Privacy and user data

In short

• Audit results are never written to storage; nothing remains on the server once the response is sent.
• There are no accounts, logins, mailing lists or report histories.
• The strictly necessary cookie counts your free audits for the day — three of them. It holds a date and a number; it carries no identity, no address and nothing about the audit.
• Using the Search Console dashboard adds two more cookies. You only get them if you choose to connect it; the audit tool does not need them.
• No browser storage (localStorage, sessionStorage) is used.
• No analytics, advertising or tracking script is loaded.
• Fonts are served by Google Fonts, so your browser’s IP address reaches Google. Details below.

The Search Console dashboard and your Google data

If you choose to connect the dashboard, we ask Google for read-only access (webmasters.readonly). That lets us read your list of properties and their search performance totals — clicks, impressions, CTR, average position. It cannot submit sitemaps, delete properties or change anything: the scope does not permit it.

The refresh token Google issues is held only in a cookie in your own browser, encrypted with AES-256-GCM. It is never written to a database, a record or a log on the server; it is read from the cookie on each request and dropped when that request ends. That means we do not hold your credential — and it also means a browser carrying that cookie can open the dashboard.

Nothing that comes back from Search Console is stored. The table you see is that request’s response; reloading the page fetches it from Google again.

Disconnecting deletes the cookie. Removing the grant at Google is a separate act and it is yours to make, at myaccount.google.com/permissions. We cannot revoke it on your behalf.

This dashboard is independent of the audit tool. If you never connect it, no Google data is processed and neither cookie below is ever written to your browser.

tp_gsc

Your encrypted Google refresh token. httpOnly, Secure, SameSite=Lax. It expires on its own after 90 days, and “Disconnect” deletes it immediately.

tp_gsc_state

A random value that stops the round trip to Google being tampered with (CSRF). It lives 10 minutes and is cleared the moment you return.

Data controller

The controller for this service is [ticari unvan], [açık adres]. Tax office and number: [vergi dairesi] / [vergi kimlik numarası]. For any data request: bot@teknikprime.online

What is processed, and why

No name, phone number, postal address, payment detail or comparable identifying data is ever requested or collected.

The address you submit for audit

Used to fetch and analyse the target page. It is returned to you in the response, is not stored on the server and is not shared, with the single exception of the PageSpeed measurement described below.

Your browser’s language preference (Accept-Language)

Read to decide whether to serve Turkish or English. It is not stored; your choice travels in the URL itself (/tr or /en).

Server access logs

Our hosting provider records each request in its own infrastructure: IP address, timestamp, requested path, user agent. These exist to keep the service running and to stop abuse. We add nothing of our own to them, and they contain no audit results.

Third parties that receive data

These providers may operate servers outside your country, so the data named above is transferred internationally. The transferred set is no larger than what each row states.

Google PageSpeed Insights

Speed and Core Web Vitals are measured on Google’s infrastructure. Only the address of the audited page is sent for this; nothing about you is sent.

Wikidata

To see whether the brand resolves to a known entity, the audited domain’s brand name is queried against Wikidata’s open search service.

Google favicon service

In the report’s screenshot frame, the audited site’s icon is loaded from www.google.com/s2/favicons as a placeholder until PageSpeed returns the real capture. Two things reach Google in that request: the domain you are auditing, and your browser’s IP address. No cookie is set. The icon disappears once the capture arrives, but the request has already been made by then.

Google Fonts

The page’s typefaces load from fonts.googleapis.com and fonts.gstatic.com. That means your browser makes a request to Google, and your IP address reaches Google in it. No cookie is set. Removing this dependency is on our roadmap; this entry will be updated when it is.

Hosting provider

The site runs on Vercel. The access logs described above are held by that provider.

Legal basis

Processing rests on the performance of a contract and on legitimate interests — providing the service and keeping the infrastructure available — under GDPR Articles 6(1)(b) and 6(1)(f), and on the equivalent grounds in Articles 5/2-c and 5/2-f of Turkish law 6698 (KVKK).

Retention

• Audit content and results: not retained. Nothing is kept in memory after the response is sent.
• The address you submitted: not retained.
• Server access logs: for the hosting provider’s own retention period, for operational purposes.

Your rights

Under the GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Under Article 11 of KVKK you may ask whether data is processed, request information, ask for correction or deletion, learn which third parties received it, and claim compensation for damage.

To exercise any of these, write to bot@teknikprime.online. Because no audit record is stored, erasure requests will usually be answered with "there is no data to delete" — every request still receives a written reply.

Security

The site is served over HTTPS only. The audit engine runs behind a guard that refuses addresses pointing at its own network: private IP ranges, cloud metadata addresses and non-HTTP schemes are re-checked at every redirect hop.

Changes

This text was last reviewed on 2026-09-09. If the set of data collected changes, this text is updated the same day as the change.