Data controller
Under Turkish Personal Data Protection Law No. 6698 (KVKK), your personal data is processed by ImgPage acting as the data controller.
Data processed
We process email, username, and password hash; contact requests contain name, email and message. Security uses IP/network information, hashed rate-limit keys and event times. Do not send unnecessary sensitive data.
Account and service
Verify the codes sent to your current and new addresses. All sessions and API keys will be revoked after the change.
Profile name, biography, visibility and image selections are stored with your account. Profiles start hidden. A public profile exposes your name, biography and public images, never your email. Your old username is reserved for 30 days after a change.
Notification preferences and read receipts are stored with your account. The list shows the latest 50 account events from 30 days; security audit records have a separate 180-day retention period. These settings do not disable verification or password-reset emails.
Authorized account management records retain the target account, reason, previous and resulting role or access status, and revoked access counts for 180 days. Only the Project Owner can view this history.
Sharing and access
Images, filenames, sizes, privacy and expiry settings are held in private server storage; EXIF/XMP is removed. The guest-upload security cookie lasts 31 days. Quotas cover the last 24 hours; quota byte events are regularly removed after 48 hours. Access stops at expiry; failed file cleanup is retried.
Shared album invitations store recipient email, role, acceptance and access deadlines. Contributions require explicit consent; source ownership and quota remain with the uploader. Revocation, privacy changes and restoration do not reopen old publication grants. Invalid invitations, boxes and contribution records are pruned in bounded groups after 30 days once no active dependent record remains.
For link uploads our server requests your public image URL; the source can see our server IP and the requested URL. Browser session cookies and credentials are not forwarded. The raw source URL is not stored in the job database or image page. A keyed digest of URL and settings, status and image reference support retries; inactive jobs are regularly removed 7 days after their last update. The temporary download is removed after processing; your expiry, privacy and quota settings apply.
Sharing links: Anyone with this link can view even a private image. Expiry cannot exceed the image expiry. Hiding the download button does not prevent copying. Revocation closes only this link; it does not change the image visibility. Renewal invalidates the old link and opens a new one with your chosen settings. Private label, permission, expiry, version and token digest are stored. Deleted images lose their link records during regular cleanup; revoked or expired records are removed after 30 days.
Export requests retain the account, selected image IDs, format and job status; records are regularly removed 24 hours after their last update. ZIP is not stored on the server. Files saved on the recipient device cannot later be remotely recalled.
Optional API keys store a name, digest and short prefix, permissions and creation/last-use/revocation/expiry dates, not the full key. Daily counts and error outcomes of authenticated API requests are kept for 30 UTC days, without full request URLs, IPs or filenames in this report. Revoked or expired key records are removed during bounded maintenance after 90 days. API uploads share the account quota and image deletion/expiry rules.
Download another format: The stored image stays unchanged. JPEG fills transparency with white; conversion cannot restore lost detail. The file is temporary.
Albums, folders, tags and notes are private to you. Images are not duplicated.
Only reviewed, currently public images appear. Privacy or access changes require a new review.
Security
Upload limits use a signed first-party browser identity, a hashed network group and operation times. Shared-budget links between an image and its browser/network are kept for up to 30 days; no permanent device fingerprint is created. These signals do not prove a unique person or image ownership. Old failed, never-completed uploads are removed after 30 days once physical remnants and linked work are ruled out.
Abuse review may restrict uploads or new registrations from a network for up to 7 days. The restriction list stores keyed network hashes, not plain IP addresses. Expiry ends enforcement and maintenance removes the hash. The administrator, reason category and time remain in the audit log for 180 days. Shared-network users may be affected; this restriction does not block sign-in, support or existing images.
Sign in · Create account · Forgot password · Account status · Contact. Complete verification before submitting. Cloudflare may process network and browser information for this check. Cloudflare
Upload IP addresses are encrypted; access expires after 7 days and scheduled cleanup deletes them. Only the Project Owner can reveal them with recent authentication and a reason. Access logs contain no IP address and are retained for 180 days. Short-lived IP records are excluded from system backups.
Restrictions and reports
Explain why the decision should be reviewed. An appeal does not automatically restore access or extend retention. An appeal outcome does not automatically change access. Access decisions are separate and require a reason.
In the active system: Content reports are kept for review: up to 90 days after closure and at most 180 days from creation. Pseudonymous identifiers used for duplicate checks are cleared after 7 days. Avoid sharing unnecessary personal information.
Moderators can manage reports only for publicly available images. Private or link-only content, IP information, account management and permanent deletion are restricted to the Project Owner.
Suspension does not extend retention. Quotas and normal deletion rules still apply. Expired images cannot be restored. Private share links are revoked and album contributions require renewed approval. Lifting suspension does not revive them automatically.
Administrator image deletion decisions retain the acting account, image ID, reason and time for 180 days. These records contain no image copy or upload IP address; only the project owner can review and export them.
Authorized image review records retain the Project Owner, image ID, reason and time for 180 days. Review does not change normal sharing permissions, view counts or retention; it creates no separate permanent image copy.
Support
To track and respond to your request, we process its reference number, correspondence, and the delivery status of email notifications. The request and related records are retained for 30 days from submission. Separate technical records used to investigate errors include a tracking code, the event time, and technical error details. These records are retained for 7 days.
Processing purposes
Data is used to create accounts, verify email, provide secure sign-in, prevent abuse, respond to requests and meet legal obligations. Your personal data is not sold.
Recipients and services
We share your personal data with providers only as needed for services such as hosting, security and email delivery. If a legal obligation or a binding request applies, we may disclose the necessary data to competent public authorities. Domestic transfers are subject to Article 8 of Türkiye’s Personal Data Protection Law (KVKK), and international transfers are subject to Article 9.
The hosting provider stores account and service records and locally saved images on the London server. A cloud storage provider in Central Europe stores images routed there and encrypted system backups.
The network security and content delivery provider handles web requests and delivers images. The form verification service may process network and browser information.
The email delivery provider processes recipient addresses and message content to deliver email. Incoming mail services route and deliver messages sent to ImgPage. When an administrator requests a translation, selected blog and SEO text is sent to the translation provider. Visiting a page does not start a translation.
On some public pages, the page type and language are sent to Google Analytics. This measurement uses no analytics cookies. Select necessary only below to stop it.
Cookie preferencesSecurity
Passwords are not stored as plain text. Access controls and attempt limits apply; no system is guaranteed completely secure. Report suspicious access to [email protected].
Retention and deletion
Records are removed by regular cleanup after the periods in the table. Account and terms-acceptance records remain during the account relationship; deletion requests are reviewed separately. Mailboxes, legal requests and image/backup retention are explained separately for their purposes and obligations.
Duration
Random image and object identifiers and the deletion time are kept in a separate security record to prevent deleted images from reappearing after recovery. It contains no image bytes, filename or deletion-link secret. It is retained while backup restoration could restore the image.
Unlimited uploads have an activity condition: guest images and members’ link-only images are permanently deleted after 6 calendar months without a valid access. Each valid access restarts this period. Members’ private and public images are exempt; a shorter chosen retention period is never extended.
After verified file removal, maintenance clears filenames, notes, tags, album links and content hashes. Limited deletion, security and quota records remain. Image files are not backed up separately. Encrypted database and settings backups target the last 3 days; older snapshots are pruned only after a new backup is fully verified.
The hosting provider’s daily backup of the main disk may include images present on the server disk when the backup is taken. The provider keeps that copy for 24 hours. This copy is separate from ImgPage’s encrypted database and settings backup.
Your account and all images you own will be permanently deleted. Images owned by others in your albums are preserved. This cannot be undone. Security records and backups follow the retention policy. Restore checks prevent erased accounts from being reopened. View deletion status for 24 hours; does not grant account access.
| Data processed | Duration |
|---|---|
| Verification records | 24 hours |
| Expired or revoked sessions | 30 days |
| Security event records | 180 days |
| Contact queue copies | 30 days |
Your rights
Under KVKK you may learn whether data is processed, request information about purposes and recipients, seek correction, deletion where applicable and notification to recipients, object to automated adverse results and seek compensation for unlawful processing.
Requests and contact
Contact [email protected] from your registered email or select KVKK on the contact page. Identify the request and account; do not send unnecessary identity documents. Proportionate verification may be requested. Valid statutory requests are answered within 30 days.
Data deletion instructionsContact