Privacy Policy

Last updated: 9 Eylul 2026

This policy applies to www.xn--kmsorular-p3a82fc21d.com and the NoteShare mobile app. By using the service you agree to the data processing described here.

1. Data we collect

1.1 Account information

• Username — shown next to the files you upload.
• Password — stored only as an irreversible bcrypt hash. Your plain-text password is never kept.
• Country, university, faculty and department — required to determine which archive you can access.
• Language preference (Turkish/English).

We do not ask for or store your email address, phone number, real name, date of birth or location. As a consequence, we cannot recover your account if you forget your password.

1.2 Content you upload

• The PDF files themselves (max 15 MB, max 10 files per user).
• File name, file size, course name, course code, year level and your optional description.
• An MD5 digest of the file content, used to detect duplicate uploads.
• How many times the file has been viewed.

1.3 Interaction data

• The upvotes and downvotes you cast.
• Content reports you submit (reason and optional details).
• The list of users you have blocked.

1.4 Technical data

• Session token — a random string generated at login, automatically invalid after 7 days.
• Cookies — only two: session_token (not readable from JavaScript) and lang for your language preference. We use no advertising or tracking cookies.
• Server logs — the web server keeps standard access logs containing IP address and browser information for debugging.

1.5 Third parties

Our website uses Google Ads conversion measurement (gtag.js), operated by Google under its own privacy policy: policies.google.com/privacy. This tag does not send your account details or uploaded files to Google.

2. Why we process this data

• To create your account and keep you signed in.
• To ensure you only reach the archive of your own university and department — this is the core access rule of the platform.
• To store your files and serve them to users in the same department.
• To review reports and remove infringing content and accounts.
• To prevent abuse such as spam and repeated duplicate uploads.

3. Who your data is shared with

We do not sell your data or transfer it to third parties for marketing. Your data is visible only:

• Your username and uploaded files are visible to other registered users in the same university and same department. Users in other departments cannot access this content.
• Our hosting provider has technical access to the server as part of operating it.
• To competent authorities where we have a legal obligation (court order or official request).

4. Retention

• Account and content: kept until you delete them.
• Session tokens: automatically invalid after 7 days.
• When you delete your account: your user record, all uploaded PDF files (physically removed from disk), your votes, share links, reports and block records are permanently deleted. This cannot be undone and there is no waiting period.
• Server access logs are rotated and deleted on the hosting provider's routine cycle.

5. Your rights

Under GDPR and Turkish KVKK you have the right to:

• Access: download every record related to your account as JSON from Settings → Download my data.
• Erasure: delete your account from Settings → Delete account, or, if you cannot sign in, at /delete-account.
• Rectification and objection: write to destek@xn--kmsorular-p3a82fc21d.com.

6. Security

• Passwords are hashed with bcrypt and never stored in plain text.
• All database queries use prepared statements.
• Uploads are validated by MIME type and file signature; only PDF files are accepted.
• Uploaded files cannot be fetched directly by URL; they are served only through an endpoint that checks authorisation.

No system is completely secure, so we recommend not reusing a password you use elsewhere.

7. Children's privacy

The service is intended for university students and is not directed at children under 13. If we learn that a user under 13 has registered, we delete the account.

8. Changes

If we change this policy we will update the "last updated" date on this page, and notify you in the app for significant changes.

9. Contact

For any privacy question, request or complaint: destek@xn--kmsorular-p3a82fc21d.com