Privacy
Privacy Notice on the Processing of Personal Data
Last updated: 4 November 2026
This is a translation for convenience. If it differs from the Turkish text, the Turkish text prevails. Türkçe metin
1. Data controller
This Privacy Notice has been prepared by the data controller named below under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform.
| Data controller | Mehmet Ali Kamiloğlu (an individual) |
| Address | Han Spaces Etiler, Beşiktaş, İstanbul |
| hello@bookmarksociety.co | |
| Service | Bookmark web app (app.bookmarksociety.co) |
In this notice "Bookmark", "we" and "us" mean the data controller; "you" means the person using the app.
2. Scope
This notice covers the processing of personal data of readers who sign up to and use the Bookmark web app. It also covers members who respond to Bookmark Society gatherings through the app, and what editors, moderators and administrators working for the Bookmark team do inside the app.
Visitors to the bookmarksociety.co website and the newsletter list are covered by a separate notice. Photos taken at Bookmark Society's in-person gatherings fall outside this notice, and participants are asked separately.
3. Personal data we process
When you use Bookmark, the following personal data is processed. The table in section 4 matches each kind of data to its purpose.
| Category | Data in this category |
|---|---|
| Identity | First name, last name, username, the name shown on your profile; your declaration that you are 18 or older and its date |
| Contact | Email address |
| Images | Your profile photo; photos you add to reading moments; cover photos you upload when adding a new book or edition |
| Reading and library | Books on your shelves and their status (reading now, want to read, read, paused, stopped), your private shelves, books and shelves you have hidden, reading records (pages, time, date), the edition you read, your ratings, your favourites, authors you follow, your reading goal and reading moments preference, picks you have hidden, books and editions you suggest |
| Your content | Notes, quotes, reading moments (the line you write and an optional place name), essays, lists, comments, likes, things you save, questions you add to gatherings, reading groups you open or join |
| Social | Who you follow and who follows you, accounts you block or mute, whether you appear on the "Friends this week" board |
| Gatherings | Your Bookmark Society membership, your responses to gatherings (Going, Maybe, Can't go), attendance, any moderator role |
| Preferences and consents | Your privacy and notification settings, language, consent and preference records and their dates |
| Security | A one-way hash of your password, session records (IP address, browser and device, sign-in and refresh times), password reset records, security logs; for team members also two-step verification data and a log of team actions |
| Usage and notifications | Records of what you do in the app (for example starting or finishing a book, adding a note), your in-app notifications, and whether a notification was sent and opened |
| Requests and reports | What you send us, reports you make or that are made about your account or content, and their outcome |
Special categories of personal data. Bookmark does not ask for special categories of personal data listed in Article 6 KVKK (health, religion, political opinion, philosophical belief and the like) and does not separately process them for any purpose. Please don't include such information in your notes, essays or comments; if you do, others can see it according to the visibility you chose.
4. Purposes and legal grounds
Your personal data is processed for the purposes below, each on the legal ground under Article 5 KVKK shown next to it, and only as far as the purpose requires.
| Purpose | Categories | Legal ground |
|---|---|---|
| Creating your account, signing in and managing your account | Identity, Contact, Security | Necessary to enter into or perform a contract (Art. 5/2-c) |
| Providing the core service: library, reading records, reading rhythm, ratings and shelves | Reading and library, Preferences and consents | Art. 5/2-c |
| Showing your profile and posts to other readers according to your privacy settings (friends' feed, book pages, the weekly friends board, reader search) | Identity, Images, Reading and library, Your content, Social | Art. 5/2-c |
| Publishing your notes, quotes, essays, lists, comments and likes; following and reading groups | Your content, Social | Art. 5/2-c |
| Running Bookmark Society gatherings: recording responses, letting respondents see each other, sending the address to attendees a day before, reminders | Identity, Gatherings, Your content | Art. 5/2-c |
| Personal book picks (Monday picks, "readers of this also read", Friday radar) based on your library, the authors you follow and the shelves friends have opened to you | Reading and library, Social | Art. 5/2-c |
| Tuning reminder times and picks to you by learning when you open the app and how you respond to notifications | Usage and notifications, Reading and library | Explicit consent (Art. 5/1); without your consent this does not happen |
| Sending in-app notifications; each type can be turned on or off on its own | Usage and notifications, Preferences and consents | Art. 5/2-c |
| Sending a weekly email summary if you ask for it | Contact, Reading and library, Gatherings | Art. 5/2-c |
| Password reset and essential account emails | Contact, Security | Art. 5/2-c |
| Recording decisions to send or not send a notification, to apply the daily notification limit | Usage and notifications | Our legitimate interest, provided it does not harm your fundamental rights and freedoms (Art. 5/2-f) |
| Information security, preventing unauthorised access and abuse, rate limiting, blocking, reports and moderation | Security, Your content, Social, Requests and reports | Art. 5/2-f; Art. 5/2-ç for obligations under Art. 12 KVKK |
| Authorising team members and logging team actions | Identity, Security | Art. 5/2-f and Art. 5/2-ç |
| Meeting obligations under Law No. 5651 and related legislation (keeping traffic data, recording the age declaration, requests from authorities) | Identity, Security, Your content | Expressly provided for by law (Art. 5/2-a) and legal obligation (Art. 5/2-ç) |
| Answering your requests under Article 11 KVKK | Identity, Contact, Requests and reports | Art. 5/2-ç |
| Establishing, exercising and protecting our rights in a possible dispute | All categories as relevant | Necessary to establish, exercise or protect a right (Art. 5/2-e) |
| Producing aggregate statistics that cannot be linked to anyone, to improve the service | Reading and library, Usage (anonymised) | Art. 5/2-f |
Bookmark does not sell or rent your personal data, and does not share it with third parties for advertising. There are no ads in the app.
5. How we collect personal data
Your personal data is collected electronically, wholly or partly by automated means:
- directly from you, through the sign up form and your profile settings,
- when you add books to your shelves, keep reading records, share notes and essays, respond to gatherings and change your settings,
- from photos you upload,
- through session cookies and server logs while you use the app,
- through the actions of other users and team members who follow you, comment on your content, report you or make you a moderator of a gathering.
Data collected in these ways is processed on the legal grounds given for each purpose in section 4.
6. Who sees your personal data and who it is transferred to
Other readers. Bookmark is made for reading with friends. By default your library is visible to your followers, your profile is open and readers can find you by username or name. You can turn each of these off in one tap under Settings › Privacy, and hide a single book or shelf. Your private shelves are visible only to you. You choose who sees each post. Your response to a gathering is seen by the other members who responded to it. People you block cannot see you or your content.
Transfers within Türkiye. Under Article 8 KVKK your personal data may be transferred only to public authorities and courts legally entitled to request it, on their lawful request and limited to it (Art. 5/2-a and Art. 5/2-ç), and to our lawyer, who is bound by confidentiality, where needed to establish or protect a right (Art. 5/2-e).
Transfers abroad. The app runs on the infrastructure of the companies below, which act as our data processors. As they are based abroad, your personal data is transferred abroad. Since there is no adequacy decision for the countries concerned, transfers are made under Article 9 KVKK and the Regulation on the Procedures and Principles for the Transfer of Personal Data Abroad by signing the standard contracts published by the Personal Data Protection Board and notifying the Authority within five business days of signature.
| Recipient | Service | Where data is held | Data transferred |
|---|---|---|---|
| Fly.io, Inc. (USA) | App and server hosting | Frankfurt, Germany | All data processed in the app |
| Neon, Inc. (USA) | Database hosting | Frankfurt, Germany | All data processed in the app |
| Resend, Inc. (USA) | Sending transactional emails (password reset, weekly summary) | USA | Name, email address, the email's content |
These companies may process your data only on our instructions and to provide their service to us. No personal data is sent to sources we use for book details and covers, such as Open Library.
7. Retention and destruction
Your personal data is kept for as long as needed for its purpose and as required by law. When that period ends, it is deleted, destroyed or anonymised in periodic destruction runs no more than six months apart, under the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
| Data | Retention |
|---|---|
| Account, profile, library and reading data | While your account exists |
| Your posts (notes, essays, lists, comments, photos) | Until you delete them or your account ends |
| Gathering responses and attendance | While your account exists |
| Session and traffic logs (IP address, time) | 1 year (Law No. 5651 and its regulation) |
| Notifications and notification decision records | 12 months, then anonymised |
| App event records | 12 months, then anonymised |
| Consent and preference records | While the consent or preference stands; 10 years after withdrawal, as proof |
| Report and moderation records | 2 years |
| Team action logs | 2 years |
| KVKK requests and correspondence | 10 years |
If you delete your account. Your name, email, password, photo and profile are deleted at once; your sessions are ended; your follows and private shelves are deleted. Your reading records are separated from your identity and anonymised so they can never be linked back to you. Depending on what you choose when deleting, your notes, lists and essays either stay under the name "A former reader" with no link to you, or are taken down. Records the law requires us to keep are kept only for that period, with access restricted.
8. Picks, automated processing and notifications
Picks. Monday picks suggests seven books for you every Monday; Friday radar shows new books and editions from authors you follow. Picks are based on your library, the authors you follow, the shelves friends have opened to you and aggregate data, not linked to anyone, on which books readers read together. Each pick says why it was chosen, and you can hide one you don't want. Picks have no legal or similarly significant effect on you; even so, under Article 11/1-g KVKK you keep the right to object to an outcome against you arising solely from automated analysis of your data.
Learning from your reading habits. Tuning reminder times and picks to you by looking at when you open the app and how you respond to notifications happens only with your explicit consent. It starts off; you can turn it on through the separate Explicit Consent Text and turn it off at any time under Settings › Privacy.
Notifications. The web app sends no notifications to your phone; notifications appear only inside the app. Each type is a separate choice, and turning one off affects neither the others nor the service:
| Notification | Default |
|---|---|
| A friend finishes a book you are reading or have read | On |
| Someone comments on your post | On |
| A gathering you said you'd join is coming up | On |
| Monday picks are ready | On |
| Friday radar | Off |
| Weekly email summary | Off |
Bookmark sends you at most two notifications a day. It sends no commercial electronic messages (campaigns, ads, promotions); for those your separate approval would be sought under Law No. 6563.
9. Age limit
You must be at least 18 to open a Bookmark account. Under Law No. 5651 on the Regulation of Internet Publications and Combating Crimes Committed Through Them and the Regulation on Differentiated Services for Children and Age Verification by Social Network Providers, the service is not provided to anyone under 15.
When you open an account you declare that you are 18 or older. This declaration and its date are kept while your account exists. This processing relies on the conclusion of a contract (Art. 5/2-c) and on meeting our legal obligation (Art. 5/2-ç). If the law comes to require separate age verification, we will update this notice and let you know.
If we learn that someone under the age limit has opened an account, we will close it with notice and delete their data as far as the law allows.
10. Cookies and data kept in your browser
The app uses only cookies it needs to work. No analytics, advertising or third-party tracking cookies are used. Essential cookies rely on performing the contract (Art. 5/2-c) and our legitimate interest in keeping the service secure (Art. 5/2-f), so no consent is asked.
| Name | Purpose | Duration |
|---|---|---|
| bm_access_token | Confirms you are signed in | 15 minutes |
| bm_refresh_token | Renews your session without signing in again | Up to 30 days |
| bm_staff | Team session, for team members only | Up to 8 hours |
Small preferences, such as the reading timer and showing the "add to Home Screen" suggestion only once, are kept only in your browser (local storage) and never sent to us. You can clear them in your browser settings.
11. Data security
Under Article 12 KVKK we take appropriate technical and organisational measures to prevent unlawful processing of and unlawful access to your personal data. The main ones:
- all connections are encrypted (HTTPS) and passwords are stored only in a one-way form,
- authorisation is checked on the server on every request, privacy settings included,
- team access opens with a separate, short-lived session, a password and two-step verification; every team action is logged,
- access to data is limited on a need-to-know basis, and our providers are bound by contracts with confidentiality duties.
If your personal data is obtained by others unlawfully, we will notify the Personal Data Protection Board as soon as possible and within 72 hours at the latest, and tell you as soon as possible.
12. Your rights and how to apply
Under Article 11 KVKK you have the right to apply to us to:
- learn whether your personal data is processed,
- request information about it if it is,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Türkiye or abroad it is transferred to,
- ask for it to be corrected if incomplete or wrong,
- ask for it to be deleted or destroyed under the conditions in Article 7 KVKK,
- ask for corrections, deletions and destructions to be notified to the third parties it was transferred to,
- object to an outcome against you arising solely from automated analysis of your data,
- claim compensation if you suffer damage from unlawful processing.
What you can do yourself in the app. You can correct your profile and privacy settings under Settings; download everything we hold about you as one file under Settings › Account › "Download your data"; delete your account with "Delete your account"; and withdraw your consent and notification choices at any time.
Applying. Under the Communiqué on the Procedures and Principles of Applications to the Data Controller you can send requests about your rights:
- in a signed letter with documents proving your identity, by hand or through a notary, to Han Spaces Etiler, Beşiktaş, İstanbul,
- or from the email address registered to your Bookmark account to hello@bookmarksociety.co.
Your application should include your name, surname, signature (for written applications), Turkish ID number (or, if you are not a Turkish citizen, your nationality and passport or ID number), an address or email for our reply, and your request. We will answer as soon as possible and within 30 days at the latest, free of charge; if the action has a separate cost, the fee in the Board's tariff may be charged.
If your application is refused, you find the answer insufficient or we don't answer in time, you can complain to the Personal Data Protection Board within 30 days of learning the answer and in any case within 60 days of applying (Art. 14 KVKK).
13. Changes
We update this notice when our processing or the law changes. For an important change we tell you in the app before it takes effect. The current version is always linked at the bottom of the app and of bookmarksociety.co.