mesh1. Data controller and scope
This notice has been prepared by the business below, acting as data controller, under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK) and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform:
- Data controller
- Remzi Yılmaz (sole proprietorship)
- destek@meshmekan.com
It covers visitors to the Mesh Mekan website and users of the Mesh Mekan app (macOS, iOS, iPadOS, tvOS and visionOS). Visiting the website and using the app are separate processing activities; visiting this website alone does not create a Mesh Mekan account.
This notice explains which data is processed and how; it is not a request for explicit consent. If processing that requires consent is ever added, consent will be asked for separately with its purpose stated, and it will not be made a condition of the service. The Authority’s explanation of the obligation to inform (in Turkish).
2. Data processed, purposes and legal bases
| Data category | Purpose of processing | Legal basis (KVKK Art. 5) |
|---|---|---|
| IP address, request time, browser and connection details sent to the website | Serving the pages, ensuring access and the security of the service | Art. 5/2-f: the data controller’s legitimate interest, provided it does not harm your fundamental rights and freedoms |
| Apple user identifier, app account ID, display name, session token and its version | Creating the account, authenticating you, managing and ending your session | Art. 5/2-c: the formation and performance of a contract |
| Status, status message, avatar color; optional city, time zone, interest tags and what you are working on | Providing the profile, discovery and online presence features | Art. 5/2-c: performance of the social features you choose to use |
| Messages, files and file details; Mekan, group and conversation memberships; friendships; read and unread information | Delivering content to the recipients you choose, providing chat and file sharing | Art. 5/2-c: performance of the contract |
| The previous text of an edited message; the message ID, sender, related Mekan or conversation and the time of the edit | Reviewing moderation cases and disputes: being able to see whether a message was changed after it was reported | Art. 5/2-f: legitimate interest; in a dispute, Art. 5/2-e: establishing, exercising or protecting a right. The record is accessible only to moderation, is never shown to any user and is kept for at most 90 days |
| Store storefront (name, description, address, phone number, image), product records and store report counters | Showing the store owner’s storefront publicly; giving the owner an aggregate visits and engagement report | Art. 5/2-c: performance of the store subscription; for the counters, Art. 5/2-f: proportionate legitimate interest (the count record carrying identity is deleted within 30 days) |
| Block records; the reason, note, parties and target content of reports; the text of a reported name or message at the moment it was reported (accessible only to moderation, at most 90 days); suspension and ban records | Keeping the community safe, enforcing the rules, reviewing appeals | Art. 5/2-f: legitimate interest; in a dispute, Art. 5/2-e: establishing, exercising or protecting a right |
| APNs device token and notification preferences | Delivering the notifications you turned on to your device | Art. 5/2-c: performance of the notification service you requested (operating system permission stays with you) |
| App Store transaction and subscription identifiers, product, period and entitlement status | Verifying the entitlement you bought, tracking and applying renewals | Art. 5/2-c; where a legal retention obligation arises, Art. 5/2-ç |
| Rate limit and abuse counters (hourly/daily counts per user or Mekan) | Protecting the service from overload and automated abuse | Art. 5/2-f: legitimate interest (counters are deleted within 2 days) |
| Your name, email address, the content of your request and attachments when you write to us | Answering your support request, completing your KVKK request | For service requests, Art. 5/2-c; for KVKK requests, Art. 5/2-ç and, where necessary, Art. 5/2-e |
Health data, biometric data or similar special categories of personal data are not requested in any field and are not processed for profiles. We recommend that you do not add such information, or unnecessary personal data about others, to chats or support messages. Conditions for processing personal data (in Turkish).
3. How data is collected
Data is obtained entirely by automated means, electronically: website data through the request your browser sends; app data through Sign in with Apple, profile editing, chat, sending files, store management, purchases and reporting; support data through the email you send. The app does not access your contacts, location, photos or microphone unless you explicitly choose a file yourself.
4. To whom is data transferred, and why?
- Other users: Your profile and online information in discovery and social features; your messages and files within the access rules of the Mekan or conversation you take part in; your store storefront to everyone.
- Cloudflare, Inc. (data processor): The app’s server runs on Cloudflare Workers; the database is on Cloudflare D1, file storage on Cloudflare R2, and live chat and the notification inbox on Cloudflare Durable Objects. This website is also published with Cloudflare Workers, and support email is delivered through Cloudflare’s email routing. All app data in the inventory above is processed on this infrastructure.
- Apple Inc. (a separate data controller for its own services): The identifiers, notification texts and transaction details needed for Sign in with Apple, push notifications (APNs) and App Store in-app purchases are shared with Apple. Apple’s processing of this data is subject to its own privacy policy.
- Authorized authorities and persons: When an authority expressly empowered by law makes a request in due form, limited to the scope of that request (Art. 8/2-a and Art. 5/2-ç).
There is no sharing with advertising networks, analytics services, data brokers or any other third party.
Transfers abroad
Cloudflare and Apple are multinational companies; their servers may be located outside Turkey, and your data is processed abroad through these services. Under KVKK Art. 9, the transfer relies on the data processing agreements made with these providers and on the fact that the service — such as Sign in with Apple, notifications and App Store purchases — can only be provided through them, so the transfer is necessary for the performance of the contract. The scope of the transfer is limited to the inventory above. The Authority’s explanation of transfers abroad (in Turkish).
5. Retention and deletion
Data is kept for as long as the purpose of processing requires and, where applicable, for as long as a legal retention obligation requires; when that period ends, it is deleted or anonymized. The periods defined in the app’s code are: Mekan messages 24 hours and the last 200 messages; store messages the last 1,000 messages; one-to-one and group messages the last 500 messages per conversation, closed conversations 90 days; an empty Mekan 14 days, a Mekan or store whose rent has ended 90 days; uploads not attached to a message 1 hour; the Mekan activity log 35 days; the store report 90 days and the unique visitor count 30 days; decided reports 30 days; the text of reported content 90 days; the previous text of an edited message 90 days; Mekan vote records 90 days; completed requests 30 days; rate counters 2 days; notification device records not seen 180 days; support correspondence 2 years at the latest. The full table is in the Privacy Policy.
Account deletion has two stages: the account closes immediately and its personal fields are cleared; Mekan, file, conversation and friendship records are cleaned up in the background and the account record is deleted. The sender details of one-to-one and group messages are removed; personal details you wrote inside the message text yourself may remain, and you can make a separate request about them. Details: Privacy Policy, “When you delete your account”.
6. Your rights under KVKK Art. 11
By applying to the data controller, you have the right to:
- Learn whether your personal data is processed,
- Request information about it if it has been processed,
- Learn the purpose of processing and whether the data is used in line with that purpose,
- Know the third parties, in Turkey or abroad, to whom your data is transferred,
- Request correction if it has been processed incompletely or inaccurately,
- Request its deletion or destruction under the conditions in KVKK Art. 7,
- Request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
- Object to a result against you that arises from analysis of the processed data exclusively by automated systems,
- Request compensation if you suffer damage because of unlawful processing.
Mesh Mekan has two mechanisms in which automated analysis produces a result about you. The first is the 7-day account suspension triggered by reports from three different users within 24 hours. The second is a vote inside a Mekan opened by its regulars that passes the threshold: the result can be a 30-minute mute or removal from the Mekan (no re-entry for 10 minutes); it applies only to that Mekan and does not affect your account. You can appeal either decision through the channel on the Contact page, and a person reviews the appeal. The Authority’s explanation of data subject rights (in Turkish).
7. How to make a request
To exercise your rights, send your request in writing to the email address or postal address above, in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller. What the request must contain and the practical steps are described on the Contact page. You can also carry out most information, correction and deletion requests yourself in the app — by editing your profile or deleting your account.
Requests are free of charge; if the action requires an additional cost, the fee schedule set by the Board may apply. Your request is answered as soon as possible according to its nature, and within 30 days at the latest. Application and complaint periods (in Turkish).
If your request is rejected, the answer is insufficient or no answer is given in time, you can file a complaint with the Personal Data Protection Board within 30 days of learning the answer, and in any case within 60 days of the date of your request.