Privacy

From Production is operated by PROCUX Technology Inc., Ege University Technopark, İnci Building, No. 103, Bornova, İzmir, Türkiye, which is the data controller for the information we collect. Microsoft acts as an independent controller for optional Clarity data, as explained below.

Optional measurement is your choice

Reading needs no account and no analytics consent. Google Analytics and Microsoft Clarity stay off unless you opt in. You can accept visit statistics and session recordings separately, reject both, or withdraw a choice using Privacy choices in the footer. We respect Global Privacy Control and Do Not Track signals by keeping optional measurement off. We do not run advertising tags or request advertising consent.

Essential storage:

• better-auth.session_token — set when you sign in, so the site knows who you are on the next request. Removed when you sign out.
• fp_csrf — a short-lived random value that proves a form submission came from this site. Expires in 30 minutes.
• fp_r_<post> — a mark that this browser already counted a read for one post, so the counter is not inflated by a refresh. Expires in 12 hours and contains no identifier.
• fp_privacy_v1 — local browser storage recording your two choices, their date and the notice version. It lasts 90 days and is not sent to analytics providers.
• After you accept an optional tool, fp_measurement_entry briefly preserves the referring domain across the consent reload. It contains no query string or fragment, is consumed once, and becomes invalid after five minutes.

Visit statistics — Google Analytics

If you choose visit statistics, Google Tag Manager loads Google Analytics on selected public pages. We measure page visits, campaign-link clicks and clicks through to original publishers. We remove URL query strings and fragments and reduce referring URLs to their domain. We do not send form contents, internal search terms, account identifiers or campaign briefs. Sign-in, account, invitation, payment and private campaign pages are excluded, as are signed-in visits. Google receives technical request information and pseudonymous browser identifiers. Its first-party _ga and_ga_* cookies are configured to expire after 90 days. Identifiable event and user data retention in our Analytics property is set to two months, without resetting retention on new activity; aggregate reports may remain longer.

Google Signals, advertising personalization and automatic form/search measurement are off. See how Google uses information from sites that use its services. Rejecting analytics prevents Google tags and measurement requests from loading; we do not use Google's cookieless measurement pings as a substitute for consent.

Session recordings — Microsoft Clarity

When available and separately accepted, Clarity records interactions such as clicks, scrolling and page layout on selected public pages so we can find usability problems. Page text and form values are masked. We exclude private and signed-in pages, and do not start recordings when the page or referring URL has a query string or fragment. We do not supply a name, email address or account identifier. Clarity may set _clck and_clsk cookies to associate visits, as described inMicrosoft's cookie documentation. Our consent expires after 90 days; we clear optional first-party cookies when that consent is absent or withdrawn.

Microsoft is an independent data controller. Its terms allow use of collected information to provide and improve its services, including advertising-related purposes, and use of non-personal data for research and AI development. We send advertising consent as denied and do not enable Microsoft Advertising integration. Read theMicrosoft Privacy Statement andClarity termsbefore enabling session recordings. Declining them does not affect access to the site.

Limited analytics infrastructure

Fonts and stylesheets are served from this domain. Cloudflare Web Analytics loads its privacy-focused performance beacon from static.cloudflareinsights.com. On this proxied site the browser reports aggregate visit and performance measurements through/cdn-cgi/rum. The beacon does not set a tracking cookie. Cloudflare necessarily receives the network information needed to deliver and measure the request, including the IP address visible at its edge.

What we collect when you sign in

Signing in is optional; reading needs no account. If you sign in with GitHub or Google we receive your name, email address, avatar URL and the account id at that provider. We use it to attribute what you write, to match your email domain against a verified hub, and to contact you about your account. We never receive your password.

What we collect when you do not

We retain historical vote and article-opening counters. Legacy article-opening counters use a short-lived browser cookie and an in-memory rate limit; they do not show that an article was read to completion. Our list cards instead show filtered link clicks when you open an article or its original source. We keep those totals separate from the recent clicks used for Trending.

To reduce repeated clicks, the application uses the network address transiently to create a keyed value with a rotating secret. The click-measurement tables do not store the raw address, a device fingerprint or your account identity. Repeat-prevention values are scheduled for removal after seven hours; rotating secrets expire within forty-eight hours. The cleanup job runs every five minutes even when collection is paused. Cleanup can be delayed by an outage, and backup copies follow their separate retention period.

Accepted click events retain the article, time, source category and, where applicable, the share identifier so we can show cumulative totals and compare referral sources. A daily roundup visit is recorded separately from clicks on its articles. These counts do not measure unique people or completed reading. Filters can miss automated traffic or exclude real clicks; shared or changing network addresses can also affect totals.

This first-party link measurement does not send events to Google Analytics or Microsoft Clarity and does not use their consent choice as its collection switch. We skip link measurement when supported Global Privacy Control or Do Not Track request signals are enabled. Your optional analytics and recording choices continue to control those separate tools. Opening an article does not require an account or optional analytics consent.

Posts we collect from other blogs

We read public RSS feeds. For each post we store a title, a date, up to 600 characters of excerpt and a link to the source. We do not store the body. This is publishing data, not personal data, but if a post of yours is here and you want it gone, write from an address on the domain and the feed and every entry from it are removed. No form, no argument, no retention period.

How long we keep it

Account data for as long as you have an account. Ask us to delete it and it goes, along with your votes; posts you published stay unless you ask for those too. Sessions expire on their own. Aggregate counters do not contain a person identifier. The short-lived repeat-prevention values and the retained click-event fields are described above.

Who else sees it

Our hosting provider processes the data needed to serve the site. Cloudflare provides DNS, security, content delivery and the aggregate Web Analytics measurement described above. Google and Microsoft receive the optional measurement data only when you choose the corresponding feature. Paddle acts as Merchant of Record for checkout and handles payment data under its own privacy policy — we never see a card number.

Our application servers are in the European Union. If you are outside it, your data is transferred there when you use the site. Google, Microsoft and our other providers may process data in other countries, including the United States, under their applicable terms and transfer safeguards.

Your rights

Under the Turkish KVKK and the GDPR you can ask what we hold about you, ask for a copy, ask us to correct it, and ask us to delete it. Write tocontact and we answer from the same address. You can also complain to your local data protection authority.

Changes

If this page changes we update the date at the top. If a change matters — a new processor, a new category of data — we say so here rather than leaving you to spot it.