Data controller
Under Turkish Personal Data Protection Law No. 6698 (KVKK), your personal data is processed by ImgPage acting as the data controller.
Collection methods
Data is collected electronically through account/contact forms and browser service requests. Special-category data and unnecessary information about other people are not requested.
Data processed
We process email, username, and password hash; contact requests contain name, email and message. Security uses IP/network information, hashed rate-limit keys and event times. Do not send unnecessary sensitive data.
Account and service
Verify the codes sent to your current and new addresses. All sessions and API keys will be revoked after the change.
Profile name, biography, visibility and image selections are stored with your account. Profiles start hidden. A public profile exposes your name, biography and public images, never your email. Your old username is reserved for 30 days after a change.
Notification preferences and read receipts are stored with your account. The list shows the latest 50 account events from 30 days; security audit records have a separate 180-day retention period. These settings do not disable verification or password-reset emails.
Authorized account management records retain the target account, reason, previous and resulting role or access status, and revoked access counts for 180 days. Only the Project Owner can view this history.
Sharing and access
Images, filenames, sizes, privacy and expiry settings are held in private server storage; EXIF/XMP is removed. The guest-upload security cookie lasts 31 days. Quotas cover the last 24 hours; quota byte events are regularly removed after 48 hours. Access stops at expiry; failed file cleanup is retried.
Shared album invitations store recipient email, role, acceptance and access deadlines. Contributions require explicit consent; source ownership and quota remain with the uploader. Revocation, privacy changes and restoration do not reopen old publication grants. Invalid invitations, boxes and contribution records are pruned in bounded groups after 30 days once no active dependent record remains.
For link uploads our server requests your public image URL; the source can see our server IP and the requested URL. Browser session cookies and credentials are not forwarded. The raw source URL is not stored in the job database or image page. A keyed digest of URL and settings, status and image reference support retries; inactive jobs are regularly removed 7 days after their last update. The temporary download is removed after processing; your expiry, privacy and quota settings apply.
Sharing links: Anyone with this link can view even a private image. Expiry cannot exceed the image expiry. Hiding the download button does not prevent copying. Revocation closes only this link; it does not change the image visibility. Renewal invalidates the old link and opens a new one with your chosen settings. Private label, permission, expiry, version and token digest are stored. Deleted images lose their link records during regular cleanup; revoked or expired records are removed after 30 days.
Export requests retain the account, selected image IDs, format and job status; records are regularly removed 24 hours after their last update. ZIP is not stored on the server. Files saved on the recipient device cannot later be remotely recalled.
Retention and deletion
Random image and object identifiers and the deletion time are kept in a separate security record to prevent deleted images from reappearing after recovery. It contains no image bytes, filename or deletion-link secret. It is retained while backup restoration could restore the image.
Unlimited uploads have an activity condition: guest images and members’ link-only images are permanently deleted after 6 calendar months without a valid access. Each valid access restarts this period. Members’ private and public images are exempt; a shorter chosen retention period is never extended.
After verified file removal, maintenance clears filenames, notes, tags, album links and content hashes. Limited deletion, security and quota records remain. Image files are not backed up separately. Encrypted database and settings backups target the last 3 days; older snapshots are pruned only after a new backup is fully verified.
The hosting provider’s daily backup of the main disk may include images present on the server disk when the backup is taken. The provider keeps that copy for 24 hours. This copy is separate from ImgPage’s encrypted database and settings backup.
Your account and all images you own will be permanently deleted. Images owned by others in your albums are preserved. This cannot be undone. Security records and backups follow the retention policy. Restore checks prevent erased accounts from being reopened. View deletion status for 24 hours; does not grant account access.
Processing purposes
Data is used to create accounts, verify email, provide secure sign-in, prevent abuse, respond to requests and meet legal obligations. Your personal data is not sold.
Legal grounds
Account, verification and account-related support processing is assessed under KVKK Article 5(2)(c) insofar as necessary to establish or perform the service contract.
Security, rate limiting and abuse records are assessed under KVKK Article 5(2)(f) insofar as necessary for legitimate interests without harming your fundamental rights and freedoms.
General enquiries and feedback unrelated to an account are assessed under KVKK Article 5(2)(f), insofar as necessary for the legitimate interest of answering your request and balanced against your rights.
Legal obligations and rights requests are assessed under KVKK Articles 5(2)(ç) and 5(2)(e), as applicable. Separate activities requiring explicit consent are handled independently of account terms.
Recipients and services
We share your personal data with providers only as needed for services such as hosting, security and email delivery. If a legal obligation or a binding request applies, we may disclose the necessary data to competent public authorities. Domestic transfers are subject to Article 8 of Türkiye’s Personal Data Protection Law (KVKK), and international transfers are subject to Article 9.
The hosting provider stores account and service records and locally saved images on the London server. A cloud storage provider in Central Europe stores images routed there and encrypted system backups.
The network security and content delivery provider handles web requests and delivers images. The form verification service may process network and browser information.
The email delivery provider processes recipient addresses and message content to deliver email. Incoming mail services route and deliver messages sent to ImgPage. When an administrator requests a translation, selected blog and SEO text is sent to the translation provider. Visiting a page does not start a translation.
On some public pages, the page type and language are sent to Google Analytics. This measurement uses no analytics cookies. Select necessary only below to stop it.
Cookie preferencesInternational transfers
These services may process data outside Türkiye. The server is in London and cloud storage is in Central Europe. The translation service’s global endpoint can process requests in multiple regions. Transfers abroad are subject to Article 9 of KVKK.
Your rights
Under KVKK you may learn whether data is processed, request information about purposes and recipients, seek correction, deletion where applicable and notification to recipients, object to automated adverse results and seek compensation for unlawful processing.
Requests and contact
Contact [email protected] from your registered email or select KVKK on the contact page. Identify the request and account; do not send unnecessary identity documents. Proportionate verification may be requested. Valid statutory requests are answered within 30 days.
Contact