1. Who is responsible for your information
Erkan Eroğlu, an individual based in Türkiye, operates Kutu Bookmark and is responsible for the personal information processed to provide it. This Policy covers kutu.link, the Kutu web application, Kutu mobile applications, and the Kutu browser extension. Contact [email protected] for privacy questions and requests.
2. Information we process
Account information. When you sign in, we process identifiers and account information supplied by your sign-in provider, such as your email address, name, profile image, provider, and account identifier. Authentication tokens and session information help us verify access. Kutu does not need your Google or Apple account password.
Browser extension. When you choose to save a page or enter a link, the extension processes its URL, title, description, and preview image, together with your selected collection, tags, and private-save choice. It connects to your signed-in Kutu workspace after you approve the connection there. The extension remembers connection and language preferences in browser extension storage; it does not keep a separate bookmark library or copy your account's sign-in tokens into that storage. It requests temporary access to the active page when you use it and host access to Kutu for the workspace connection. It does not automatically transmit your entire browsing history. Premium eligibility is checked by the server before an extension private-save request is accepted.
Your library. We process the links you save, titles, descriptions, notes, preview images or image references, collections, tags, favourites, private-bookmark settings, and associated creation, modification, and deletion information. We also process workspace preferences, automation rules, and sync information needed to keep your devices consistent.
Technical and security information. Web hosting, application, and security systems process information such as IP addresses, browser or device details, request times, requested paths, errors, and security events to deliver and protect the Service. Cloudflare may process request information and use security mechanisms when handling traffic to the website.
Mobile usage analytics. The mobile application uses Google Analytics to understand usage and improve Kutu. Depending on the analytics configuration and device permissions, this can include app interactions, device or app identifiers, device characteristics, app version, and approximate location information derived by the provider. Aggregated reports do not necessarily mean that all underlying data is anonymous. Google's explanation of how its services use information is available at policies.google.com/technologies/partner-sites.
Support and purchases. If you contact us, we process your message, contact details, and information necessary to address it. Where you purchase a mobile subscription, purchase and entitlement systems process transaction references, product identifiers, subscription status, and related account identifiers. The store or payment provider handles its own payment information.
3. Why we use information
We use account and library information to authenticate you, save and organise your content, apply your settings and rules, and synchronise authorised devices. We use technical information to operate the Service, prevent abuse, investigate problems, and protect accounts. Support information helps us answer requests. Purchase information helps establish and maintain access to paid features. Mobile analytics helps us understand how the app is used and where it needs improvement.
The mobile application does not display advertisements. This does not mean that analytics collection is disabled or that analytics data is inherently anonymous.
4. Legal grounds
Depending on the processing and the law that applies, our grounds include steps necessary to enter into or perform our service agreement, compliance with legal obligations, and legitimate interests such as service security and troubleshooting where those interests do not override your rights. Processing that legally requires consent must be subject to a separate valid consent mechanism. Accepting the Terms or reading this Policy is not consent to optional analytics or every other processing activity.
Under Türkiye's Personal Data Protection Law No. 6698, the corresponding grounds may include necessity directly related to establishing or performing a contract, fulfilment of a legal obligation, establishment or protection of a right, legitimate interests subject to your fundamental rights and freedoms, and explicit consent where required. The applicable ground must be assessed for each activity; this Policy does not itself obtain explicit consent.
5. Cookies and storage on your device
The website uses cookies and browser storage for authentication, session continuity, language preferences, appearance and workspace preferences, and local library or synchronisation state. For example, the language-preference cookie may remain for up to one year, and an account-presence hint may remain for up to 30 days. An authentication cookie's lifetime is tied to the verified session. Browser-stored caches and pending changes can remain until cleared or removed by the application.
The neutral home address may use your saved language choice or the language preferences sent by your browser to select a language route. Kutu does not directly read your operating system's language setting.
Browser controls let you remove or restrict storage. Doing so may sign you out, reset preferences, or remove local data and changes that have not synchronised. Export or synchronise important material first. Mobile analytics identifiers and storage are governed by the app's actual settings and applicable device controls; they are separate from website language cookies.
6. Recipients and external websites
Information is processed by providers needed to operate Kutu. These include Google Firebase for authentication, hosting and infrastructure providers such as Spaceship, Cloudflare for traffic delivery and security, and Google Analytics for mobile usage measurement. Apple or Google may process information when you use their sign-in or purchase services. Subscription-management providers may process entitlement and transaction information where used by the mobile application.
When Kutu fetches a saved link's metadata or imports a public source you select, the destination website or preview endpoint receives a request identifying the requested resource and technical connection information. A direct preview-image request from your device can also disclose your IP address to that image host. URLs can themselves contain personal information or access tokens; avoid saving or submitting secret links unless necessary and appropriate.
We may disclose information when legally required or when reasonably necessary to protect rights, investigate abuse, or respond to a security incident. If ownership of the Service changes, any transfer of personal information must remain subject to applicable law and appropriate notice. Publicly accessible links do not make your Kutu library public.
7. International processing
Kutu is operated from Türkiye. Infrastructure, authentication, analytics, and store providers may process information in other countries, whose laws can differ from those where you live. The locations and applicable transfer arrangements depend on the provider and service configuration. Contact [email protected] for information about the recipients and transfer arrangements relevant to your information. Publishing this Policy or using Kutu does not itself constitute consent to a transfer that legally requires separate consent.
8. Retention and deletion
We retain account and library information for the operation of your account and the purposes described here. Retention must be limited to what is necessary, taking account of the account's status, support needs, applicable legal obligations, security needs, and the establishment or defence of legal claims.
You can request account closure or deletion at [email protected] using the steps in Delete Your Kutu Account. Deleting a bookmark or moving it to Trash is not necessarily immediate erasure from all devices, sync records, or backups. Some information may need to be retained for a specific legal obligation, security purpose, or legal claim. Residual backup copies are subject to the backup-retention cycle rather than immediate removal from every copy. We must remove or de-identify information when it is no longer needed. You may ask us about retention applicable to your account and any exception affecting a deletion request.
Signing out, uninstalling an app, or clearing your browser does not itself delete your server-side account. Account deletion does not necessarily cancel an app-store subscription; manage renewal with the purchase provider.
9. Security and private bookmarks
Kutu uses access controls and encrypted network connections to help protect information. A private-bookmark PIN adds an access restriction within the Service. It is not a claim that Kutu is end-to-end encrypted or that the operator cannot process saved content. No system can guarantee absolute security. Keep your sign-in account, devices, and PIN secure, and report suspected unauthorised access to [email protected].
10. Your choices and rights
Depending on your location and applicable law, you may have rights to receive information about processing, access or correct information, request deletion or restriction, object to certain processing, receive portable data, and withdraw consent without affecting processing that was lawful before withdrawal. Exceptions may apply, and we may request proportionate information to verify your identity.
Under Article 11 of Türkiye's Law No. 6698, rights include learning whether information is processed, requesting information about processing, learning its purposes and whether use is consistent with them, learning recipients in Türkiye or abroad, requesting correction and deletion where legal conditions are met, requesting relevant notifications to recipients, objecting to an adverse result arising exclusively from automated analysis, and seeking compensation for damage caused by unlawful processing.
Send requests to [email protected], preferably from your registered email address. We will review your request and respond with the outcome as soon as possible and no later than 30 calendar days after receiving it, or sooner if required by applicable law. We may need to verify ownership before disclosing or deleting information, and we will explain any applicable exception. You may also complain to the competent data protection authority, including Türkiye's Personal Data Protection Authority or, where applicable, the authority in your country of residence. Statutory complaint procedures and conditions remain applicable.
Export tools are available in the web workspace for supported library formats. A library export may not include every account, security, or subscription record; contact us for a broader access request. The current web application does not provide a working self-service account-deletion control, so email us for account-deletion requests.
11. People under 18
Kutu is intended for people aged 18 and over. People under 18 must not create an account or use the Service. If you believe someone under 18 has provided personal information, contact [email protected]. We will assess the report, restrict an ineligible account as appropriate, and take the steps required by applicable law to remove information that should not be retained. The age condition does not eliminate our obligations concerning any personal information actually collected.
12. Updates and contact
We will publish changes with an updated effective date and provide appropriate notice of material changes. If a new use requires consent, a revised Policy alone will not substitute for obtaining it.
Privacy contact and operator: Erkan Eroğlu, Türkiye — [email protected].