KVKK Privacy Notice (Türkiye)

CLOVERA KVKK PRIVACY NOTICE (TÜRKİYE)
Last updated: October 16, 2026
Contact: kitteniversestudios@gmail.com

This notice is provided in accordance with Article 10 of Turkish Law No. 6698 on the Protection of Personal Data ("KVKK") and the Communiqué on the Procedures and Principles for Compliance with the Obligation to Inform. In case of any discrepancy between this English version and the Turkish version, the Turkish version prevails for users subject to Turkish law.

1. Data Controller
Clovera is an independent project run under the name "Kitteniverse Studios". Kitteniverse Studios is not currently a registered company. For the purposes of the KVKK, the data controller is therefore the natural person operating the project. The data controller can be reached at kitteniversestudios@gmail.com. If the project is later registered as a company, this notice will be updated to show the registered name and contact details.

2. Personal Data Processed
The following categories of personal data may be processed within Clovera:
a) Account data: a username, a password (stored only as a hash), a language preference, and optional profile details such as a display name, pronouns, a short biography, a custom status, an accent colour, a profile photo, and a banner. A user who wants the birthday marker shown on their profile may also give the day and month of their birthday; the year is never asked for and never stored, so no date of birth is held and no age can be derived from what is held. Registration requires only a username and a password. Clovera does not ask for, and does not collect, an email address or a telephone number; an internal, non-deliverable placeholder address is generated so that the account record has a unique identifier;
b) Technical data: the IP address of each connection, which the server sees while a request is being handled and which is afterwards kept only as a one-way keyed digest, and only in the records listed in Section 9 and, for a few hours at most and only in the server's working memory, in the Kitguard counts described in Section 9a; and the browser's User-Agent string. Clovera does not derive or store users' geographic location from their IP addresses, and does not record the operator or the type of the network a user connects from; it places a random identifier in a signed-in user's browser so that the browser can be recognised again, for the purposes set out in Section 9, and keeps a digest of it;
c) Usage data: login times, failed login attempts, interactions, reports, blocks, community participation, and feature usage;
d) Content data: messages, posts, comments, blog articles, attachments, profile text, and other user-submitted content, including a message written now and scheduled to be sent later, and what a user writes to the KittenAI assistant;
e) Safety and moderation data: report records, enforcement history, detection signals, and abuse-prevention logs;
f) Call data: that a call took place, between which two accounts, whether it was answered, and when it began and ended; and, while a user is in a voice channel of a community, which channel they are in and whether they are muted, deafened, or sharing a screen. What is spoken in a call and what is shown on a shared screen are not recorded, as Section 18 explains.

3. Purposes of Processing
Your personal data is processed for the following purposes:
a) Creating and managing accounts;
b) Providing messaging, community, feed, moderation, and support functions;
c) Protecting users and the service from spam, fraud, abuse, illegal activity, and security threats;
d) Enforcing platform rules and legal obligations;
e) Improving reliability, performance, and user experience;
f) Communicating service notices, policy updates, and support responses. Because Clovera holds no email address, this communication takes place inside the service: as on-screen notices, as the acceptance screen shown when the policies are revised, and, where the user has enabled them, as push notifications. Clovera has no way to reach a user outside the service unless the user writes first.

4. Legal Grounds for Processing
Your personal data is processed on the following legal grounds under Article 5 of the KVKK and, where required, Article 6:
a) Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the establishment or performance of that contract;
b) Processing being necessary for the data controller to comply with a legal obligation;
c) Processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject;
d) The explicit consent of the data subject, where explicit consent is required.

5. Method of Collection
Your personal data is collected electronically, by automated and partly automated means, through registration forms, in-app interactions, messaging and content submission, automated logs, security systems, cookies, and similar technologies. The cookies Clovera places in your browser are: a session cookie necessary to keep you signed in, a browser identifier placed when you sign in or register and described in Section 9, a device cookie for the "Keep me signed in on this network" feature where that option is selected, a pass cookie set after a Kitguard check has been passed and described in Section 9a, and preference values such as language and theme. Clovera has no cookies of its own for advertising, audience measurement, or cross-site tracking, and takes no fingerprint of your browser or device.

6. Recipients of Personal Data and the Purposes of Transfer
Within the framework of Articles 8 and 9 of the KVKK and the related legislation, your personal data may be transferred to the following recipients for the purposes stated:
a) Hosting and infrastructure provider: Clovera's application and database run on a third-party hosting platform, which necessarily processes all data stored or transmitted by the service in order to operate it. It acts as a processor on Clovera's instructions;
b) Anthropic, PBC (Claude API): to process the relevant content for the KittenAI features described in Section 7a;
c) Google (hosted fonts): Clovera's pages load two typefaces from Google's servers. Because the browser makes that request directly, Google learns the visitor's IP address, User-Agent string, and the fact that a Clovera page was loaded. This happens on every page view, including for visitors with no account who are not signed in; its only purpose is to display the site's typography;
d) Bot-protection providers — Cloudflare, Inc. (Turnstile) and Intuition Machines, Inc. (hCaptcha): where bot protection is enabled, the login and registration pages, and the Kitguard check page described in Section 9a, load the provider's challenge script, and Clovera sends that provider the challenge token **together with the visitor's IP address** in order to verify the result. While Clovera itself stores only a digest of the address, the full address is transmitted to the provider for this check. The provider may also set its own cookies or browser storage in order to distinguish automated traffic. This transfer occurs only on those three pages and only while the protection is enabled, and the script is loaded nowhere else; its purpose is to prevent automated account creation, password-guessing and other automated abuse. Clovera's server may also contact the provider with a placeholder value carrying no data about any visitor, to find out whether it can be reached;
e) Push notification delivery services: if a user enables push notifications, the browser registers with the notification service operated by its vendor (Google, Mozilla, Apple, or Microsoft, depending on the browser) and Clovera sends notifications through that service. The service learns that a notification was sent to that subscription and when; the notification content is encrypted in transit to the browser. A notification says what kind of event occurred and, where there is one, the username of the person who caused it; it never carries the text of a message. Push notifications are off unless the user turns them on;
e-bis) Browser speech recognition services: where a voice channel has switched on live captions and a speaker's browser cannot recognise speech on the device, the browser sends that speaker's sound directly to the speech service operated by its vendor (for Google Chrome, Google) to have it written down, as Section 7a describes. Clovera's servers neither send nor receive the sound, and Clovera receives only the resulting text;
f) Competent authorities and institutions: to comply with lawful requests, investigate abuse, enforce platform rules, and fulfil obligations arising from legislation;
g) Third parties in connection with legal claims: to establish, exercise, or protect a right and to conduct legal proceedings.

Clovera does not sell personal data. Clovera does not use analytics, advertising, tag-management, or audience-measurement services, and embeds no third-party content other than what is listed above.

7. Cross-Border Data Transfer
Every recipient listed in Section 6 may process personal data on servers outside the user's country, including outside Türkiye. This constitutes a cross-border transfer of personal data within the meaning of Article 9 of the KVKK, and it covers not only the KittenAI features but also the hosting infrastructure, the IP address and User-Agent disclosed to Google when hosted fonts are loaded, the IP address and challenge token sent to a bot-protection provider, and push notification delivery.

Such transfers are carried out on the basis of an adequacy decision where one exists for the country, sector, or international organisation concerned. Where there is no adequacy decision, the transfer is made on the basis of one of the appropriate safeguards listed in Article 9 of the KVKK, subject to the notification and authorisation requirements that attach to the safeguard relied on. Only where neither of those is available, and only for a transfer that is occasional in nature, may a transfer be made on one of the exceptional grounds in the final paragraph of Article 9, one of which is your explicit consent obtained after you have been informed of the possible risks.

Using a KittenAI feature is not, by itself, that explicit consent. Explicit consent under the KVKK must relate to a specific subject, be based on information, and be declared by free will; an action taken inside the service is not a substitute for it. Where a transfer rests on explicit consent, it is requested separately and expressly, and refusing it does not remove your access to the parts of the service that do not depend on the transfer. The hosting infrastructure, the hosted fonts, the bot-protection check and push notification delivery are continuous rather than occasional transfers and are therefore not made on the basis of consent at all.

Users who wish to avoid the transfer caused by the hosted fonts can block requests to Google's font domains in their browser; the service remains fully usable with fallback typefaces.

Calls and voice channels are carried by the hosting infrastructure in (a) above and by nobody else. The sound of a call, and the picture of a shared screen, pass through the servers on which Clovera runs, which are outside Türkiye, and are forwarded to the other participants without being recorded; no separate provider, relay, or turn server takes part. That transit is within the transfer to the hosting provider described here, and Clovera adds no further recipient. Live captions, which a voice channel can switch on, are the one exception, and Section 7a describes them.

7a. KittenAI Features and Automated Moderation

Clovera's built-in artificial intelligence features ("KittenAI") — conversation summaries, message translation, Live Translation, reply suggestions, Catch-Up digests, the KittenAI chat assistant, writing assistance, the translation of live captions in voice channels, and automated content moderation — are powered by Anthropic's Claude models, accessed through the Claude API operated by Anthropic, PBC. Anthropic acts as a data processor on Clovera's behalf for these features.

When a KittenAI feature runs, the relevant content is decrypted on Clovera's servers and transmitted to Anthropic for processing. Depending on the feature, this content may include:
a) The text of direct messages, group messages, and channel messages, together with the display names of the participants, where a summary, translation, reply suggestion, or Catch-Up digest is produced from a conversation;
b) Posts, post comments, blog articles, usernames, profile text, the name, description, welcome message, and channel names of a community, the name of a group chat, and messages sent to the KittenAI chat assistant, together with the earlier messages of that assistant conversation and, where the user attaches one of their own direct or group conversations to it as context, the last forty messages of that conversation with the sender names;
c) Images such as profile photos, banners, server icons, and post attachments (for automated image moderation);
d) The text of a line of live captions in a voice channel, without the name of the person who said it, where someone in that channel reads another language.

The features run as follows:
a) User-initiated features (summarize, translate, reply suggestion, community idea, Catch-Up, writing assistance, and the KittenAI chat) run only when the user actively requests them;
b) Live Translation runs only if the user has turned it on in settings, and can be turned off at any time; it is off by default;
b-bis) Web search in the chat assistant. Unless the operator has switched it off, the KittenAI chat assistant can look something up on the web while answering you. Where it does, the model builds a search query from what you asked and Anthropic runs the search, which may involve a search provider Anthropic engages, so the substance of your question reaches that search service as well as the model, and the pages your answer was drawn from are kept with the reply and shown under it. This happens only in the chat assistant and only in a conversation you started with it. No other feature can search: your direct messages, group messages, community messages, translations, summaries, Catch-Up digests and the moderation checks are never turned into a search query.
b-ter) Live captions in voice channels. They run only in a voice channel where someone who can configure it has switched them on, and they are off by default. While they are on, each speaker's own browser writes down what they say, using the speech recognition built into the browser, and only while that speaker's microphone is on. Where the browser can do this on the device it does; otherwise it sends the sound to its vendor's speech service (for Google Chrome, Google), as Section 6(e-bis) describes. Clovera receives only the resulting text, stores it encrypted for at most six hours, shows it to the people in the channel, and deletes it with its translations when captions are switched off for the channel or the speaker's account is deleted. A line is sent to Anthropic only to translate it for someone in the channel who reads another language, without the name of the person who said it; where everyone reads the speaker's language, no KittenAI feature runs at all.

c) Automated content moderation runs by itself, without being requested, on the following: feed posts and post comments — including posts that are not public — blog articles, usernames chosen at registration or changed later, profile text, profile photos, banners, server icons, messages sent by creator bots, the name, description, welcome message, and channel names of a community, and the name of a group chat. It also runs on messages and forum posts in the channels of communities that have enabled moderation; where a community has not enabled it, nothing written in its channels is measured against the platform rules by an automated process, though it stays within the serious-crime screen described below, which a community owner cannot switch off. A user's own direct messages and group messages are not read by that general moderation, by the serious-crime screen described below, or by any other automated review; they are transmitted to Anthropic only where a participant uses one of the features in (a) or (b) on the conversation.

At intervals, Clovera also reviews accounts, communities, and groups for spam, deception, and coordinated attacks. Beyond the texts listed in (c), this review relies only on counts produced on Clovera's own servers from usage data — how often an account publishes, how many distinct people it sent direct messages to who never replied or who blocked it, how many people it added to new groups, friend requests, blocks, reports, earlier automated removals, a community's invite links and membership bursts, and whether an account's address digest matches a ban record. None of these counts is transmitted to Anthropic and no private or group message is read for them. The result is a case for a human administrator; a community may be placed on hold, reversibly, until that person has looked.

d) Serious-crime screen. Clovera puts the text of a single item to KittenAI with one question: whether it is itself a step in organised or other grave crime. Only what is written in a community's channels — messages, forum threads, and forum replies — is within it, wherever it is written; the moderation setting of a community decides only whether the general moderation in (c) runs there, and the owner of a community cannot switch this screen off for the place they run, while the operator of the service can switch it off for the whole service. It never reads a direct message or a group message, and no setting extends it to them. The categories are closed: running a criminal organisation, including recruitment, tasking, the division of proceeds, protection rackets, and extortion; trafficking or smuggling people, forced labour, and forced prostitution; terrorism, including recruitment, financing, and attack planning; dealing in drugs, firearms, or explosives, including instructions for making weapons or explosives; the sexual abuse of children, including soliciting, arranging, or sharing such material; arranging violence for another party, including contract killing, kidnapping, and a credible and specific plan to kill or seriously injure a named person; and laundering money, trading stolen payment or identity data, or producing counterfeit money or documents.

This screen is not general moderation of what you write in a community and cannot be used as such. Insults, threats made in anger, swearing, hate, harassment, bullying, sexual talk between adults, jokes, boasting, roleplay, fiction, personal drug use, and discussion of crime, politics, courts, or police as a subject are outside it and are not flagged by it. Nothing it reads is used to profile you, to rank you, or to target anything at you.

Only the text of the single item is transmitted to Anthropic, without your username, display name, or any identifier, and without anything else written around it; a file attached to it is never opened or transmitted by the screen. Messages you have deleted are not read. Where the answer is that no category applies — the ordinary case — nothing is recorded and no trace of the reading is kept. Where a category is found, a case is opened for a human administrator containing the date, the category, the account that wrote it, the community and channel it was written in, and an excerpt of at most 200 characters, stored encrypted; no one else in the conversation is recorded. The screen can delete nothing, hide nothing, place no community on hold, and restrict no account: what was written stays where it was written, and a human administrator decides whether it is removed and whether any consequence follows. What the screen finds is also excluded from the counts the account, community, and group review in (c) works from. Until 15 October 2026 the operator could also switch this screen on for direct and group messages; that switch has been removed, and a case it opened over such a message while it was on stays with a human administrator until it is decided.

Content you send to other users may be processed by KittenAI if another participant in the conversation uses an AI feature on that conversation (for example, translation, summarization, or Catch-Up), or if the content is subject to automated safety moderation.

Users who do not use KittenAI features and have not enabled Live Translation do not have their private message content sent to Anthropic.

No KittenAI feature is applied to a call or a shared screen, and no automated review is applied to a call, a voice channel, or a shared screen. Clovera transmits nothing spoken or shown there to Anthropic or to any other provider, and does not record or moderate it. The only content KittenAI receives from a voice channel is the written line of a live caption described in (b-ter), and only to translate it.

A conversation with the KittenAI chat assistant is kept in plain text on Clovera's servers so that it can be shown again when the user returns and given back to Anthropic as context for the next question. It stays until the user clears it with the button on that page, or until the account is deleted.

Clovera transmits only the content reasonably needed for the requested feature, together with limited context such as the target language. No account identifier is transmitted; the user identifier is used only inside Clovera to apply per-user rate limits. Content transmitted to Anthropic is processed subject to Anthropic's Commercial Terms of Service and the data processing terms incorporated in them. Under those terms, content submitted through the Claude API is not used to train Anthropic's models; Anthropic keeps it only for the limited period those terms set, which can be longer for content its automated safety systems flag as breaching its usage policy, and such flagged content may be reviewed by Anthropic's trust and safety staff for that purpose alone. Clovera does not permit its processors to use this content for their own advertising purposes. Translation results are cached in encrypted form on Clovera's servers to reduce repeat processing.

8. Who Can See What You Write
Part of Clovera can be read without an account, and part of that is offered to search engines. Because "public" here means visible to anyone on the internet rather than visible to signed-in users, it is set out separately.

a) Readable by anyone and offered to search engines: a post you have marked public and the files attached to it, a blog article you have published, and the front page of a community whose owner has listed it publicly. These are served to any visitor without an account and are listed in Clovera's sitemap, so search engines and AI crawlers may fetch and index them. Your username, display name, profile photo and banner, and the reactions and comments on the item, are shown to the same audience;

b) Readable by anyone holding the link, but kept out of search indexes: inside a community whose owner has listed it publicly and left it open to guests, the text and announcement channels, the forum listing and the forum threads. These pages are excluded from the sitemap and carry an instruction not to index them, in the page and in the response headers, unless the operator of the service switches indexing on. Voice, mission, counting and showcase channels are never readable in this way, and a channel closed by permissions is closed to visitors as well;

c) Guest reading of a publicly listed community is on unless its owner turns it off, in Community settings → Visibility. Turning it off keeps the community listed in Discover and closes its contents;

d) Not readable without an account: direct messages, group chats, communities that are not listed publicly, channels closed by permissions, posts not marked public, and the files attached to any of these. Nothing can be written without an account;

e) Who can hear a call: a one-to-one call is heard by the other participant only. A voice channel is heard, and a shared screen is seen, by the members of the community who are in that channel at the time and are entitled to open it; anyone entitled to open it can join and can see who is already there. A visitor without an account can never join or hear a voice channel. Beyond the participants, the sound and the shared picture pass through Clovera's own server, which forwards them without keeping a copy, as Section 18 explains.

Content that another person, a search engine or a crawler has already fetched while it was public does not become unreadable when you later delete it or make it private. Clovera stops serving it, which is what causes search engines to drop it in time, but Clovera cannot recall a copy someone else already holds. You should treat anything you mark public as published. The legal grounds for this processing are the performance of the contract, for content you have yourself marked public, and the legitimate interest of the data controller in the discoverability of publicly listed communities (Section 4(a) and (c) above).

9. Login Records, Browser Identifier and Address Digests
On each successful login or registration, Clovera records which account signed in, when, the User-Agent string of the browser, and a digest of the browser identifier described below. That record holds nothing derived from the IP address of the connection: no address, no digest of one, no digest of the surrounding network range, no autonomous system number and no network category. Clovera formerly recorded those and no longer does, because behind proxies and mobile carriers the address reaching the server was frequently not the user's own, so the record associated accounts that had nothing to do with each other. No geographic location is derived from an address at any point.

Browser identifier: when you sign in or register in a browser that does not already carry one, and when a signed-in browser is found without one, Clovera places a random value in a cookie in that browser. It describes nothing about your device or about you, expires five years after it is set, and is not removed when you sign out. Only a one-way digest of it is stored: on each login record, and in a list held against each account of the browsers it has been used from, with the time each was first and last seen. It is used for two purposes only. First, Clovera's administrators can see which accounts have signed in from the same browser, in order to detect accounts opened to evade a ban, several accounts run by one person to manipulate or harass, and sign-ins from a browser an account has never used. People who share a computer share a browser too, so a match is treated as a lead and never as proof, and no account is restricted automatically on that ground; any decision is taken by a person. Second, when an administrator terminates an account, the digests of the browsers it was used from, and of any persistent-session tokens described below, are recorded as banned browsers, and requests presenting them are refused; that record may be kept after the account has been deleted. Clearing the site's cookies removes the identifier. The legal ground is the legitimate interest of the data controller in protecting account security and in giving effect to its rules and enforcement decisions (Section 4(c) above).

While a request is being handled the server necessarily sees the IP address, and uses it at that moment to apply rate limits, to check the address against a ban already in force, where bot protection is enabled to verify a challenge with the provider named in Section 6(d), and to keep the Kitguard counts described in Section 9a. Afterwards the address is kept only as a one-way keyed digest, and only in the following records. The raw address is not stored in any of them:
a) A digest of the IP address used at registration is kept on the account record, to prevent an unlimited number of accounts being created from a single address;
b) Every active session record stores a digest of the IP address and the User-Agent string of the device that created it. This is what allows a user to see their active sessions in settings and sign other devices out. This record is created for every session, whether or not the user has selected the optional "Keep me signed in on this network" feature. Section 7a describes one further use of this digest and of the registration digest, in the review of accounts, communities and groups, and paragraph (f) below describes another;
c) A failed login attempt is recorded with a digest of the IP address, the username attempted, the reason for the failure, and the User-Agent string; a recovery key offered and refused is recorded in the same way. These records exist to detect password-guessing and account-takeover attempts. They are not linked to any account, because the username attempted may not belong to an existing user;
d) Where the "Keep me signed in on this network" option is selected, a digest of the IP address is stored with the device token, as described below;
e) Where an account is banned, the digests held for it under (d) are recorded as banned addresses so that the same address can be refused. Such a record may be kept after the account itself has been deleted;
f) A request to reset a password that is to be approved from a device still signed in to the account is stored with the account it concerns, a random token, an expiry, the User-Agent string of the browser that made it, and a digest of the address it was made from. That digest is used for one thing only: it is compared with the digests held under (b) for the same account, so that the person deciding on the request, on their other device, is shown whether it came from an address the account has signed in from before. The request is deleted when the account is deleted;
g) An action subject to a rate limit — signing in, registering, asking for a recovery, and certain content actions — is counted against a record holding a digest of the IP address, the name of the action, a count that returns to zero when the window passes, and the times the window opened and was last touched. This record carries no account identifier;
h) While a Kitguard stop, waiting period or temporary address block described in Section 9a is in force, a record of it is kept so that a restart does not lift it, holding the digest of the IP address, or a value identifying the browser, or the account identifier, with the reference code, the kind of behaviour, the times it began and ends and how often it has been repeated. It is deleted when the measure ends or with the account, and is never kept longer than a day.

The "Keep me signed in on this network" feature: when the user selects that option at login, a digest of a random device token placed in the browser is stored in association with the account, together with a digest of the address the user was connecting from. The session is restored when that browser returns and presents the token — by the device cookie alone, whatever address the request comes from, notwithstanding the wording of the option. The address digest is not used to restore the session; it is kept for the purpose in (e) above. The legal ground for creating the token and restoring the session is the explicit consent the user gives by deliberately selecting the option at login; the legal ground for keeping the address digest is the legitimate interest of the data controller in giving effect to an enforcement decision (Section 4(c) above), which is not covered by that consent. The token is deleted when the user logs out, when the user signs out of all other devices, when the individual token is revoked in Settings → Sessions, when the account is banned, and when the account is deleted; otherwise it remains valid for as long as the account exists. The accompanying device cookie expires five years after it is set.

The legal ground for these records is the legitimate interest in protecting account security and the integrity of the platform (Section 4(c) above), save where a different ground is stated above. They are not used for advertising, behavioural profiling, or cross-service tracking.

9a. Kitguard
Kitguard is an automated check that stops a connection or an account whose behaviour strongly suggests automated abuse, and asks it to pass a verification before it continues. Section 12 of the Privacy Policy describes it in full.

a) What is processed: the keyed digest of the address a request comes from, for a signed-in user the account identifier, and for a browser that has passed the verification a value derived from the address digest and the User-Agent string; a score for each, built from fixed weights for these events and halving every fifteen minutes: requests that keep arriving above the per-second limit for an address or an account, at least thirty refused within a minute, with images and the site's own files counting for very little and refusals caused only by many people sharing an address not counted against anyone; collisions with the rate limits of actions that publish something or reach other people, not of typing indicators, edits, live updates or translations; sign-in, registration or recovery attempts refused because too many have already failed or been made, and failed bot-protection checks or arithmetic questions on the login or registration page, but not a single wrong password; registration attempts beyond the limit for one address; requests for paths only vulnerability scanners ask for, more than thirty requests within a minute for pages that do not exist (images and other files aside), bursts of changing requests for such pages, and sequential fetching of numbered pages; following the hidden link every page carries, which no person can see or reach and which crawlers are told not to follow, and which on its own leads to a stop; well-known attack patterns, such as database, script, template or command injection, reading files outside the site or sending the visitor to another site, in the path, the query string other than fields people type text into, or the User-Agent string, of which only the presence is noted; request methods no browser sends; requests for the administration pages by anyone who is not an administrator; requests larger than the service accepts; more than twelve different pages refused to one address within a minute for lack of access; and content submitted by an account in its first period after registration, or a username chosen at registration, that the automated moderation in Section 7a blocks. Content of an established account is not counted, and the serious-crime screen is never counted. Apart from requests only machines make, an event of the same kind is counted at most once every five to thirty seconds. Nothing about the content or the request is kept, only that an event of one of these kinds occurred and when. Where someone is stopped: a random reference code, whether they passed or failed the verification, and any waiting period;
b) Whose score is used: a visitor who is not signed in is assessed by the address digest until their browser has passed the verification, and afterwards by that browser's own score; a signed-in account by its own score and, while the account is new (24 hours after registration unless the operator changes it), also by the part of the address's score that comes from requests arriving too fast or from probing — not by sign-in failures, limits or blocked content, which on a shared address may be other people's. An established account is never assessed by its address. Administrators, the service's own bot accounts and search engine crawlers verified as such are not scored;
c) The verification: where bot protection is enabled, the hCaptcha challenge under Section 6(d) together with a short calculation performed by the browser that reads nothing from the device; otherwise, or where the provider cannot be reached, holding a button down while the browser performs that calculation. Passing ends the stop and sets a cookie holding only an expiry time and a signature derived from the address digest and the User-Agent string, of which Clovera keeps no copy; it expires after six hours. While it is valid, the browser is judged on its own score rather than on the address's, and is not asked again while attack mode is on. Where the stop was on an address, the address keeps its score, so that whatever caused it is not let through by someone else passing. While the operator has switched attack mode on, every visitor who is not signed in is asked to pass the verification before entering;
d) Retention: apart from a referral described in Section 11, and the stops, waiting periods and temporary address blocks still in force, which are kept in the record described in Section 9(h) until they end so that a restart does not lift them, all of this, and the five-minute clock kept for each stop, is held in the server's working memory only, is never written to the database or to disk, and is lost whenever the service restarts. A score that has fallen back to almost nothing is discarded; an entry untouched for three hours is discarded the next time the service handles a request, unless a stop or a waiting period is in force. For the operator of the service only, a list of the most recent decisions is kept — the time, the kind of decision and of behaviour, the reference code and, where the person was signed in, the account identifier, but no address and no digest of one — limited to its last 200 entries and to the last 24 hours. The operational log records when the operator releases a stop, with the reference code and the operator's account, and when an address is temporarily blocked, with the reference code but not the address. A referral is a case for an administrator holding the account identifier, the number of passes within the hour, the kind of behaviour and the reference code, and no address or digest of one; it is stored encrypted in the database and kept, with its contents destroyed when the account is deleted, as the review cases described in Section 7a are;
e) Legal ground: the legitimate interest of the data controller in keeping the service available and protecting accounts and communities against automated abuse (Section 4(c) above). Kitguard is an automated assessment of behaviour; Section 11 describes the decisions it can take and how to object to them.

10. Retention and Destruction
Your personal data is retained for as long as necessary for the purposes described in this notice and in the Privacy Policy, subject to the maximum periods prescribed by the applicable legislation. Retention periods per category of data are determined taking into account the purpose of processing, legal obligations, limitation periods, dispute management, security needs, and technical requirements. Account content, login records, and failed login records are kept for as long as those purposes require and are not deleted on a fixed schedule.

Where the purpose of processing ceases, the legal ground ends, or the retention period expires, personal data is deleted, destroyed, or anonymised. Deletion, destruction, and anonymisation are carried out in accordance with the provisions of the applicable legislation, the technical and administrative measures in place, and the retention and destruction procedures. These operations are recorded, and the related records are kept for at least three years, save for legal obligations to the contrary.

Account deletion: the account settings contain a "Delete account" control that erases the account and its data in a single step. The erasure is immediate and irreversible; confirming it requires the account password and the account's own username. An account that owns a community with other members in it must first hand that community to another member or close it; a community whose only member is the account holder is closed together with the account. A user who cannot reach the control may instead write to kitteniversestudios@gmail.com from, or while signed in to, the account concerned, and the data controller will carry the erasure out manually. Because no email address is held for any account, such a request must contain enough information for the controller to be satisfied that it comes from the account holder (see Section 13). In line with the recording obligation described above, Clovera keeps a record of each erasure — its date, who carried it out, and how much was removed — containing nothing that identifies the erased account.

When such a request is carried out, the following are erased: the account record, the login and session records belonging to it, the list of browsers it was used from, the persistent-session tokens and the address digests held with them, any recovery request made for the account, the account's messages, posts, comments, blog articles, and uploaded files, its conversation with the KittenAI assistant, the records of its calls and of its presence in voice channels, the recovery keys issued to it, any bots it created together with those bots' own accounts, and the registration IP digest. A message the account deleted earlier is destroyed at this point too. Failed login records and the rate-limit records in Section 9(g) are not erased, because they carry no account identifier and may not correspond to a real user at all. Content other users have received may remain visible to them insofar as it forms part of their own conversation history, and content that was public may already have been copied or indexed by others, as Section 8 explains. Records that must be kept to comply with a legal obligation, to defend a legal claim, or to prevent the recurrence of serious abuse — including a ban already in force and the address digest recorded with it — may be retained for as long as that purpose requires, with any link to the deleted account removed where the record can stand without it. Destruction is carried out on the criteria of inaccessibility, irretrievability, and non-reusability.

Content can also be removed without erasing the account: a user may delete their own messages, posts, comments, and blog articles at any time, and may change or remove their profile photo and banner.

An important note on message deletion: when a user deletes one of their own messages, the message is marked as deleted and stops being shown to the participants, but the stored copy — encrypted for a direct message, plain text for a group or community message — remains in Clovera's database rather than being destroyed immediately. This is deliberate: a message deleted seconds after it was sent is frequently the subject of a report, and destroying it on request would make such reports impossible to assess. Deletion in the sense of destruction follows the procedure described in this Section.

Report records and misuse measurement: user reports carry a category chosen by the reporter (for example fraud, threats, or content involving minors) and a free-text explanation; when a report is reviewed, the outcome is recorded with it. The free-text explanation of a settled report — upheld or dismissed — is erased 180 days after it is settled; the category, outcome, and dates are kept so that the extent of unlawful use of the service can continue to be measured. For the same measurement, Clovera also keeps daily counters of automated moderation events; these consist only of a date, an event name, and a number, and contain no user identifier, content, or address. Private messages are not read or scanned to produce these figures. Where the serious-crime screen in Section 7a is enabled, a message it flags is counted in those same daily counters, which carry only a date, an event name, and a number.

11. Automated Decision-Making
Automated content moderation may result in content being blocked, removed, or restricted without prior human review, and a community may be placed on hold — hidden from discovery and closed to new members — pending human review. Decisions in this scope may be produced by technical systems for the purposes of security, legal compliance, and the enforcement of platform rules. The content types on which moderation runs by itself, the account, community, and group review, and the serious-crime screen for what is written in communities are described in Section 7a. No account is suspended, no community closed, no group dissolved, and no private message removed by an automated system; those decisions are taken by a human administrator to whom the automated findings are shown.

Kitguard, described in Section 9a, evaluates behaviour automatically. The decisions it can take are limited to asking for a verification within five minutes, imposing a wait of at most sixty minutes after repeated stops of a browser used without signing in, failed attempts or a verification not passed within those five minutes — counted per browser where the stop is on an address — and refusing requests from an address that keeps sending them while it is stopped for a limited time, never more than a day, never against a session that is already signed in, and never where someone has passed the verification from that address within the last hour. A signed-in account that is stopped again after passing the verification three times within an hour is not made to wait; it is referred to a human administrator, who decides whether anything is done under the Terms of Service. It does not restrict, suspend or terminate an account and does not remove content. Where a result of this analysis goes against you, you may object to it under Article 11(1)(g) of the KVKK by sending the reference code shown on the Kitguard page to kitteniversestudios@gmail.com; the operator of the service, a person, will look at the stop and can release it.

To contest a moderation decision and request human review, you may contact kitteniversestudios@gmail.com. Your request will be assessed according to the nature of the incident and concluded as soon as possible.

12. Your Rights under KVKK Article 11
Under Article 11 of the KVKK, by applying to the data controller you have the right to:
a) Learn whether your personal data is processed;
b) Request information if it has been processed;
c) Learn the purpose of processing and whether the data is used in accordance with that purpose;
ç) Know the third parties to whom your data is transferred, in Türkiye or abroad;
d) Request correction of incomplete or inaccurate data;
e) Request deletion or destruction of your data under the conditions of Article 7 of the KVKK;
f) Request that the operations under (d) and (e) be notified to third parties to whom the data has been transferred;
g) Object to a result arising against you through analysis carried out exclusively by automated systems;
ğ) Claim compensation for damages arising from unlawful processing.

Some of these rights can be exercised directly in the service without making an application: the account and its data can be erased from settings as described in Section 10, profile details and the username can be corrected in settings, messages and posts can be deleted by their author, active sessions on other devices can be terminated, and Live Translation can be turned off.

13. How to Apply
Requests regarding the rights above may be sent to kitteniversestudios@gmail.com in accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller. Clovera may need to verify identity before completing certain requests. Because no email address or other contact detail is held for any account, identity is verified through the account itself; for example, the user may be asked to send or post a particular value from the account concerned.

Applications are concluded within thirty days at the latest, as required by Article 13 of the KVKK. Where an application is made in writing, it must contain the minimum identity and contact details relating to the request. For electronic applications, the subject of the request must be stated clearly. Applications are made in Turkish.

14. Responding to an Application
Clovera either accepts the application or rejects it with an explanation of the grounds. The response is communicated in writing or electronically. Where a request is accepted, it is carried out as soon as possible and you are informed.

If responding to your application entails an additional cost, the fee determined under the applicable legislation may be charged. If the application arises from an error of the data controller, any fee charged is refunded.

15. Right to Complain
If your application is rejected, the response is found insufficient, or no response is given in time, you retain the right to lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) under Article 14 of the KVKK.

16. Withdrawal of Consent and Feature Controls
For user-initiated KittenAI features, you can stop the processing at any time by not using them; for Live Translation, by turning it off in settings. You can withdraw your consent for "Keep me signed in on this network" in any of three ways, each of which deletes the stored token and the address digest kept with it: by logging out on that browser, by signing out of all other devices in settings, or by revoking that token in Settings → Sessions. Because the session is restored by the device cookie alone and not by the network the request comes from, changing network does not withdraw it. Push notifications can be turned off in settings. Withdrawing your explicit consent does not affect the lawfulness of processing carried out before the withdrawal.

17. Children's Data
Clovera does not collect a date of birth and therefore cannot verify a user's age: the day and month of a birthday may be given voluntarily for the marker shown on a profile, but the year is never collected, so no age can be derived from it. The minimum age is stated in the Terms of Service and is relied upon as a representation by the user. If Clovera becomes aware of use below the age limit contrary to the legislation, it may remove the account and the related data as appropriate.

18. Data Security
Clovera takes all necessary technical and administrative measures to prevent the unlawful processing of and access to personal data, to ensure that data is preserved, and to maintain an appropriate level of security. Within this scope, access rights are restricted, logging and monitoring mechanisms are operated, security incidents are followed up, encryption and similar protective measures are applied where considered necessary, and obligations relating to data security are observed in relationships with data processors.

Direct messages between two people are stored encrypted at the application layer on Clovera's servers (encryption at rest with ChaCha20-Poly1305), together with post bodies, post comments, blog articles and their comments, and the cached translations of direct messages; passwords are never held in plaintext and are protected with a strong hashing algorithm. This encryption is applied by Clovera's servers and is not end-to-end encryption: content is decrypted on the server when it is delivered to authorised participants and when a KittenAI feature, an automated safety review, or the serious-crime screen described in Section 7a is run on it.

Since 14 September 2026, group messages, community channel messages, forum threads and replies, and the questions and options of polls are not encrypted at rest; they are held in plain text. The reason is that content written to a group, and above all content written in a community to people the sender may never have met, must be capable of being examined when it is reported, when a community is being investigated for organising abuse, and when a lawful order requires it. A user should therefore treat anything written in a group chat, a community channel, a forum, or a poll as content the operator of the service can read, and Clovera states this rather than describing as encrypted something it can decrypt at will.

Files are not encrypted at rest either, wherever they are attached. A photograph, a video, a recorded voice message or a document sent in a direct message, a group chat or a community channel, and a profile photo or a banner, are held on Clovera's servers in the form in which they arrived; only the message text around them is encrypted. Who may fetch such a file is controlled — a file attached to something that is not public is served only to an account already entitled to see it, as Section 8 describes — but the operator of the service can open it. The same is true of the title of a blog article, a message waiting to be sent at a scheduled time, a conversation with the KittenAI assistant, profile text, and the names of communities, channels, and groups, all of which are held in plain text.

Calls, voice channels, and screen sharing are not stored at all. A one-to-one call carries sound only; a voice channel carries sound and, where a member shares a screen, the picture of that screen or window with its sound where the sharer includes it. None of it is peer-to-peer and none of it reaches a third party: each participant's stream travels over an encrypted connection to Clovera's own server, which forwards it to the other participants from memory and keeps no copy. Nothing is recorded and nothing is written to disk, and Clovera transmits no sound or picture to Anthropic or to any other provider. No transcript is produced, except the lines of live captions in a voice channel that has switched them on, which are kept encrypted for at most six hours as Section 7a describes. Because the stream is forwarded by that server, it is not end-to-end encrypted, and a user should treat a call as a conversation carried by the operator of the service. What remains afterwards is only what Section 2(f) describes, and because nothing is retained, a complaint about what was said in a call can be assessed only on what the complainant can show.

Personal data breaches: where a breach of security leads to the destruction, loss, alteration, or unauthorised disclosure of or access to personal data, Clovera assesses it as soon as it becomes aware of it. In accordance with Article 12 of the KVKK and the Board's decision on the subject, the Personal Data Protection Board is notified within 72 hours of the controller becoming aware of the breach, and the data subjects concerned are notified as soon as they can be identified. Because no email address or telephone number is held for any account, that notification to users is given inside the service — an on-screen notice to every account, and a push notification where enabled — and on the public site. A person who has stopped using the service, or whose account has been deleted, cannot be reached by Clovera at all; this follows from Section 2(a).

19. Retention and Destruction Policy
Clovera conducts its personal data retention and destruction processes taking into account the category of data, the purpose of processing, the retention period, legal obligations, and security needs. Personal data whose retention period has expired or whose purpose of processing has ceased is destroyed in accordance with the legislation, using whichever of deletion, destruction, or anonymisation is appropriate. Destruction operations are based on the criteria of inaccessibility, irretrievability, and non-reusability.

20. Updates
This notice may be updated in line with changes in legislation, updates to the structure of the service, or changes in data processing activities. The current text is made available through appropriate channels.

Data Controller: The natural person operating the project
Contact: kitteniversestudios@gmail.com