Privacy Policy

Frequency: Almost in Tune · almostintunebook.com

Last updated: October 9, 2026

1. Who this is

This site is operated by Ata Selim, an individual creator based in Türkiye, not a company. Questions about this policy or your data: almostintunebook@gmail.com.

Under Turkey's Law on the Protection of Personal Data (KVKK, Law No. 6698), Ata Selim is the "data controller" (veri sorumlusu) for the personal data described below. Under the EU/UK GDPR, the same role is called the "data controller."

2. What we collect

Account information: If you sign in with Google or Apple, we receive your email address (and basic profile info those providers share) to create and identify your account. If you sign in with a magic link, we collect the email address you provide.

Chat messages: We store the messages you send to the chatbot and the responses it gives, along with timestamps, so the conversation can continue naturally and so we can enforce the monthly message limit on free accounts.

Usage/event data: We log basic usage events (such as message counts per month) to run the free-tier system and understand how the service is used.

Bot-protection and rate-limiting data: We use Cloudflare Turnstile to confirm you're a real visitor rather than an automated bot. Turnstile may collect limited technical data (like browser and device signals) to do this; see the Cloudflare Turnstile Privacy Addendum for details on what Cloudflare receives. We also run a short-lived rate limiter that stores your IP address for approximately 24 hours to help prevent abuse of the service, after which it is automatically deleted.

Contact/feedback messages: If you use the contact form, we store the message you send (and your email address, if you provide one) so we can read and respond to it.

Cookies and similar technologies: Our authentication provider (Supabase) uses cookies and/or browser local storage to keep you signed in between visits. We do not use advertising or cross-site tracking cookies. You can block or clear these through your browser settings, but doing so will sign you out and may prevent the chat from working.

What we do not collect: We do not process payments or collect payment card information in the current version of this service. We do not knowingly collect data from anyone under 16 (see Section 10).

  • Sunday email choice: if you tick "Send me one line from the book every Sunday" at sign-in or in your account settings, we store that yes/no choice and the date you said yes, so a weekly email can be sent to you later. It is off unless you tick it, and you can change it anytime in account settings. Deleting your account deletes this choice too.

3. Why we're allowed to process this data (legal basis)

Where GDPR or KVKK applies, we rely on the following legal bases for each type of processing:

  • Account information and chat messages: processing necessary to perform our contract with you (providing the chatbot service you signed up for), and, before you create an account, your consent to using the anonymous preview.
  • Usage/event data and bot-protection/rate-limiting data: our legitimate interest in operating the service reliably, enforcing fair usage, and preventing abuse. We believe this interest does not override your own privacy rights, given the limited data involved.
  • Contact/feedback messages: your consent, given by submitting the form.

You can withdraw consent at any time (for example, by deleting your account or simply not submitting the contact form); this does not affect the lawfulness of anything already processed.

4. How we use it

We use the data above to:

  • Provide and operate the chatbot and account system
  • Enforce the free-tier message limit
  • Detect and prevent abuse or automated misuse
  • Respond to contact/feedback messages
  • Improve the service over time

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects, and we do not sell your data or use your chat content for advertising.

5. Who we share it with, and AI processing specifically

We use the following third-party services to operate this site, each of which processes data on our behalf under their own privacy and security terms:

  • Supabase: hosts our database and handles authentication (account sign-in)
  • Lovable's AI Gateway: routes chatbot conversations to the underlying AI model (currently Google's Gemini, via Google's commercial API) to generate responses
  • Cloudflare: provides Turnstile bot protection

On AI training specifically: chatbot conversations are sent through Lovable's AI Gateway to Google's Gemini API on a paid, commercial basis. Google's terms for this commercial API tier state that customer data is not used to train or improve Google's models without separate permission, and we have not granted that permission. Separately, we have configured our own Lovable workspace to opt out of Lovable using site content for Lovable's own model training. No part of this service uses your conversations to train a public or third-party AI model for other users' benefit.

We don't share your data with anyone else, and we don't sell it.

6. International data transfers

Our service providers (Supabase, Google/Lovable's AI Gateway, Cloudflare) operate infrastructure in multiple countries, which means your data may be processed outside Türkiye or your own country, including in the United States. Where this involves transferring data out of the EU/EEA or Türkiye, we rely on the safeguards those providers make available (such as standard contractual clauses or equivalent mechanisms) to protect your data in transit and at rest. Contact us if you'd like more detail on a specific provider's transfer safeguards.

7. Data retention

We retain account and chat data for as long as your account is active, so your conversation history and monthly usage can be tracked correctly. Using "Clear conversation" in the chat hides your message history from view, but does not delete it immediately: cleared messages are retained under the same terms as your other chat data until your account is deleted or the standard retention period below applies. Contact/feedback messages are retained until resolved and for a reasonable period afterward for our records.

You can delete your account and its data yourself at any time from your Account page, or by emailing almostintunebook@gmail.com. We will act on an email request within a reasonable time and, where KVKK or GDPR applies, no later than the timeframes those laws require.

8. Your rights

Depending on where you live, you may have some or all of the following rights over your data:

  • Access: ask what data we hold about you
  • Rectification: ask us to correct inaccurate data
  • Erasure: ask us to delete your account and associated data
  • Restriction: ask us to limit how we use your data in certain circumstances
  • Objection: object to processing based on our legitimate interest
  • Portability: request a copy of your data in a portable format
  • Withdraw consent: at any time, for processing based on consent, without affecting past processing
  • Lodge a complaint: with your local data protection authority. If Turkish law applies, this is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu / KVKK Kurulu). If EU/UK GDPR applies, this is your local supervisory authority.

You always have the option to stop using the service and decline to create an account (a limited anonymous preview is available without signing in).

To exercise any of these rights, email almostintunebook@gmail.com.

A note for California residents

Based on our current size and traffic, this service does not meet the thresholds that trigger the California Consumer Privacy Act (CCPA/CPRA). We do not have $26.625M+ in annual revenue, do not process personal information for 100,000+ California consumers a year, and do not derive revenue from selling or sharing personal information. As a matter of good practice, though, we extend the same rights described above (access, deletion, and no sale of your data) to California residents regardless of legal applicability.

9. Security

We take reasonable steps to protect your data, including using established providers (Supabase, Cloudflare) with their own security practices, and access controls on our database. No online service can guarantee perfect security, so we can't promise data will never be exposed, but we work to minimize that risk.

If a data breach occurs that creates a meaningful risk to your rights or freedoms, we will notify affected users without undue delay by email, and where required by KVKK or GDPR, notify the relevant regulator within the timeframe those laws require.

10. Children's privacy

This service is intended for users aged 16 and older, consistent with our Terms of Service, and we do not knowingly collect data from anyone younger. If you believe someone under 16 has created an account, contact us and we'll remove it.

11. Changes to this policy

We may update this policy as the service evolves. Material changes will be reflected in the "last updated" date above, and where required by law, we will notify registered users of significant changes directly.

12. Contact

Questions about this policy or your data: almostintunebook@gmail.com