This policy covers the Paraboz website (paraboz.com) and the Paraboz mobile app. Both talk to the same server and the same database, so one text describes both.
In short
Paraboz is a banknote archive. You do not need an account to browse it, and while you browse without one we ask you for nothing. When you do open an account, we collect the least data the account needs to work. We do not sell your data, we do not hand it to ad networks, and the app contains no third-party advertising or tracking SDK.
What we collect
Account details
- Name — shown on your profile and in the mail we send you.
- Email address — your identity at sign-in; verification, password resets and notifications go there.
- Password — stored only as a hash. The password itself is kept nowhere and cannot be read by us.
- Language preference — the language of the interface and of our mail.
- Profile photo — optional; without one we draw your initials.
- Notification preferences — on/off for wishlist news and the monthly digest.
Data that comes from using the service
- Your collection marks — which notes you marked "owned" or "wanted".
- Your submissions — banknote photographs and details you contribute to the archive.
- Your messages — what you write through the contact form and our replies.
- Session tokens — the keys that keep you signed in on mobile, stored with the device name you gave.
Technical logs
The server keeps request logs for debugging and abuse prevention: IP address, timestamp, requested address and browser/app identifier. These logs are deleted automatically after 180 days.
Why we collect it
- Performance of a contract — opening the account, showing you your collection, publishing your submission, answering your message.
- Legitimate interest — security, abuse prevention, finding faults.
- Consent — for optional cookies and optional notifications only; you can withdraw either at any time.
There is no automated decision-making and no profiling. We collect no location data, no contacts, no calendar and nothing else from your device. The app reaches the camera and the photo library only when you pick a banknote photo or a profile picture, and reads nothing beyond the image you picked.
Who we share it with
We do not sell your data. We share it with nobody except the providers that keep the service running:
- Hosting provider — the server the site and database run on.
- Cloudflare — the proxy and security layer in front of our traffic; your IP address passes through it.
- Resend — the service that delivers our mail; it sees your address and the content of the message.
- Cloudflare Turnstile — a bot filter on form submissions. No visitor data goes to Google.
- Google Analytics 4 — only if you choose "accept all" on the cookie banner. Without consent the script is never added to the page and no request reaches Google.
If a competent authority sends a lawful request, we disclose only the data that request covers.
Cookies
Necessary cookies: the session cookie, the CSRF token and the cookie that remembers your cookie choice. The site does not work without them, so they are not subject to consent.
Optional cookies: analytics only. They are never set unless you accept them on the banner. The full list is on the cookie policy page. The mobile app uses no cookies at all.
How long we keep it
- Account data — as long as your account exists; immediately on deletion.
- Server logs — 180 days.
- Published submissions — indefinitely, but detached from your identity when you delete your account (see how to delete your account).
- Cookie choice — 6 months.
Your rights
Under GDPR and Turkish data protection law (KVKK) you may access your data, have it corrected, have it erased, object to processing, and receive a copy of it. You can edit your name, email, language and photo yourself on your account page, export your collection from there, and delete your account yourself. For anything else, write to us; we answer within 30 days at the latest.
Deleting your account
You can delete your account yourself, from the app or from the site. The steps and the exact list of what is and is not removed are on How to Delete Your Account.
Children
Paraboz is not directed at children under 13 and we do not knowingly collect data from them. If we notice such an account, we delete it.
Changes
If we update this text, this page is updated. If a change is significant, we tell members by email.
Contact
The data controller is Paraboz. For any question, request or complaint: [email protected] — or the contact form on the site.