Privacy and data handling

1. Scope and contact

This notice describes the app, website, notifications, public sharing and support data flows for LocalTR, developed by TeknoWeb Teknoloji Dış Ticaret Ltd. Şti. Contact info@localtr.dev with privacy questions or data requests.

How is data collected?

• You provide your email and language for notifications and complete the email confirmation step yourself. This optional signup is based on your consent for one download notification; it does not grant permission for other marketing.
• If you email support, your sender address, message and necessary attachments arrive through email. This page does not itself collect a support form or identity documents.
• Local settings and captures arise on the Mac you use; public HTTP data arises over the connection when you enable sharing. You must also manage the content carried by your public link and your application's authorization.

The company's current inventory is needed to complete detailed legal bases outside notifications and controller/processor roles. One legal basis has not been assumed for every activity. You can request information about the relevant flow using the data request route.

2. Local data on your Mac

Local names, port mappings and app settings support development routing. Local certificate authority (CA) and certificate material is created for HTTPS. An HTTP capture is a request/response copy kept for inspection; it may include method, request path, duration, headers, bodies and responses.

Captures are stored in the app's local storage on your Mac and may remain after the app closes. This is not an unlimited archive; record and memory limits apply. Selected headers and particular JSON/form fields are redacted in the stored copy, without guaranteeing detection of every secret or personal field.

Review captures before sharing or replaying them. Keep private keys and credentials out of exports. Local cleanup and requesting action on server-side data are separate tasks.

3. Public relay and data transit

When a public link is enabled, a visitor's HTTP request travels through the LocalTR relay server to your Mac, and the response returns along that service path. Headers and bodies may pass through it. Storing a local capture and carrying data through a server are different operations; bodies cannot be described as never passing through TeknoWeb servers.

Connection and operational data may be processed for service operation, troubleshooting and abuse investigation. Transit does not mean every payload is persistently logged. We do not guarantee end-to-end encryption unreadable by the relay, zero logs or a specific server retention period. Use controlled test data.

Recipients and processing regions

Notification addresses are processed in PostgreSQL infrastructure, and confirmation emails in SMTP mail infrastructure. Support messages reach the contact mailbox. The planned iyzico payment flow is not open. These descriptions do not establish that all data stays in Türkiye or that no infrastructure provider has access.

The current inventory of actual provider/recipient groups, processing countries and any cross-border transfer conditions is not yet complete. We do not list unverified providers, countries or transfer safeguards. Contact us with the relevant data flow to request these details.

4. Account and license data

The customer portal is not available yet. When the account service is enabled, email addresses, session records, license-account associations, device activations and order references support authentication and ownership checks. The trial uses device identity. Private account details are not shown on public pages.

Notification signup does not create an account, license or trial. Legal bases, recipients and retention information for the planned account flow must be completed before the service opens.

5. Payment provider

The planned payment integration is iyzico; purchasing is not open yet. Provider data handling and sales documents must be completed before real payments open. Do not enter card details in support email or the LocalTR license field.

6. Website sessions, measurement and support

Account sessions

When the account service opens, necessary session cookies may be used for authentication and security. The portal being in preparation is separate from the public website being live.

Website measurement

Optional website measurement is currently disabled. No third-party advertising tracker is loaded. If enabled in the future, only daily aggregate counts are kept on our own server; this measurement does not store email, IP addresses, user agents, cookies, fingerprints or URL query parameters. Account and development pages are excluded; GPC and DNT preferences are respected.

These limits apply only to website measurement, not to mail delivery, support messages, server operational records or the Mac app's separate diagnostic channels.

Email support

Your support email address and necessary error information are processed to handle your request. Send only necessary, redacted information. Do not share passwords, session cookies, license keys, card data or a CA private key. A support email does not subscribe you to product notifications.

7. Retention, rights and data requests

Prepare your request

For a general privacy question, identify the service and what you want to learn or change. Do not send unnecessary identity documents, complete logs or private keys in an initial general question. A formal KVKK request has separate required information and delivery rules; read the procedure below. Identity is verified as necessary without disclosing another person's data.

The link opens your email app with a fixed subject only; it does not fill in personal information or send anything. Use the address manually if you have no email app. A general contact email does not by itself satisfy every formal request requirement.

Your applicable KVKK rights

• Learn whether your personal data is processed and, if so, its scope, purpose and whether it is used for that purpose.
• Learn who receives it domestically or abroad and request correction of incomplete or inaccurate data.
• Request erasure/destruction when legal conditions apply and notification of relevant recipients about correction or erasure.
• Object to adverse results arising solely from automated analysis and seek compensation for damage from unlawful processing.

Requests within the scope of KVKK are concluded as soon as appropriate and no later than 30 days; acceptance or a reasoned refusal is communicated in writing or electronically. This statutory period is not a commercial response or resolution guarantee for general technical support. Unconditional immediate deletion of every record is not promised; any necessary retention must be explained.

Send a written request to the company postal address in section 1, or a KEP request from your own registered electronic mail account to teknowebteknoloji@hs01.kep.tr. Check the communiqué's conditions for a request from an email address previously provided and registered in our system, and for other methods. Required identity/contact details and the subject of the request must be included; the general question guide does not replace them. Ordinary email is not KEP delivery.

The official guidance is in Turkish. The communiqué's method, language and required elements apply. Official guidance explains the prior controller request requirement and relevant periods for a complaint to the Board.

Local cleanup and server retention

Cleanup of captures and LocalTR-owned local records takes place on your device. Deleting the app does not establish that the helper, certificate trust and local files have been removed. The removal guide contains safety prechecks, not a verified complete cleanup procedure for every version.

Notification retention and deletion rules are below. Verified periods and deletion schedules for support messages/attachments, production operational records and relevant backups have not yet been published in this notice. Do not apply the notification's 24-hour rule to them. Identify the data class in your request so its scope and any retention obligations can be explained. Local cleanup does not immediately erase historical server data or every backup.

8. Download launch notification

Notification signup is optional and does not create an account or license. Its sole purpose is to request one email when the LocalTR Mac download opens. Your email address, selected language, consent text version and request/confirmation times are stored in our PostgreSQL infrastructure; the confirmation email is sent through our SMTP infrastructure. No advertising tracker, email open pixel or click measurement is added.

Signup becomes active only after opening the email link and pressing its confirmation button. A confirmation link is valid for 24 hours from creation; a queued confirmation delivery request is valid for 24 hours from the request time. Unconfirmed addresses and expired delivery requests are removed during subsequent applicable queue or confirmation operations while the notification service is running. No exact deletion time is promised while the service is stopped. Link secrets are stored as hashes.

A confirmed address is held solely to await the one download launch notification. Opening the unsubscribe link and removing the request deletes the address, link records and queued delivery requests. Signing up again requires a new request and confirmation. The email hash used to limit repeat delivery and technical send counters are removed during cleanup after their 24-hour validity ends; they are not used for visit measurement.

When the launch notification delivery job is completed and the list is closed, the notification list, link records, remaining delivery requests and its temporary technical records are deleted. An operator performs this closure; addresses are not moved to another marketing list.

Cannot find your unsubscribe link?

First use the complete personal unsubscribe link in your confirmation email. Opening the page alone does not delete the signup; complete the explicit removal action. If the email is lost, the link fails or removal produces an error, email us from the signup address to request removal. You do not need a new signup or confirmation to unsubscribe.

9. App diagnostics and crash reports

Routine app diagnostics

In current app source, routine diagnostics are a separate opt-in preference, off by default. They are used for limited aggregate technical counters. Host/domain/path and free-text errors are excluded from this counter payload. This scope is not a general absence-of-data guarantee for the entire app or crash content.

Separate crash reports

Crash reporting requires separate user opt-in and reporting configuration. Crash investigation may carry content different from routine counters; do not generalize the counter field limits to every crash report.

A source review is not a test of the distributed package's actual preference screen, payload or delivery. Check preferences in your installed version. Disabling a preference does not establish automatic deletion of data previously delivered to a server. Identify the channel in your data request; not every technical counter is promised to be attributable, locatable or individually erasable.

Website measurement, routine diagnostics and crash reporting are three separate controls. Disabled website measurement does not verify the other two app preferences or actual delivery.