or uses data for another purpose, it says so in addition on its own membership terms page. Topics outside membership have their own documents: the "Mailing list privacy notice" for the mailing list, the "Cookie policy" and the website's privacy page for cookies and visit statistics.

3. What data we process

Required to open an account:

• Your email address.
• Your password: stored as an irreversible hash (scrypt). Nobody, including us, can see it; we can only check whether the password you enter is correct.
• Your acceptance records: the date and time you accepted the membership terms and this notice, and the versions you accepted.

Optional (you may add them on your account page; none is required):

• Identity: first name, last name, nickname, date of birth (only ages 16 to 90 can be selected), gender (female, male or prefer not to say).
• Contact and location: phone number (with country code), country, city. We never ask for your street address, neighbourhood or district.
• Image: profile photo. It is resized automatically on upload and hidden data embedded in the photo, such as location and device (EXIF), is removed.
• Occupation.
• Profile: an "About me" text (up to 160 characters) and the usernames or addresses of social media accounts you add to your profile. We do not sign in to those accounts or take any data from them.

Recorded automatically:

• Your Bumba member number: a numbers-only ID issued in a single sequence across all Bumba websites. The shared service that issues it keeps only the number, the website and the date; not your email or name.
• Account details: sign-up date, last sign-in date, whether your email address is verified.
• Preferences: language, theme, time zone (taken from your browser; you can change it), profile visibility and which fields are visible, celebration email setting.
• Sessions: for each open session, the browser and operating system name and the day it was opened and last used. IP addresses are not kept with sessions.
• Security records: to limit failed sign-in, sign-up and password reset attempts, your IP address and the number of attempts are kept for at most one day and then deleted.
• The website's own usage data: data created by the service the website provides to you (e.g. game progress and scores, items you save, achievement badges, dhikr counts). It is kept linked to your account.

Signing in with a social account (only on websites that offer it, e.g. Google on Spora Başla): if you sign in with Google or Apple, that service passes us your name, email address and (if any) profile photo. Your password is never passed to us.

Data we do not process: we never ask for or collect religion or denomination, health, political opinions, ethnic origin, philosophical beliefs, trade union membership, biometric data, ID numbers or street address. Payment card details are not processed as part of membership; a website offering a paid service states this separately.

4. How we collect it

Your data is collected electronically: from what you enter in the sign-up and account page forms, automatically while you use the website (session, preference and usage data) and, if you choose to sign in with a social account, from that service.

5. What we use it for

• To open your account, let you sign in, verify your email address, reset your password and confirm a change of email address.
• To email you about your account: verification, password reset, "your password was changed", email change confirmation, "your account was deleted", a warning when someone tries to sign up with your address, a notice with the reason if your account is suspended and a notice when it is reinstated.
• To greet you by name in emails; to send emails in your chosen language and at your local time; to show dates and times in your format.
• To send celebration emails (section 6).
• To show your profile to other members only if you want and only with the fields you choose (section 7).
• To provide the website's service to you: keep your progress, saved items and badges; show you local content (e.g. based on your country or city).
• To protect your account and the website: limit failed sign-in attempts, prevent abuse, show you your open sessions and let you close them.
• To see aggregate statistics in the admin panel (e.g. total members, members by country and age group). The panel never shows one person's details.
• To answer you when you exercise your rights; to use records if there is a legal obligation or a dispute.

Your phone, gender and occupation stay on your profile only; if a website uses them for anything else, its membership terms say so. We never send you SMS or call you.

What we do not do: we do not use your data for advertising, we do not sell or rent it, we do not make automated decisions about you or profile you into categories, and being a member does not put you on any promotional email list (there is a separate, optional mailing list for that).

6. Celebration emails

We send you a short greeting email on your birthday (if you entered your date of birth), on your membership anniversary, on New Year's Day and on the public holidays of the country you chose on your profile. For Türkiye these are Ramadan Feast, Sacrifice Feast, 23 April, 1 May, 19 May, 30 August and 29 October; for other countries, that country's celebratory public holidays. No greetings are sent on days of remembrance or mourning. If you have not chosen a country, only the birthday, anniversary and New Year emails are sent.

They arrive in the morning, your local time, never more than one a day, and contain greetings only, no promotion, campaign or offer. Turn them off on your account page or with one click, without signing in, from the link at the bottom of each greeting. When you turn them off or delete your account, this is completed within 7 days at the latest; during that time a greeting that was already queued for sending may still reach you.

7. Who can see it

Your profile is private by default: only you see the information you enter. If you turn on "Show my profile" on your account page, you choose field by field what other members can see and can change it at any time. Your email address is never shown to others under any circumstances.

Where other members can see you on a website (e.g. a leaderboard or comments), they see the nickname you made visible, otherwise the name you made visible, otherwise your member number, e.g. "Member 10458".

Within Bumba, only authorised people who need it for their work can access your data. Bumba's administrator can see all information in your account in the admin panel (your profile, email address, member number, dates, open sessions, linked websites and the website's usage data); your password is stored as a hash, so no one can see it.

8. Legal bases

• Required information, session and preference data, the website's usage data, account emails and linking your account to other Bumba websites at your request: setting up and performing the membership agreement (KVKK Art. 5/2-c).
• Security records, preventing abuse (including the ban record) and aggregate statistics: our legitimate interest, provided it does not harm your fundamental rights and freedoms (KVKK Art. 5/2-f).
• Acceptance records and other records where needed: establishing, exercising or protecting a right (KVKK Art. 5/2-e) and our legal obligations (KVKK Art. 5/2-ç).
• Optional profile information, profile visibility, celebration emails and transferring data abroad: your explicit consent (KVKK Art. 5/1 and Art. 9). You give it by accepting this notice at sign-up, entering the information yourself and turning the settings on yourself; you withdraw it at any time by deleting the information, turning the setting off or deleting your account. Withdrawal does not affect processing done before it.

9. Where your data is kept and who receives it

• Server: your data is kept on our server in Istanbul. The server is provided by Netverim (BGZ Bilişim), which does not access your data for its own purposes.
• Backups: nightly backups are stored encrypted with Cloudflare, Inc.'s (USA) storage service for at most 30 days. This is a transfer abroad.
• Email delivery: membership and celebration emails are sent through Resend, Inc. (USA). For this, your email address, name and the email content are passed to Resend. This is a transfer abroad.
• Social sign-in: if you use it, information is exchanged with Google or Apple during sign-in; their own privacy policies apply.
• Between Bumba websites: if you turn on your membership on another Bumba website from your account page, or choose to use your existing membership when signing up there and sign in with your password, your email address, password hash, member number and profile information (including your photo) are passed to that website; while linked, changes to them are passed on immediately. The link is carried by a shared membership service on Bumba's own server, which holds only your member number, an irreversible hash of your email address, the websites you are a member of and any ban record. You can turn the link off at any time from your account page; turning it off deletes your account on that website.
• Authorities: public authorities and courts legally entitled to request it, only as far as properly requested.

Otherwise your data is not shared with or sold to anyone. Website visit statistics (Umami) run on our own server and contain no membership data.

10. How long we keep it

• Account and profile information, preferences and the website's usage data: as long as your account exists. Accounts are not deleted for being inactive.
• Accounts whose email is not verified: deleted automatically after 7 days.
• Sessions: expire and are deleted after 30 days on websites or 90 days in mobile apps without use; a session you close is deleted immediately.
• Verification and password reset links: deleted when used or when they expire (24 hours and 1 hour).
• Security records (IP address and number of attempts): at most one day.
• Permanently banned accounts: profile and usage data are deleted; only the email address, member number, reason and date of the ban are kept until the ban is lifted, so the address cannot be used to sign up again.
• The record in the shared membership service: deleted when your last linked account is deleted (except a ban record).
• Backups: at most 30 days.

When you delete your account all your data is deleted immediately; only your posts and contributions in content shared with other members (e.g. forum posts, comments, information you added to a shared tree) remain, shown as "Deleted member" instead of your name. Shared content you own (e.g. a family tree) passes to its longest-standing member; if it has no other member it is deleted after 30 days. Deleted data stays in backups for at most 30 more days and is deleted there when the backup expires. If a celebration email was already queued with the email delivery service (with your address and name), it leaves that service within 7 days at the latest. If the law requires us to keep a record, only that record is kept, for as long as the law requires.

11. How we protect it

All connections are encrypted (HTTPS). Passwords are irreversibly hashed. Session cookies can only be read by the server and are sent only over secure connections. Failed sign-in attempts are limited. Backups are encrypted. Only authorised people can access the server and the data. In mobile apps the session key is kept in the phone's secure storage (iOS Keychain, Android Keystore).

12. Children

Membership is for people aged 16 or over. If we learn that someone under 16 has signed up, we delete the account. If you are a parent and think your child has opened an account, write to us.

13. Your rights

Under Article 11 of the KVKK you have the right to:

• Learn whether your personal data is processed and, if so, request information about it.
• Learn the purpose of processing and whether it is used accordingly.
• Know the third parties, in Türkiye or abroad, to whom it is transferred.
• Request correction if it is incomplete or inaccurate.
• Request its deletion or destruction under the conditions of Article 7 of the KVKK.
• Request that corrections and deletions be notified to the third parties to whom the data was transferred.
• Object to a result against you arising solely from automated analysis.
• Claim compensation if you suffer damage because of unlawful processing.

You can exercise most of these yourself, immediately, on your account page: change or delete any information, download all your data (including your photo) with "Download my data", turn off profile visibility and celebration emails, close your open sessions and permanently delete your account with "Delete account".

14. How to contact us

Send your request by email from the address registered to your account to bilgi@bumbagroup.com, or in writing to Bumba Teknoloji Limited Şirketi, Ataşehir, İstanbul. Please state your name, the website where you are a member and your request clearly.

We answer free of charge within 30 days at the latest; if the request involves an additional cost, the fee set by the Turkish Personal Data Protection Board may apply. If you find our answer insufficient, you may complain to the Personal Data Protection Board.

15. Changes

We may update this notice. The current version is always on this page, with its date at the top. If there is a significant change (e.g. new data, a new purpose or a new transfer), we tell members by email and, where needed, ask for your acceptance again at your next sign-in.