Data controller
The data controller for your personal data is Kadans (kadansapp.com).
For any question or request about your personal data: destek@kadansapp.com
What data we process
- Account: name, email address, password (only a one-way hash is stored; we can't see your password), email verification status, account creation and last activity time.
- Sessions and security: IP address, browser and device information, approximate country and city derived from the IP address, session records; short-lived request counters to prevent abuse.
- Profile (optional): username, display name, short bio, profile photo, province and district, date of birth, gender, language preference. You can leave these empty and change or delete them at any time.
- Kadans for Zwift app: when you link the app to your account, a one-way hash of your computer's hardware ID (the raw ID never leaves your computer), device name, operating system, app version, last seen time, IP address and approximate location. The app does not access your Zwift account and never reads or sends your Zwift password or ride data.
- Donations: payments are taken by Lemon Squeezy; your card details never reach us. From Lemon Squeezy we receive your email, name, amount, currency, transaction and subscription IDs and status. We use them to manage your supporter badge and (unless you turn it off) your name on the supporter wall.
- Contact form: name, email, the topic you choose, your message and the page language.
- Notify list: email address, the release you're waiting for (e.g. Windows) and language.
- Site statistics (only with your consent): via Google Analytics, pages visited, visit duration, approximate location (country, city), device and browser type, and the referring site. See the Cookie Policy for details.
Purposes and legal bases
| Purpose | Legal basis (KVKK art. 5 / GDPR art. 6) |
|---|---|
| Creating your account, letting you sign in and link the app to your account | Performance of a contract |
| Account emails (email verification, password reset) | Performance of a contract |
| Security, preventing abuse and unauthorised access, managing your devices | Legitimate interest |
| Managing donations and supporter status | Performance of a contract; legal obligation |
| Replying to your messages | Legitimate interest |
| Sending a one-time announcement when the release you're waiting for is out | Consent (given by submitting the form) |
| Optional profile information | Consent |
| Site usage statistics (Google Analytics) | Consent (cookie banner) |
You can withdraw your consent at any time; this does not affect processing carried out before you withdrew it.
International transfers
The servers of the providers above may be located outside Turkey (mainly in the EU and the US), so your data is transferred abroad. Transfers are made in line with Article 9 of the KVKK and only as far as needed to provide the service. Transfers for Google Analytics are based on the consent you give in the cookie banner.
How long we keep data
- Account and profile: while your account is open; deleted within 30 days of a deletion request.
- Sessions: up to 30 days; ended immediately when you sign out or remove a device from your account.
- Request counters: a few minutes.
- Contact messages: up to 2 years after the matter is closed.
- Notify list: up to 1 year after the announcement is sent, or immediately on request.
- Donation records: for the retention periods required by law.
- Google Analytics data: 14 months.
Your rights
Under Article 11 of the KVKK (and the GDPR, where it applies) you have the right to:
- learn whether your personal data is processed and, if so, request information about it,
- learn the purpose of processing and whether it is used accordingly,
- know the third parties in Turkey or abroad to whom it is transferred,
- request correction of incomplete or inaccurate data,
- request deletion or destruction of your data under the conditions of the law,
- request that corrections and deletions be notified to third parties the data was transferred to,
- object to an outcome against you that results solely from automated analysis,
- claim compensation if you suffer damage from unlawful processing,
- and, under the GDPR, to data portability and to restrict processing.
You can correct your profile yourself on the Profile page of your account. For other requests, or to delete your account, write to destek@kadansapp.com from the email address registered to your account; we reply free of charge within 30 days. If you're not satisfied with our reply you can complain to Turkey's Personal Data Protection Authority or, in the EU, to your local data protection authority.
Security
Connections are encrypted with HTTPS. Passwords and hardware IDs are stored only as one-way hashes. Only authorised administrators can access the data. You can see the devices linked to your account and sign them out with one click.
Children
Kadans is not intended for children under 16. If you are under 16, ask a parent or guardian for permission before creating an account.
Changes
When we update this notice, the date at the top of the page changes. If an update significantly changes how we process your data, we'll also let you know at the email address registered to your account.