Privacy Policy
a11y.tr is a directory and release-notes platform where blind and visually impaired developers publish their apps and where anyone can find the latest version of an app, read what changed and download it from the developer's own links. This policy explains what personal data we process, why, who receives it and what rights you have.
1. Who is responsible
a11y.tr is operated by Can Kırca ("we", "us"), who is the data controller. You can reach us about anything in this policy at [email protected].
2. What we collect
Visitors
Browsing the public site does not require an account. We do not use advertising or cross-site tracking, and we do not set cookies on public pages. Our web server keeps short-lived technical logs (IP address, requested page, time, browser type) to keep the service secure and working.
Developers with an account
Name or display name, the address (username) you choose, email address, password (stored only as a one-way hash) or other sign-in credentials, profile text and links you add, the apps, release notes, download links, FAQs and documents you publish, and records of your activity in the management panel. We set a strictly necessary session cookie when you sign in to the management panel.
Subscribers
If you subscribe to a developer, an app or platform updates, we process your email address, what you subscribed to, your preferences and the confirmation and unsubscribe records. We email you only about what you subscribed to.
People who contact developers or report problems
If you use a contact form or the issue form on an app page, we process your message, your email address if you give one, and the technical details you choose to include, such as app version, device platform and the screen reader you use. Issue reports can be public. Do not include sensitive information in them.
Release announcements sent to us (email and WhatsApp)
Developers can add a release by sending or forwarding an announcement to us by email, by forwarding it to our WhatsApp Business number, by pasting it into the panel, or through our API. When a message arrives we process its text, any links in it, the sender's phone number or email address, the time and the message identifier. We match the sender to a registered developer account and ignore messages from senders we cannot match. We use the content only to prepare a draft release entry (version number, date, release notes and download links) that the developer reviews before it is published. We do not use these messages for advertising or profiling and we do not send marketing messages through WhatsApp.
3. Why we process data and on what basis
- Provide the service you asked for: running developer accounts, publishing releases, delivering subscriptions, handling contact messages and issue reports (contract or steps taken at your request).
- Security, abuse prevention and service reliability: logs, rate limiting, spam checks that do not use CAPTCHAs, audit records (our legitimate interests).
- Emails you subscribed to: with your consent, which you can withdraw at any time by using the unsubscribe link.
- Legal obligations: responding to lawful requests and keeping records the law requires.
Where Turkish data protection law (KVKK, Law No. 6698) applies, we rely on the corresponding grounds in Article 5 of that law. Where the EU/UK GDPR applies, we rely on Article 6(1)(a), (b), (c) and (f).
4. Automated processing and AI
To turn an announcement into a draft, we send its text to an AI service provider that extracts structured fields such as the version number, the date, the changes and the links. The AI output is a suggestion only. A person (the developer) reviews and approves it before anything is published, and we check links against allowed domains. We do not use AI to make decisions about you that have legal or similarly significant effects.
5. Who receives personal data
We use a small number of service providers who process data on our behalf under agreements that restrict them to our instructions:
- Hosting and infrastructure providers that run our servers and databases.
- Email delivery providers that send confirmation and update emails and receive inbound release emails.
- Meta Platforms (WhatsApp Business Platform), which delivers WhatsApp messages sent to our number to us. Meta processes those messages under its own terms and privacy policy.
- An AI service provider (Anthropic) that processes announcement text as described in section 4.
We do not sell personal data. Information that developers publish on their pages (for example their profile, apps and release notes) is public by design.
6. International transfers
Some providers are located outside your country, including outside Türkiye and the European Economic Area. Where required, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision.
7. How long we keep data
| Data | Kept for |
|---|---|
| Raw text of announcements received by email or WhatsApp | Up to 30 days after the draft is approved, rejected or expires. Drafts expire after 30 days. |
| Developer account data | While the account is active, then deleted within 30 days of closure. |
| Published releases, app pages and profile | Until the developer removes them or the account is closed. |
| Subscriber email address and preferences | Until you unsubscribe. We then keep only a one-way hash of the address so that we do not email you again. |
| Contact messages and issue reports | Up to 24 months after the conversation is closed. |
| Server logs | 30 days. |
| Backups | Overwritten within 35 days. |
8. Your rights
Depending on where you live, you can ask us to confirm whether we process your data, give you a copy, correct it, delete it, restrict or object to processing, withdraw consent, and, where applicable, receive your data in a portable format. Under KVKK Article 11 you have the corresponding rights, including the right to learn whether your data is processed, to request information about it, and to request correction or deletion. To use a right, email [email protected]. We answer within 30 days. See our data deletion instructions for deletion requests.
You can also complain to your data protection authority. In Türkiye this is the Personal Data Protection Authority (KVKK).
9. Security
We protect data with encrypted connections (HTTPS), hashed passwords, access limited to people who need it, signed requests from the WhatsApp Business Platform, rate limiting and regular backups. No system is perfectly secure; if a breach affecting you occurs we will notify you and the authorities as the law requires.
10. Children
a11y.tr is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has given us personal data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. We will change the date at the top and, for significant changes, notify account holders and subscribers.
12. Contact
Questions or requests: [email protected].