Privacy & Data Protection

Under Turkey's Personal Data Protection Law No. 6698 (KVKK), the management of the Kurultay community — its Founder (IIIYIII) — acts as the data controller and informs its members as follows:

Data We Process

• Discord account: user ID, username, avatar and your nickname on our server.
• Discord welcome record: when someone joins our server without having registered on the site, the bot writes them a welcome message once; to avoid writing to the same person twice, their Discord user ID and the date of the message are kept.
• RSI (if you play Star Citizen): username (handle) and org membership verification history (the periods in which you were seen as an org member). No RSI information is asked of members who play only EVE Online or Elite Dangerous.
• Year of birth (not the full date; see below).
• Membership records: membership/role status, the fixed options you picked in the survey (the games you play, experience, interests, branch preference), the ships you added to your fleet, your mission and event participation, your prestige records, and your governance records (votes, signatures and candidacies).
• Activity record: the days on which you used the site or Discord, and when you were last seen on the site; this record does not contain what you did or which pages you viewed. Voter eligibility and activity rules read this record.
• Panel activity logs (audit/record — including the IP address at the time of the action, for security purposes).
• Images you upload to the site.
• Discord copies: from the forum only the title and author of each thread are taken; members' message text is not copied to the site. Posts in the announcement channel are copied.
• Contact form: if you use it, the name you enter, an optional e-mail address and the message text (if you are signed in, the message is linked to your account).
• Access to the game panels (EVE Online and Elite Dangerous): Access to a game panel is by request. In your request, your Kurultay name, which game panel you ask for, the dates of the request and of the decision, and your note if you wrote one are shown to the Founder. While your access lasts, the Founder sees how many EVE characters you have linked and the day you last opened the panel; in Elite, the Founder sees only that you have access. In an EVE request you write the name of your EVE character. The name you write is looked up in CCP's public service (no login needed): the character's number and corporation are read from there; if the character is not found in EVE your request is not saved. You do not have to be in the Kurultaysc [KRTAY] corporation: the Founder sees whether your character is in the corporation and decides. The character name you wrote is shown to the Founder until your request is decided; it is deleted once the decision is made. Nobody, the Founder included, can see your game data (character names, wallet, orders, goods); the only name the Founder sees is the one you wrote in your request. Unless the Founder has lifted the corporation requirement for you, the corporation of your linked characters is looked up in the same service when you link a character: you link your character in the corporation first and your other characters after it. Leaving the corporation does not close your EVE access by itself; only the Founder removes your access. If your access is removed, your game data is deleted immediately. Your request, its state (waiting, approved, not approved, removed) and your note are kept in Kurultay's main database.
• EVE Online link (optional): if you link your EVE character through CCP's login page, your character's ID and name are kept and 26 permissions are requested from you at CCP; the game data read is what these permissions cover. Twenty-four are read permissions: (1) your public character information: your corporation and alliance, your character's date of birth and security status; (2) your wallet and transaction history; (3) your assets; (4) your market orders; (5) your contracts; (6) your skills and attributes; (7) your skill queue; (8) your location; (9) your ship; (10) whether your character is in the game right now and its last login and logout time (only the latest state is kept, no history); (11) your clones; (12) your implants; (13) your standings; (14) your LP; (15) your in-game notifications; (16) the names of the player structures you can access; (17) your loss and kill records (each record holds the ship, the cargo, the system and the character, corporation and alliance IDs of the other players involved); (18) your saved fittings; (19) your industry jobs; (20) your blueprint list; (21) your mining ledger; (22) your planetary colonies (CCP names this permission "manage", but EVE has no address that writes to a planet: the panel only reads); (23) your faction warfare record; (24) your research agents. Two are actions, not reading: (25) opening a window in the game (market, information and contract windows) and (26) setting a route waypoint. These two are used only when you press the button and confirm; no permission that moves money or items is requested. One more permission is requested only if you want it: when you use the "Save to game" button to add a fitting to your saved fittings in the game, permission to write to your saved fittings is asked separately for that character; if you never use the button, it is never requested. The panel only saves fittings with this permission; it does not delete them. Your EVE mail, contact list, calendar, fleet and corporation data are not requested. Other players appear in loss and kill records: their names are shown to you on the panel but are not stored; they are asked from CCP each time you open the page. Corporation and alliance names are kept in the shared records. EVE provides loss and kill records only for the last 90 days; for older ones the ID of the character you linked is sent to the public zKillboard archive (zkillboard.com), run by the player community. Only your character ID reaches that service; the records themselves are still read from CCP's public address, and once the archive has been read it is not queried again. The information you enter on the panel yourself (such as the Omega end date, watch list, manual cost, table layout and the "lost" or "sold" decision you give for a ship that left the list) and the time you last opened the panel are also kept. Your EVE password never reaches Kurultay: you type it only on CCP's page. This data is not kept in Kurultay's main database but in a separate EVE server service, in a separate file in your name; the login keys issued by CCP are additionally encrypted. Only you can see it on the site; no other member can, the Founder included; the Founder sees only how many characters you have linked and the day you last opened the panel. Your character name is not shown to other members unless you turn it on. If your linked character is in Kurultay's EVE corporation Kurultaysc [KRTAY], a KRTAY badge appears on your member card; the badge does not show the character name. Only a character whose EVE permission is valid counts for the badge. If your Discord account is linked, the same information gives you the KRTAY role on Discord and opens the #korp channel that only corporation members can see. For the member card, only this badge information and the character name that can be shown on the card are kept in Kurultay's main database. Kurultay refreshes this information every 15 minutes; your corporation membership is read from EVE once an hour (once a day for a member who has not opened the panel for a long time; EVE may also serve it with a delay), so joining or leaving the corporation does not show on the card right away. The name appears on the card only if you turn it on; if the name on the card changes (another character's name takes its place) your choice is switched off and you have to turn it on again to show it. The EVE notifications you keep on are written to your notification inbox on the site with their title and text. There are ten kinds: being outbid, a sale, an order price that looks wrong, a filled buy order, contract news, a skill queue warning, a watched price limit being crossed, a price move, a sale that turned into a loss and a player structure holding your assets being about to be abandoned (structure abandonment warning). Price move and loss are off by default, the other eight are on; you can switch each one on the panel's Settings page. If the EVE permission of one of your characters lapses, that notice is written regardless of these settings: if you do not link the character again within 30 days, its data is deleted. For the structure warning, the names of the player structures holding your assets, the names of the corporation and alliance that own them (CCP's public information) and EVE's public war list are read; personal names of structure owners and of the sides in a war are not kept.
• Elite Dangerous link (optional): if you link your commander through Frontier's login page, your Frontier account ID (only to match "whose commander is this") and all the game data covered by the permission you grant at Frontier are read. From your Frontier profile: your commander name, your credits and debt, all your rank branches, your location, your ships, the modules, cosmetics and condition of your active ship, the vehicles in its hangar, your on-foot gear (suits, loadouts, weapon condition and mods), the expansions Frontier reports for you and your Merc Coin balance. If you own a fleet carrier, everything Frontier provides for it (balance and financial breakdown, fuel, cargo, orders, its market and shipyard, its services and the game's crew characters, its locker, jump history). From your game journal: every event written to the journal (travel, exploration, combat, trade, missions, power and squadron, wing and crew events) and what is derived from them: the income and expense items (with their time and amount), daily summaries, your daily play time and the time of your last session (with game mode, version and language), your open missions and the IDs of your finished missions (at most 400), materials, engineer progress, reputation, game statistics, pledged power and squadron name, the latest full loadout of each ship (engineering included), your stored ships and modules, the cargo and passengers on your ship, your on-foot locker and backpack, and your community goal contributions. If another player's name appears in the journal, "a player" is written instead; the text of chat messages and the other party's name are not kept, only the channel is; Frontier player IDs, the name of a private game group and other players' carrier names are not stored. From Frontier's visited-systems file, the IDs of the systems you visited and the number of visits are read. Your commander in the Legacy (pre-4.0) galaxy is read only if you turn it on. The market, shipyard and services of the station you last docked at, the active community goals and GalNet news are also read; these are public game information. The settings you choose on the panel (Frontier's language, Legacy) and the time you last opened the Elite panel are also kept. The e-mail address and name that Frontier sends during login are not stored. Your Frontier password never reaches Kurultay: you type it only on Frontier's page. This data is not kept in Kurultay's main database but in a separate Elite server service, in a separate file in your name; the login keys issued by Frontier are additionally encrypted. Only you can see it on the site; no other member can, the Founder included; the Founder sees only that you have access to the Elite panel. Your commander name is not shown to other members. Price tables come from public data shared by players; when you look up prices, only the commodity name and, if you choose "search near me", the name of the system you are in are sent to the price service; your commander name and account are not sent. If the name of a system you visited is not in your own journal, only that system's ID is sent to the same service.

No longer collected (decision of 2026-09-15). The following are neither asked for nor stored; anything stored earlier has been deleted:

• Declared real name. Our identity is what can be proven: the RSI handle. A declared name cannot be verified and would only add re-identification risk. The name shown on the panel is now the handle; to match who is who, the Founder sees the nickname on our Discord server.
• Full date of birth. The age requirement (20) is checked at sign-up; afterwards only the year of birth is kept. A "name + full date of birth" pair is the most valuable material in a leak; that pair no longer exists. Age is visible only to the Founder.
• "Why Kurultay?" free text. It was the only free-text field in the survey and people could volunteer names, ages or contact details there. Experience and interests are fixed-option lists; no personal data can be typed into them, and they remain.
• Account e-mail. Removed on 2026-09-12; Discord sign-in no longer asks for e-mail. An address you choose to enter in the contact form is separate from this.

Privacy

Our site uses no advertising or third-party tracking cookies, and no visitor statistics script. Your session is kept in your own browser; the server stores only a session record to check that the session is valid (a session ID, its start and its expiry — not your IP address or device details). A session lasts at most 30 days even when it is refreshed; after that you are asked to log in again. If a used session key comes back, the key is treated as stolen: that session is closed and the event is written to the action logs with the IP address of that moment. On the Settings page you can close all your sessions other than the current one with a single button. Member data is never used for marketing purposes.

Purposes of Processing

Establishing and maintaining membership, verifying the minimum age requirement (20), RSI org identity verification (for Star Citizen players), community security and disciplinary processes, operating the Discord–panel integration, deciding requests for access to the game panels by the Founder and managing the panels according to server load, showing the Founder the corporation of the character in an EVE request and verifying corporation membership when a member whose corporation requirement has not been lifted links a character, providing the EVE Online tools (net worth, assets, where to sell, orders, market, opportunities) to members who link their character, and providing the Elite Dangerous tools (commander card and account details, ships and loadouts, storage and on-foot gear, fleet carrier, station market and shipyard, prices, income and expenses, community goals and GalNet, record and event log, visited systems) to members who link their commander.

Legal Basis

KVKK Art. 5 — processing being necessary to establish and maintain the membership relationship, together with the community's legitimate interest; and, where required, explicit consent. The EVE Online link is optional and based on your explicit consent: separate confirmation is asked before linking, and you can withdraw consent at any time by removing the link or deleting your EVE data. The Elite Dangerous link is also optional and is based on your explicit consent in the same way. When you link EVE or Elite, the date of your confirmation and the version of the text you confirmed are stored in Kurultay's main database. The day you remove an EVE character's link or delete your EVE data is stored in the same place as well, as the record of your withdrawal of consent.

Transfers

Data is not shared or sold for commercial purposes. The site's server and main database are in Hetzner Online GmbH's data centre in Helsinki (Finland, European Union). All of the site's traffic passes through Cloudflare, Inc. (USA): the connection is opened at Cloudflare, and the visitor's IP address and the content of the request pass through its systems on the way to our server. The two off-server copies of the encrypted backups are kept in the Cloudflare R2 storage service and in the Founder's Google Drive account (Google LLC, USA); the backups are encrypted and the decryption key is not kept with these services. An additional unencrypted copy of the images you upload to the site is kept in Cloudflare R2. The community operates on the Discord and Roberts Space Industries platforms — using these platforms also entails the processing of data on their systems abroad, subject to their own privacy policies. If you link your EVE Online character, the data is fetched from the systems of CCP Games (the maker of EVE Online); login and data retrieval run through their systems abroad, subject to CCP's own privacy policy. For loss and kill records older than 90 days, the ID of the EVE character you linked is sent to the zKillboard archive (zkillboard.com), run by the player community; only your character ID reaches that service, and the request goes to its systems abroad, subject to its own privacy policy. If you link your Elite Dangerous commander, the data is fetched from the systems of Frontier Developments (the maker of Elite Dangerous); login and data retrieval run through their systems abroad, subject to Frontier's own privacy policy. Price data and the names of visited systems are read from an open service run by the player community (Ardent; its source is EDDN); only a commodity name, a system name or a system ID is sent to it. GalNet news and community goals are read from Frontier's public addresses without sending any of your information.

Retention

Data is retained for the duration of membership. The following are deleted automatically when their period ends, even while membership continues:

• Contact form messages: at most 1 year. If you want them deleted earlier, write to the Founder through the Contact page or on Discord.
• IP addresses in activity logs: 1 year (see below).
• Notifications: 90 days.
• Error logs: 30 days.
• Session record: deleted when the session is closed or has not been used for 7 days; a session lasts at most 30 days even when it is refreshed. A trace of used session keys is kept for 1 hour.
• Discord welcome record: deleted when the person registers on the site, leaves the server or has their account anonymized.
• Backups: encrypted backups are kept for at most 3 months on the server and in Cloudflare R2, and for at most 12 months in Google Drive; a copy deleted from Google Drive stays in its trash for 30 more days and is then deleted automatically. Data that has been deleted or anonymized may remain only in a backup during that period; it is deleted together with the backup when the backup expires. The unencrypted copy of the images you upload, kept in Cloudflare R2, is not deleted automatically: an image deleted on the site may remain there.
• Game panel request: Your request, its state and your note are kept for as long as your membership lasts. The character name and number you wrote in an EVE request are kept only while the request is waiting; they are deleted once the Founder decides (approval or decline). If you withdraw a waiting request it is deleted immediately. When your account is deleted or anonymized, your request and approval records are deleted too. If the Founder removes your access, your links, permissions and collected game data for that game are deleted immediately (in EVE, including the EVE information on the ID card and the EVE notifications in your notification box); if the separate game service does not answer at that moment, the deletion is retried every few minutes and the panel is not opened to you again until it is done. After your access is removed you can apply again.
• EVE Online data: when you remove a character's link, that character's key and records are deleted immediately; the key is revoked at CCP as well (if CCP does not answer at that moment the revocation may fail; in that case you can also remove the permission on CCP's own page). So that the bookkeeping can continue from where it stopped, that character's bookkeeping records up to that day stay in your file as daily totals, without the character's name and ID. "Delete my EVE data" immediately deletes all your EVE data including these totals, the EVE information on your member card and the EVE notifications in your notification inbox. If you withdraw the permission at CCP, the link stops working and that character's data is deleted automatically after 30 days. If you do not open the EVE panel at all for 180 days, all your EVE data and your link are deleted automatically; the EVE information on your member card is cleared and the EVE notifications in your notification box are deleted as well. You are told by a site notification 14 days before the deletion. If you link again later, the data is collected from scratch. Your in-game notifications are kept for 90 days, then deleted. The other party in your loss and kill records (the character IDs of the victim and the attackers and the ships they were in) is kept for at most 1 year, then deleted; the rest of the record (ship, cargo, system, corporation IDs, number of attackers) stays. For records older than one year that come from the archive, the other party is deleted within a day. The names of the other players are never stored. The public market data read for you (prices and market history) carries no identity; it stays in the shared records after your data is deleted. Data in the separate EVE service is not included in backups; deleted data does not remain in a backup either. The member card information (badge and character name) and the EVE notifications written to your notification inbox sit in the main database: "Delete my EVE data" deletes both immediately; otherwise the notifications are deleted after 90 days; both may remain in the main database's backup (for at most 3 months on the server and in R2, for at most 12 months in Google Drive).
• Elite Dangerous data: Events, daily summaries and income and expense items derived from the game journal are kept for 30 days and then deleted automatically; for everything else only the latest state is kept. Turning off Legacy reading deletes the Legacy data read. "Remove link and delete my data" deletes your login key and all your Elite data immediately. A Frontier link is valid for at most 25 days; when it expires you are asked to link again. If you do not link again, your data is deleted automatically after 30 days. Elite data is not included in backups; deleted data does not remain in a backup either.

When membership ends, the data automatically enters processing:

• Deletion request: A member may open a deletion/anonymization request through the panel at any time; at the end of a 48-hour cancellation period, the system executes the request automatically and irreversibly (no one's approval is required).
• Leaving Discord: When a member leaves the server, their account is detected; if they do not return within 30 days, data identifying the person is automatically anonymized.
• Removal from membership (ban): Data identifying the person is irreversibly anonymized (Constitution Article 9.4).
• EVE Online data: When the account is deleted or anonymized (in the three cases above), EVE data is also deleted automatically within 15 minutes at the latest. The deletion is attempted even if the EVE section is switched off at that time; if the separate EVE service is stopped as well, the data is deleted in the first round after the service runs again (no data is collected while the service is stopped).
• Elite Dangerous data: When the account is deleted or anonymized (in the three cases above), Elite data is also deleted automatically within 15 minutes at the latest.

IP addresses in activity logs: 1 year. Audit records (who did what, and when) are kept permanently for community security and governance continuity; however, the IP address at the time of the action is deleted automatically 1 year after the record is created. The record itself is not deleted; only the IP field is cleared.

This period is set from two directions: the security value of an IP address (ban evasion, abuse patterns, suspicious sign-in behaviour) fades within a few months — keeping it indefinitely would breach KVKK's storage-limitation principle. On the other hand, Law No. 5651 requires those classed as "hosting providers" to keep traffic records for 1 year, and that is a minimum. One year satisfies both obligations.

When a member is anonymized, their IP address is deleted without waiting for this period (Constitution Article 9.4).

Your Rights (KVKK Art. 11)

To access, correct, request deletion/anonymization of, and object to the processing of your data. To apply: the data deletion request on the panel's Profile page, the Contact page, or a direct DM to the Founder on Discord. Applications are answered within 30 days at the latest.

This text may be updated as needed; the current version is always available on this page.

Change (2026-10-27): The EVE panel is no longer open only to members of the Kurultaysc [KRTAY] corporation but to members the Founder approves. Your EVE request is saved even if the character you write is not in the corporation; the Founder sees whether the character is in the corporation. If the Founder has lifted the corporation requirement for you, the corporation is not checked when you link a character. A member who leaves the corporation no longer loses EVE access automatically and their data is not deleted for that reason; only the Founder removes access. The KRTAY badge and the KRTAY role on Discord still come only from a character in the corporation.

Change (2026-10-26): The places where the data sits and passes through are now stated: the server and main database in Hetzner's Helsinki data centre (Finland, EU); all traffic through Cloudflare; the off-server copies of the encrypted backups in Cloudflare R2 and in the Founder's Google Drive account. Backup retention is stated per place: 3 months on the server and in R2, 12 months in Google Drive (plus 30 days in its trash); the unencrypted R2 copy of uploaded images is not deleted automatically. The Discord welcome record is described, with when it is deleted. A session lasts at most 30 days; when a stolen key is detected the session is closed and the event is logged with the IP address; other sessions can be closed from Settings. It is stated that no visitor statistics script is used. Corrected: corporation membership is read once an hour, and in Elite the Founder sees only the access; the reference 'Org Rules Art. 9.4' became 'Constitution Article 9.4'.

Change (2026-10-16): The EVE notification kinds in the site inbox are now ten: a player structure holding your assets being about to be abandoned (structure abandonment warning; from EVE's in-game notification, on by default). The public data read for the structure warning is described: the structure's name, the names of the owning corporation and alliance, EVE's war list; personal names are not kept.

Change (2026-10-08, second): The EVE panel is open only to members of the Kurultaysc [KRTAY] corporation. New processing described: an EVE request asks for the name of your character in the corporation, and that name is looked up in CCP's public service (character number and corporation); the name is shown to the Founder until the request is decided, then deleted. When a character is linked and while access lasts, the corporation of linked characters is looked up in the same service; a member with no linked character left in the corporation loses EVE access automatically and their game data is deleted. The Elite panel is unchanged.

Change (2026-10-08): Eight more kinds of data can now be read for members on the EVE panel; the permissions requested went from 18 to 26: loss and kill records, saved fittings, industry jobs, the blueprint list, the mining ledger, planetary colonies, the faction warfare record and research agents. The names of other players in loss records are not stored; they are asked from CCP when the page is opened; the other party's IDs are kept for at most 1 year. For losses older than 90 days the character ID is sent to the zKillboard archive (a new transfer). The window permission is now also used for information and contract windows. A member who wants to save a fitting with the "Save to game" button is asked at that moment for one separate write permission (writing to saved fittings). Mail, the contact list, the calendar, fleet and corporation data are still not requested. For characters linked earlier, the new data is not read until the character is linked again with the new permissions.

Change (2026-10-07): When the data of a member who has not opened the EVE panel for 180 days is deleted, the EVE notifications in the notification box are now deleted too and the day consent was withdrawn is recorded (the same as "Delete my EVE data"). Previously those notifications stayed until their 90-day period ran out.

Change (2026-10-06, second): The EVE Online and Elite Dangerous panels now open on request: a member sends a request and the Founder approves it. The new processing is written down: the Founder sees the applicant's Kurultay name, the game panel asked for, the dates of the request and the decision, and the note; for a member whose access lasts, the Founder sees the number of linked characters (in Elite, whether the commander is linked) and the day the panel was last opened. The sentence "only you can see it on the site; no other member can, the Founder included" holds for game data and was corrected accordingly. Added: game data is deleted immediately when access is removed, and how long the request and the note are kept.

Change (2026-10-06): The EVE Online section was completed. The 18 requested permissions are listed one by one (the structure market permission is no longer requested). The nine kinds of EVE notification written to the notification inbox and the "permission lapsed" notice that does not depend on the settings are listed. New periods: in-game notifications 90 days; the EVE data and link of a member who does not open the EVE panel for 180 days are deleted (a site notification tells the member 14 days before the deletion). "Delete my EVE data" now also deletes the EVE notifications in the notification inbox immediately. Added: the bookkeeping records of an unlinked character stay as nameless daily totals, public market data without identity stays in the shared records after deletion, the member card reads corporation membership once a day, the "show my name" choice is switched off when the name on the card changes, the day of unlinking and of deleting data is stored, and how deletion proceeds while the section is switched off.

Change (2026-10-03): The Elite Dangerous link now reads everything Frontier provides: every event in the game journal, each ship's full loadout, storage, the on-foot locker and backpack, all fleet carrier information, account details (expansions, Merc Coin, game mode and version), visited systems, the optional Legacy galaxy, community goal contributions and GalNet news. It now states that other players' names in the journal are replaced with "a player" and that chat text is not kept, and that everything derived from the journal (income and expense items included) is kept for 30 days.

Change (2026-10-02, third): The text was completed so that it lists every item the panel stores. For EVE, the skill queue and attributes, whether you are in the game and your last login and logout time, implants, date of birth and security status, structure names, the information you enter on the panel yourself and the two action permissions (opening the market window, setting a route waypoint) were written down; it now states that the character name for the member card and the EVE notifications sit in the main database. For Elite, the vehicles in the hangar, income and expense items, finished mission IDs and the time you last opened the panel were added; the commander name and deletion sentences were corrected to match the single button on the panel. It now states that the date of the confirmation given when linking and the text version are stored.

Change (2026-10-02, second): The data read through the Elite Dangerous link was extended: the modules of the active ship, on-foot gear, the market and shipyard of the last docked station, community goals; open missions, materials, engineer progress, reputation, statistics, pledged power and squadron name are now also derived from the game journal. Daily play time and the time of the last session, derived from the journal and kept from the start, were added to the list.

Change (2026-10-02): An optional Elite Dangerous link was added: what data is fetched, where and how it is kept, who can see it, the transfer via Frontier, explicit consent and deletion periods are described.

Change (2026-09-30): Kurultay is now also open to EVE Online and Elite Dangerous players. The survey asks which games you play (a fixed option); RSI information is asked only of Star Citizen players. An optional EVE Online link was added: what data is fetched, where and how it is kept, who can see it, the transfer via CCP, explicit consent and deletion periods are described.

Change (2026-09-27): The page now shows this document; it previously showed an older copy from the language files, which still said we "process" the name and full date of birth that stopped being collected on 15 September. The promised 1-year deletion of contact form messages now runs automatically. The sentence "session information is stored only in your browser" was corrected (the server also keeps a session record). The activity record, RSI verification history, "title and author only" for the forum, and retention periods (notifications, error logs, sessions, 3-month backups) were added.