Privacy policy

1. Controller

Ailiniyazi Maimaiti, Gustav-Heinemann-Ring 131, 81739 München, Germany. E-mail: contact@turkicnames.com. A data protection officer is not required and has not been appointed.

2. Hosting and server logs

The website is hosted on servers of Hetzner Online GmbH in Germany and operated with the self-hosted deployment software Coolify. When you open a page, the server automatically processes technical data that your browser sends: IP address, date and time, requested URL, referrer, browser and operating system. This is necessary to deliver the website and to keep it secure (Art. 6(1)(f) GDPR; our legitimate interest is a stable and secure service). Server logs are deleted after 7 days. We have a data processing agreement with the hosting provider (Art. 28 GDPR).

3. Cookies and local storage

Visitors receive no cookies. The “Save to shortlist” feature stores the names you save in your browser's local storage on your own device. Swipe progress and Name Match room keys are stored the same way (see section 5a). This happens only when you click the bookmark button, the list never leaves your device unless you choose to share a link, and you can delete it at any time (“Clear shortlist” or your browser settings). This storage is strictly necessary for a function you explicitly request (§ 25(2) no. 2 TDDDG); no consent banner is therefore required. A strictly necessary session cookie is set only for editors who log in to the protected editorial area.

4. Usage statistics without cookies

We count, per day and in aggregate, how often name and language pages are opened and how many searches return no results. We store only the event type, the page identifier (for example the name “elif”) and a counter: no IP address, no cookie, no device identifier, no profile. Search terms that returned no result are kept as aggregate counts for at most 90 days so that we can add missing names. Legal basis: Art. 6(1)(f) GDPR (improving the reference). No external analytics service is used. Should we add a cookieless analytics tool in the future, this policy will be updated before it goes live.

Our own statistics page counts, per day and in aggregate, page views by page type and language version, searches and searches without a result, name views, likes, shortlist saves, swipes, generator runs, Name Match rooms started, contact messages and pages that were not found. For this, your browser sends a small request when a page is shown that contains only the page address and, for a few actions, the action type. We store a counter per day and, for names and 404 addresses, the page identifier; for searches, the normalised query text for at most 90 days, after which only the day total remains. We do not store IP addresses, user agents, cookies or visitor identifiers, we do not count unique visitors, we ignore known crawlers, and we do not count anything when your browser sends Do Not Track or Global Privacy Control. Legal basis: Art. 6(1)(f) GDPR (running and improving the reference without profiling).

5. Correction suggestions

If you use “Suggest a correction”, we store the text you enter (the statement, your suggested correction, an optional reference URL and explanation) and the page it refers to. We do not ask for your name or e-mail address. The data is used only to check and improve our entries (Art. 6(1)(f) GDPR) and is deleted at the latest six months after the suggestion has been reviewed. To prevent abuse, requests are rate-limited using a short-lived, hashed form of the IP address held only in memory.

5d. Names we could not find

To learn which names are missing, we keep a counter of search terms that returned no or very few results, of name-page addresses that do not exist (for example /names/example-name/) and, where a search engine passes it on, of the search term that led to such an address. For each normalised term we store the text itself (at most 60 characters), how often and when it was last seen, the language version of the site and an editorial status. Terms that look like web addresses, e-mail addresses, phone numbers or whole sentences are discarded. We store no IP address, user agent, cookie or device identifier with these counters, requests from known crawlers and visitors who send a Do Not Track or Global Privacy Control signal are not counted, and a short-lived hashed form of the IP address held only in memory limits abuse. Legal basis: Art. 6(1)(f) GDPR (improving the reference). Counters marked as spam or ignored, and one-off terms that nobody has requested again, are deleted twelve months after they were last seen.

5b. Contact form

If you write to us through the contact form, we store the topic you choose, your message and, only if you type them, your name and e-mail address. An e-mail address is optional and is only used to answer you. We do not store your IP address or user agent with the message; to prevent abuse, sending is rate-limited using a short-lived, hashed form of the IP address held only in memory. Messages are read by the operator in the protected editorial area and are deleted once they have been handled, and at the latest twelve months after receipt. Legal basis: Art. 6(1)(f) GDPR (answering enquiries), or Art. 6(1)(b) where you ask about the service. If you write to us by e-mail instead, the message and your address are kept for as long as needed to answer you.

5c. Likes

The heart on a name is a public “like”; the bookmark is your private shortlist (section 3). When you press the heart for the first time, your browser creates a random token and keeps it in its local storage (key tn-client-v1); the names you liked are cached in the same place (key tn-likes-v1). The token is sent to our server as a request header only when you like, unlike or look up like counts. The server never stores the token itself: it stores a one-way hash of the token combined with a secret that only the server knows, together with the name you liked and the time. That is enough to keep one like per browser per name and to show the total, and not enough to recognise you. We store no IP address, user agent or account with a like; to prevent abuse, the number of likes per minute is limited using a short-lived, hashed form of the IP address held only in memory. Pressing the heart again removes your like. Deleting your browser's local storage creates a new anonymous identity, and the old likes then remain as part of the total. Legal basis: Art. 6(1)(f) GDPR (showing which names are liked, and keeping the feature secure).

5a. Swipe progress and Name Match rooms

Swiping on your own. The page “Swipe & Match” keeps your progress (which names you kept or passed, and the order seed) in your browser's local storage under the key tn-swipe-v1, and your kept names in the shortlist (tn-shortlist-v1). Nothing is sent to our server for this. You can delete it with “Reset my progress” or in your browser settings.

Name Match. If you press “Invite someone” we create a room. Without any account or e-mail address, a room stores: a random token that forms the private link (192 bits, not guessable), the deck settings you chose, an optional first name for each member (free text that you type; please do not enter a surname or any other personal detail), a hashed secret per member, each member's kept and passed names, optional notes (up to 200 characters) and 1 to 5 scores on names, and timestamps. If you start a room with the names from your shortlist, those names are stored as your first keeps. We do not store your IP address, user agent or e-mail address with a room. To prevent abuse, room creation and joining are rate-limited using a short-lived, hashed form of the IP address held only in memory.

Other members of a room see only: the optional first names and how many names each member has swiped, the names that every member kept, and the scores and notes on those names. A name that someone passed on, or that someone has not seen, is never sent to the other members. Anyone who has the link can join until six members have joined, so share it only with the people you want to decide with. Your browser keeps the secret key for each room in local storage (key tn-rooms-v1); if you delete it, you can no longer open the room as that member. Rooms and everything in them are deleted automatically after 90 days without activity. Legal basis: Art. 6(1)(b) and (f) GDPR (providing the function you requested, and keeping it secure). Because the stored entries contain no direct identifiers other than a first name you may choose to type, we do not collect further personal data for this feature.

6. Fonts and external content

All fonts are served from our own server; no requests are made to Google Fonts or other font services. Pages contain links to external sources such as Wiktionary, Wikidata and Wikipedia. These sites are only contacted if you click a link; their own privacy policies then apply.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). To exercise them, contact us at the address above.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

8. Advertising

The website currently shows no advertising. If this changes, we will use a certified consent management platform and update this policy beforehand.