Privacy Policy

Last updated: September 28, 2026

This policy applies to finaller.com and our mobile app. By using the service you agree to the data processing described here.

1. Data we collect

1.1 Account information

Username — shown next to the files you upload.
Password — stored only as an irreversible bcrypt hash. Your plain-text password is never kept.
Country, university, faculty and department — required to determine which archive you can access.
Language preference (Turkish/English).

We do not ask for or store your email address, phone number, real name, date of birth or location. As a consequence, we cannot recover your account if you forget your password.

1.2 Content you upload

The PDF files themselves (max 15 MB, max 10 files per user).
File name, file size, course name, course code, year level and your optional description.
An MD5 digest of the file content, used to detect duplicate uploads.
How many times the file has been viewed.

1.3 Interaction data

The upvotes and downvotes you cast.
Content reports you submit (reason and optional details).
The list of users you have blocked.

1.4 Technical data

Session token — a random string generated at login, automatically invalid after 7 days.
Strictly necessary cookies — session_token (not readable from JavaScript), lang for your language preference and cookie_consent for your cookie choice. These are required for the site to work and need no consent.
Optional cookies — Google Analytics cookies (_ga). They are set only if you choose “Accept” in the cookie banner. If you reject or make no choice, Google Analytics is never loaded.
Server logs — the web server keeps standard access logs containing IP address and browser information for debugging.

1.5 Third parties

Our website uses Google Analytics for visitor and page-view statistics, only if you accepted cookies. If you accept, visited pages and browser/device information may be processed by Google as part of this service. We do not use a Google Ads tag. Fonts are served from our own server.

You can change your decision at any time: . If you reject, any earlier Google Analytics cookies are removed from your browser.

Bot protection (Cloudflare Turnstile). To stop automated programs from creating fake accounts in bulk, we use the Cloudflare Turnstile security check on the sign-up form only. When you open the sign-up tab, your IP address and browser information (browser type, connection characteristics) are processed by Cloudflare to tell whether you are a human. This data is not used for advertising or tracking; because the check is strictly necessary for the site's security, it does not depend on your cookie choice. Turnstile is not loaded for users who only log in. Details: Cloudflare Turnstile privacy notice.

2. Why we process this data

To create your account and keep you signed in.
To ensure you only reach the archive of your own university and department — this is the core access rule of the platform.
To store your files and serve them to users in the same department.
To review reports and remove infringing content and accounts.
To prevent abuse such as spam and repeated duplicate uploads.

3. Who your data is shared with

We do not sell your data or transfer it to third parties for marketing. Your data is visible only:

Your username and uploaded files are visible to other registered users in the same university and same department. Users in other departments cannot access this content.
Our hosting provider has technical access to the server as part of operating it.
To competent authorities where we have a legal obligation (court order or official request).

4. Retention

Account and content: kept until you delete them.
Session tokens: automatically invalid after 7 days.
When you delete your account: your user record, all uploaded PDF files (physically removed from disk), your votes, share links, reports and block records are permanently deleted. This cannot be undone and there is no waiting period.
Server access logs are rotated and deleted on the hosting provider's routine cycle.

5. Your rights

Under GDPR and Turkish KVKK you have the right to:

Access: download every record related to your account as JSON from Settings → Download my data.
Erasure: delete your account from Settings → Delete account, or, if you cannot sign in, at Delete Account.
Rectification and objection: write to [email protected].

6. Security

Passwords are hashed with bcrypt and never stored in plain text.
All database queries use prepared statements.
Uploads are validated by MIME type and file signature; only PDF files are accepted.
Uploaded files cannot be fetched directly by URL; they are served only through an endpoint that checks authorisation.

No system is completely secure, so we recommend not reusing a password you use elsewhere.

7. Children's privacy

The service is intended for university students and is not directed at children under 13. If we learn that a user under 13 has registered, we delete the account.

8. Changes

If we change this policy we will update the "last updated" date on this page, and notify you in the app for significant changes.

9. Contact

For any privacy question, request or complaint: [email protected]