Skip to content
Taslak
TRStart for free

Privacy policy

Updated:

This policy covers taslak.dev, the Taslak panel, API, command-line tool and the sites published on Taslak (taslak.page addresses and connected domains). It is also our information notice under Article 10 of Turkey’s Personal Data Protection Law No. 6698 (KVKK).

In short

  • Taslak hosts a file, a folder or a static site.
  • No ads, no ad tracking, and no third-party analytics on taslak.dev or in the panel. We do not sell your data.
  • Visitor statistics of sites are kept without raw IP addresses, under a pseudonymous id that changes every day.

Controller

Taslak (taslak.dev) is the controller of the data about your account. For any question about this policy or your data: help@taslak.dev.

Data on your sites: who is responsible

The files you publish and the data you collect from your sites’ visitors (the e-mail addresses of people you invite, access requests, comments, rows written to your site’s database, files visitors upload) are yours. The person or team that publishes a site is the controller of that data; Taslak only processes it on their behalf to provide the service. If you add a tool such as Google Analytics to your site, the data it processes is your responsibility too. For your data on a site, contact the site’s owner first; if you write to us, we pass the request on.

What we process

When you create an account

  • Account details: your e-mail address and when the account was created, and any other addresses you add to sign in with (up to 10), with when each was added and verified. If you set a password, only a one-way hash of it (PBKDF2-SHA256) is stored. If you turn on two-step sign-in, the authenticator secret and hashes of your backup codes are stored.
  • Leaked-password check: when you set or change a password, we send the first five characters of its SHA-1 hash to Have I Been Pwned’s Pwned Passwords service and refuse the password if it appears in known leaks. Your password, its full hash and your e-mail address are not sent.
  • GitHub: if you sign in with GitHub, we receive your GitHub account’s primary e-mail address. If you connect your GitHub account, we store your GitHub login and the access token you grant, encrypted, and use it only to publish, mirror and build the repositories you choose.
  • Sessions and security: the IP address, browser (user agent) and times of your sessions; the name, scope and last use of your API keys. Sign-in codes are valid for 10 minutes. If you let a browser skip the second sign-in step, we store that browser’s user agent and IP address and when it was last used, so that you can recognise and forget it.
  • Teams and activity: the teams you belong to and your roles, the invitations you send, and an activity log of who did what and when (including the e-mail address of who did it).
  • Notification preferences: which e-mails you do not want.
  • Inbox: notifications about your teams and sites, such as approvals, access requests, comments, new database rows, site transfers and teams you were added to: who did it, which site or team, a link and up to 1,000 characters of the content (for example the comment or the row).

When you publish a site

The files you upload, versions and their notes, the site’s git repository, build logs, your settings (access, domains, redirects, appearance), the domains you connect and webhook addresses. Source code sent for a build is deleted when the build ends. Every uploaded file is scanned for malware with ClamAV on our own servers; sites that use a file found harmful are taken down.

When you publish without an account

The IP address a version was published from is kept in the publish history for 30 days and then removed. A site published without an account stops serving 33 hours 20 minutes after its latest publish; unless it is claimed, the periods for deleted sites below apply. Your IP address is also used for rate limiting to prevent abuse.

When you visit a site published on Taslak

  • Statistics: for each request, the site’s id, the address and path requested, country, status code, bytes sent, whether the request came from a person, a search engine or an AI tool, and a pseudonymous id to count visitors. The id is a one-way hash of your IP address and browser made with a secret key and the day’s date; it changes every day and cannot follow you across days. The raw IP address is not stored in statistics.
  • Request logs: with each request we also store its HTTP method and the first 256 characters of the user agent your browser or tool sends (its name and version). The site’s team sees them, with the fields above, in the site’s request logs, to find broken links and recognise bots.
  • Restricted sites: sites opened with a password, an invitation or a share link use a single cookie, __taslak, to keep you signed in (7 days, 12 hours for previews). If you signed in with an e-mail code, your e-mail address is inside this signed cookie. When you ask for a sign-in code or send an access request, your e-mail address and message go to the site’s owner.
  • Tags and consent choice: a site’s owner can add analytics and advertising tags (such as Google Analytics or the Meta Pixel) to the site’s pages. Those tags send data to their own providers, under the site owner’s responsibility, not ours. If the owner asks for consent, your choice is kept in your browser in a cookie, taslak_consent, on the address you visited: only the categories you accepted (for example analytics) or none, with no identifier, for the period the owner set (180 days unless they changed it, at most 395). Your browser sends it with each request to that site so that we add only the tags you agreed to; we do not store it. Your country, which Cloudflare tells us for each request, decides whether you are asked when the owner asks only visitors in the EEA, the UK and Switzerland.
  • Tag previews: when a member of a site’s team opens a tag preview link, their browser gets a cookie, taslak_tags, holding only the preview’s id, until the preview ends (at most 24 hours).
  • Comments: if the owner turned comments on, your comment, your name and its place on the page are stored, and the e-mail address you give, if any, so that you are e-mailed about replies and when the thread is resolved or reopened; the site’s team sees it. Your name and address are kept in your browser for next time. A reaction you leave without signing in is stored with a one-way hash of your IP address and the site, so that you can take it back.
  • Forms and uploads: as far as the site’s owner allows, what you write to the site’s database and the files you upload are stored. Cloudflare Turnstile runs the robot check.
  • Abuse prevention: your IP address is used for at most 24 hours to rate-limit sign-in codes, access requests, uploads and database requests.

taslak.dev and the panel

taslak.dev uses no analytics or advertising cookies. The panel keeps your session key and language in your browser (localStorage).

When you pay

Polar Software Inc. sells the Go and Plus plans as merchant of record. Your name, e-mail address, billing address and card details are entered directly on Polar’s checkout and processed under Polar’s privacy policy; your card details never reach us. We keep the team’s plan, the subscription’s status and period dates, and Polar’s customer and subscription ids.

When you report abuse

The address you report, the category, your description, your e-mail address if you give one and your IP address, to review the report and to keep the form from being abused.

When you e-mail us

Your e-mail address, name and message, only to answer you and resolve what you reported.

Purpose GDPR Art. 6(1) / KVKK Art. 5(2)
Creating your account, signing you in, storing and serving your sites (b) contract / (c) contract
Sending sign-in codes, invitations, approvals and notifications (b) contract / (c) contract
Showing site owners visit statistics and request logs (f) legitimate interests / (f) legitimate interest
Security, abuse prevention, finding bugs, the activity log (f) legitimate interests / (f) legitimate interest
Running subscriptions and plans (b) contract / (c) contract
Lawful requests of competent authorities (c) legal obligation / (ç) legal obligation
Answering support, deletion and abuse reports (b) contract, (f) legitimate interests

We do not use your data for marketing, profiling or advertising, and we do not sell it.

Where it is stored and who receives it

  • Our servers: the API and database run in Hetzner Online GmbH’s data center in Helsinki, Finland, inside the European Union.
  • Cloudflare, Inc. (USA): serves published sites from its global network; stores site files, git repositories, visitor uploads and database backups in Cloudflare R2 and site databases in Cloudflare D1; keeps visit statistics (Workers Analytics Engine); runs cloud builds; provides the robot check (Turnstile), DNS and certificates for domains; carries taslak.dev and api.taslak.dev traffic.
  • Amazon Web Services (Amazon SES): sends sign-in code, invitation and notification e-mails from the EU’s Ireland region (eu-west-1); processes the recipient address and the e-mail’s content.
  • Polar Software Inc. (USA): sells the Go and Plus subscriptions as merchant of record and takes payment. Polar is the controller of payment details under its own privacy policy.
  • GitHub, Inc. (USA): only if you sign in with GitHub or connect your GitHub account and repositories.
  • Have I Been Pwned: receives from our servers only the first five characters of the SHA-1 hash of a password you set, to check it against known leaks.

Some of these providers are outside Turkey, so this is a transfer abroad under Article 9 of KVKK. The providers process data only on our behalf and for the purposes in this policy.

How long we keep it

Data Period
Account details While your account exists
Sessions and API keys Sessions last at most 90 days; ended or revoked sessions and keys are deleted 30 days later
Additional e-mail addresses Until you remove them or delete your account
Trusted browsers 30 days, or until you forget them or turn the authenticator app off
Inbox entries 180 days
Sites, versions and files Until you delete them
Deleted sites Restorable for 30 days; then their files, versions, git repository, database and visitor uploads are deleted
Deleted versions The address stops at once; files no version uses are deleted within 7 days
Unfinished or failed uploads 7 days
IP addresses of publishes without an account 30 days
Activity log 1 year
Webhook delivery records 30 days
Visit statistics and request logs 90 days
IP addresses used for rate limiting 24 hours
Copies in database backups At most 30 days

You can delete your account in the panel under Sign-in and security → Delete my account. Deleting it removes your sessions, keys, additional e-mail addresses, trusted browsers, inbox, connected GitHub account and the teams that are yours alone with their sites; site files are cleared on the schedule above. If you are the only owner of a team you share with others, transfer ownership first; if one of your teams pays for a plan, cancel it first. Your e-mail address stays in activity logs until their 1-year period ends.

Your rights

You may ask us for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. Under KVKK Article 11 you may also learn whether your data is processed, its purpose, the third parties it is transferred to in Turkey or abroad, ask that corrections and deletions be passed on to them, object to a result against you produced only by automated analysis, and claim compensation for damage from unlawful processing.

You can download a copy of your account data as JSON in the panel under Sign-in and security → Download my data. Send other requests from your account’s e-mail address to help@taslak.dev. We answer free of charge within 30 days. You may also complain to the supervisory authority where you live, or to Turkey’s Personal Data Protection Board.

Children

Taslak is not meant for anyone under 18.

Changes

When we change this policy we update the date on this page. We announce important changes in the panel or by e-mail.