Data controller
keremcep.dev and its applications are developed and operated by Kerem Çep. For any question or request about personal data: info@keremcep.dev
This website
keremcep.dev is an informational, static website. It uses no cookies, no visitor tracking or advertising tools, and collects no data through forms. All files, including fonts, are served from this site; no requests go to third-party servers when a page loads.
The site is served through Cloudflare. To deliver the site and protect it against attacks, Cloudflare processes technical records such as IP address, browser information and request time under its own privacy policy.
Sign in with Google (auth.keremcep.dev)
Internal tools under keremcep.dev are accessed by signing in with a Google account. Access is limited to pre-authorized people; currently only Kerem Çep can sign in. If someone tries to sign in with another Google account, no account is created and no access is granted.
| Data received | The Google account's name, email address and account ID (openid, email, profile scopes) |
|---|---|
| Purpose | Authentication and preventing unauthorized access |
| Security records | Sign-in time and IP address, kept for at most 1 year to detect abuse |
| Sharing | Not shared with any third party |
Google Drive backups
Data of the applications on keremcep.dev is backed up every night, and one copy of the backups is sent to Kerem Çep's
own Google Drive account. Only the drive.file scope is requested from Google: the application can see only the
backup files it creates itself and cannot access any other files in Drive. Backups are encrypted before they are sent;
nobody, including Google, can read their contents.
Use of Google API data
keremcep.dev's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data received from Google is not used for advertising, is not sold, is not used to train AI models, and is not transferred anywhere beyond the purposes described above.
Platform for the WhatsApp Business Platform (wa.keremcep.dev)
This service is in development and not yet available to other businesses. When it opens, this section will be updated and a separate data processing agreement will be signed with each business.
The platform lets businesses connect their own WhatsApp Business accounts through Meta's official flow (Embedded Signup) and forward their messages to their own software. For this service the connecting business is the controller of the messaging data; the platform processes it on the business's behalf.
| Data | Retention |
|---|---|
| Business account and phone number IDs (issued by Meta) | While the connection lasts |
| Meta access tokens | Encrypted; deleted immediately when the connection is removed |
| Raw notifications from Meta (webhooks) | Encrypted, at most 30 days |
| Delivery records | 30 days |
| Metadata of sent messages (time, status, recipient ID) | 1 year |
| Audit records | 2 years |
Message contents are not kept on the platform after they are delivered to the business's software. Phone numbers are masked in logs. Data is shared with Meta Platforms (WhatsApp Cloud API) and Cloudflare (network and security) only as needed to provide the service. Servers are managed by Kerem Çep; during development they run in Türkiye, and moving them to a server in the European Union (Hetzner, Germany or Finland) is planned.
Internal tools
Internal tools used only by Kerem Çep and closed to everyone else also run under keremcep.dev; access is protected by Google sign-in. One of these tools processes publicly available contact information of local businesses (name, address, phone, website; sourced from Google Places and OpenStreetMap) and correspondence with those businesses, in order to offer them websites. If a business requests it, its records are deleted.
Tiny Airport and Meta Data Remover
The Tiny Airport game requires no account, shows no ads and collects no data; see the game's own privacy policy. Meta Data Remover runs entirely on the user's computer; files are never sent to any server.
Security
- All connections are encrypted with HTTPS; servers do not open ports directly to the internet.
- Access keys and passwords are stored encrypted or only on the server, never alongside the code.
- Backups are stored encrypted.
Your rights
Under Article 11 of the Turkish Personal Data Protection Law No. 6698 (KVKK), you have the right to learn whether your data is processed, request information, ask for correction or deletion, and object. You can send your request to info@keremcep.dev; it will be answered within 30 days at the latest. For deletion requests, see the data deletion page.
Changes
When this policy changes, the current text is published on this page and the effective date is updated.