Privacy policy

Climaturk is run by a group of meteorological engineers with degrees from Istanbul Technical University (İTÜ), ETH Zurich and EPFL, who are responsible for the data described here. For anything about your data, write to info@climaturk.com.

Every part of Climaturk works without an account. Your map settings are kept in your own browser (local storage) and are not sent to us unless you sign in.

To see how the site is used and to fix errors, the Lab sends us small anonymous events: the pages, modes and tools chosen, and browser error messages. No cookie and no IP address are used for this: a visitor is counted with a code that changes every day and cannot be traced back to anyone. These events are kept for about thirteen months.

Like every web server, ours records each request, including the IP address and browser, to keep the site secure and working. These logs are replaced automatically once they reach a fixed size, normally within a few weeks.

Your email address. Your password only as an Argon2id hash: a one-way code from which the password cannot be recovered, not even by us.

If you use “Continue with Google”: Google's number for your Google account and the email address Google confirms. We don't receive your name, picture, contacts or anything else from Google.

Your signed-in devices: the kind of device and browser (for example “desktop · chrome”) and when each was last active, so you can see and sign them out. No IP address is kept with them.

Your preferences: the Lab's map settings and the favourite places you save.

For security, recent sign-in, sign-up and password-reset attempts are kept for up to one day as keyed codes made from the IP address and email address, so that password guessing can be stopped. The codes cannot be turned back into the address.

Your account data: to provide the account you asked for (GDPR Art. 6(1)(b); in Türkiye, KVKK Art. 5(2)(c)). Security measures, server logs and anonymous statistics: our legitimate interest in a safe, working site (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).

Hetzner Online GmbH hosts our server in the European Union.

Güzel Hosting, which hosts our email (climaturk.com) on its servers in Türkiye, sends our account emails (confirming your address, resetting your password) and so receives your email address and those emails.

Google Ireland Ltd, only if you choose “Continue with Google”; Google's own privacy policy then applies to your Google sign-in.

When you choose a password, we check it against known breached passwords with the Have I Been Pwned service. Only the first five characters of a hash of the password are sent, which reveals nothing about the password or about you.

We use no advertising, no tracking cookies and no analytics companies.

Signing in sets one cookie, __Host-climaturk_session, which keeps you signed in for 30 days after your last visit. During a Google sign-in a second cookie lives for at most ten minutes. Both are strictly necessary for the sign-in you asked for, so they need no consent banner. The Lab also keeps your settings in your browser's local storage.

Your account data until you delete your account. A signed-in session ends 30 days after its last use. An unconfirmed sign-up is removed after 24 hours, a password-reset link after one hour. Nightly backups of the account database are kept for 14 days, so a deleted account is gone from them within two weeks.

You can see, download and delete your account data yourself on your account page at any time. You also have the right to have data corrected, to restrict or object to its processing, and to data portability. Write to us for any of these.

You can complain to a data protection authority: in the EU, the authority where you live (in Germany, your state's data protection commissioner); in Switzerland, the FDPIC; in Türkiye, the Personal Data Protection Authority (KVKK).

If this policy changes, the date at the top changes too. We will tell account holders about important changes by email.