Privacy and your data

Data controller and contact

The data controller is the individual living in Türkiye who develops and provides Galescope in their own name. The contact address for support and personal data requests is info@galescope.com. Galescope is the name of this individual’s project.

This notice describes data processing in the current application. Reviews of final retention periods for some records and the international transfer mechanism have not yet been completed; these outstanding matters are stated in the relevant sections below.

The notice explains how your information is processed; it is not a consent form. Acceptance of the terms is not interpreted as explicit consent to every kind of personal data processing.

Information and purposes

Google Cloud sign-in provides the Google account identifier, name, verified email and profile picture information if supplied. These are used for authentication, account creation and session operation; your Google password is not received. Local workspaces do not require a Google account.

Uploaded Cloud content and editing records are processed to store content and provide the workspace. Quota, protection mode, operation records, session/activity information and gift, invitation or coupon usage are processed for capacity management, support, correct rewards and abuse prevention. High Protection encrypts workspace content; account and operational information continues to be processed separately.

Hosting infrastructure may process technical data such as IP addresses, requests and browser information during connections. Information you send for support is processed to resolve your request. Local folder files are not uploaded to Cloud during normal Local use; URL previews and external links are network operations separate from this local file storage.

Collection methods and legal bases

Information is collected electronically through Google sign-in responses, browser and web requests, user uploads and edits, and direct support requests.

Processing relies on necessity directly related to establishing or performing a contract for accounts, sessions, content storage, quota/reward functions and related support; legitimate interests that do not harm fundamental rights for proportionate access security and abuse monitoring; and establishing, exercising or protecting a right for specific dispute records. These are assessments under KVKK Articles 5/2-c, 5/2-f and 5/2-e respectively. If processing follows a legal obligation, the relevant obligation and scope must be identified separately. Processing that requires explicit consent needs a separate, informed and freely given choice.

Service providers and international transfers

Cloudflare infrastructure serves the website, stores account and operation records in a database, stores Cloud files and processes supported images. Standard Protection content may be processed to operate the service; High Protection content is sent encrypted to Cloud. Account and service operation information is outside content encryption.

Google provides authentication when Google sign-in is selected. Galescope receives the Google account identifier, name, verified email and profile picture information if supplied. External link and preview features may also send requests to the relevant websites. Support emails are also processed by mail service providers. Disclosure to competent authorities is considered only within valid legal requirements and scope.

Use of these services may result in processing outside Türkiye; there is no commitment to store all data only in Türkiye. Review of recipient providers’ contracts, processing regions and the transfer mechanism under KVKK Article 9 has not been completed. Accepting these terms does not give general permission for international transfers.

Browser storage and advertising choices

The galescope_session cookie used for Cloud sessions lasts up to 7 days and is removed at sign-out. Browser storage also holds language, theme, workspace, cache, Local terms acceptance and High Protection device-key records. These are not all cookies and do not share one expiry period. The device key remains after sign-out; clearing site data may remove this remembered access.

The Galescope application code does not currently run live advertising or visitor analytics scripts. Advertising cards in the test environment are layout previews only. Showing the Google sign-in button connects to Google’s authentication component. Purposes, retention, external services and the effects of clearing storage are described in the separate cookie notice.

Before real advertising is activated, the required consent and preference controls will be established and providers, purposes and retention periods disclosed. Acceptance of these terms does not give advertising or analytics permission.

Read about cookies and browser storage

Retention and deletion

Local files remain in your selected folder; deleting and backing up that folder is under your control. Cloud files, account and quota information are retained to provide the service. When account deletion completes, Cloud files, the account profile, its quota history and related workspace records are removed. Physical file cleanup is gradual; connection or infrastructure failures may require retries.

The session cookie is valid for 7 days. Technical blocking records for revoked sessions are removed during the relevant cleanup pass after the session validity period expires. Online status records are cleaned up at the next status update after 2 minutes without activity. These are not promises that every record is deleted at an exact second.

Some completed or cancelled storage operations and unused encrypted object records are compacted during maintenance after 30 days when cleanup conditions are met. Technical operation identifiers preventing replay of old operations may remain. This 30-day threshold is not a common retention period for files, support correspondence or all personal data.

After account deletion, the Google account identifier and access status may remain to keep old sessions invalid. If an email access ban applies, the email record may also remain to maintain it; otherwise the email is removed from that access record when deletion completes. The deleted account’s direct link is removed from invitation and coupon history; operation history may remain. Removing that link alone does not mean every record is anonymous.

This review does not contain a verified final retention and deletion schedule for remaining access/operation records, support correspondence or infrastructure logs/backups after account closure. This disclosure does not mean those reviews are complete or that all legal obligations have been fulfilled.

Your rights and requests

Under KVKK you have rights to learn whether your data is processed, obtain information about processing, purposes and transfers, correct inaccurate or incomplete information, and request deletion/destruction and notification to relevant recipients when the conditions apply. Rights to object to adverse outcomes from automated analysis and seek compensation for unlawful processing are also reserved.

Send support and personal data requests to info@galescope.com. For a Cloud account request, writing from the Google email registered in the system helps match your account. Explain your request and the relevant account or operation; formal KVKK requests are subject to the mandatory information and procedures in the relevant Communiqué. Email matching alone is not identity verification for every operation; where necessary, only enough additional information to verify the requester will be requested. Do not send passwords, recovery keys or private files unrelated to the request.

Requests are answered as soon as possible according to their nature and within 30 days at the latest. They are generally free; where additional costs arise, only the tariff set by the Board may apply. Reasons are given for rejection. Other legal remedies remain available. For a complaint to the KVKK Board, the data controller must be approached first; note the complaint periods of 30 days from learning the response and, in all cases, 60 days from the initial request.