Legal information

KVKK Information Notice

August 10, 2026

This notice is issued under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (“KVKK”) and the accompanying Communiqué on the Procedures and Principles of the Disclosure Obligation. It is specific to Turkish law; it is published in English for readers who do not read Turkish, and the Turkish original governs.

It can be kept short because the architecture of the site collects almost no personal data. For the longer account, see the Privacy Policy.

Data controller

The data controller is academia.sh. Address for applications: [email protected]

Personal data processed

academia.sh collects no personal data from you directly. The site has no accounts, no registration, no sign-in, no profile, no contact form and no payment; nothing you do on the site is sent to a server.

Two kinds of processing fall within the scope of the Law:

1. Technical access logs. The hosting provider generates these automatically for each HTTP request. Such a log typically contains:

Transaction security data: IP address, user agent, requested address, timestamp, response code.

2. Visit measurement data — only with your explicit consent. If you consent, the following is processed through Google Analytics 4:

Transaction security data: an approximate location derived from your IP address (country and city level). Google Analytics 4 does not log the IP address itself.
User transaction data: the address and title of the page visited, the referring address, visit duration and sequence, browser, language, operating system, device and screen information, and the random client identifier held in the _ga cookie.

No identity, contact, employment, health, biometric or financial data is processed beyond this. No special categories of personal data are processed at all.

As long as you have not consented, or have declined, none of the second group comes into existence: the measurement script is not downloaded and no request reaches Google.

What stays in your browser is not processing

Your lesson progress, your study plan, the goals you joined and your theme preference are kept in your browser’s local storage (localStorage). These records never leave your device, are never sent to a server, and are never accessible to the data controller; they are therefore not personal data processed by the controller. The Cookie Policy lists what each key holds.

Your measurement consent (academia:consent:v1) is kept in the same local storage; it is deliberately not kept in a cookie, because writing a cookie without consent in order to ask for consent would be incoherent.

The site sets no cookie without your consent, so until you consent there is no cookie-based profiling, targeting or tracking either. The two measurement cookies written once you do consent are listed one by one in the Cookie Policy.

Purposes of processing

Technical access logs exist and are used only to:

deliver the page you requested, and
run information-security processes, preventing abuse and attacks.

Visit measurement data is processed only to:

see, in aggregate, how much of the content is read, and improve the catalogue accordingly.

None of this data is used for advertising, marketing or individual profiling, and none of it is sold to third parties. The site carries no ad script and no advertising cookie; in the measurement, the advertising categories (ad_storage, ad_user_data, ad_personalization) are permanently denied.

Legal basis

For technical access logs, the legal basis is the legitimate interest of the data controller under KVKK Art. 5/2-f, in delivering the service technically and in maintaining network security.

For visit measurement, the legal basis is your explicit consent under KVKK Art. 5/1. No measurement runs before consent is given; you may withdraw it at any time, and withdrawal does not affect the lawfulness of processing carried out until then.

Method of collection

Technical access logs are generated automatically, at the hosting layer, as an ordinary consequence of the HTTP request when you open a page. No data is requested from you.

Visit measurement data is collected automatically by the Google Analytics script running in your browser, and only after you have given consent in the banner.

Transfers

Technical access logs are not sold, rented or shared for marketing purposes.

The site is hosted on Cloudflare Pages. These records are generated and retained in the hosting provider’s systems; academia.sh does not additionally collect, archive, combine or use them to build visitor profiles.

Transfer abroad: the hosting infrastructure also runs servers outside Türkiye, so technical access logs may be processed abroad. Such transfer takes place within the framework of KVKK Art. 9 and only to the extent required to deliver the service.

Visit measurement data, if you consent, is transferred to Google Ireland Limited / Google LLC as processor and handled on Google’s servers outside Türkiye. This transfer abroad rests on the explicit consent you give under KVKK Art. 9; without consent, no transfer takes place at all.

Retention

Technical access logs are subject to the hosting provider’s own retention and destruction policy; academia.sh keeps no separate copy.

Visit measurement data is retained in Google Analytics for at most fourteen months; the measurement cookies live in your browser for two years and are deleted immediately when you withdraw consent.

The lifetime of the records in your browser is entirely up to you: you can delete them at any time from your browser settings.

Your rights as a data subject

Under KVKK Art. 11 you may apply to the data controller to:

learn whether your personal data is processed,
request information if it has been processed,
learn the purpose of processing and whether the data is used accordingly,
know the third parties to whom it is transferred, at home or abroad,
request correction if it is incomplete or inaccurate,
request erasure or destruction under the conditions of Article 7,
request that actions taken under (5) and (6) be notified to third parties to whom the data was transferred,
object to a result reached against you through analysis solely by automated systems,
claim compensation for damage suffered as a result of unlawful processing.

In addition, for the consent-based visit measurement you have the right to withdraw your consent at any time. Withdrawal is one click in the control on the Cookie Policy page; measurement stops at that moment and the _ga cookies are deleted from your browser.

Honesty is due here: academia.sh keeps no name, no email address and no record that identifies you directly; measurement data hangs on a randomly generated browser number. The answer to most requests will therefore be “no data is held in your name”. For requests about the technical access logs held by the hosting provider or the measurement records held in Google Analytics, write to us and we will forward your application to that provider.

How to apply

Send requests concerning your rights to [email protected]. Under the Communiqué on the Procedures and Principles of Application to the Data Controller, your application should state your request clearly and include information establishing your identity.

Your request is concluded free of charge as soon as possible and within thirty days at the latest. If the process incurs a cost, the fee set by the Personal Data Protection Board’s tariff may be charged.

When this notice changes

If an account system, a payment provider or any new processing activity goes live, this notice is updated in the same release as that change — not afterwards. The moment one of the statements above stops being true, this page changes too.

The current version is always published at this address; the date at the top of the page indicates the most recent change.