Privacy Policy

01Who is responsible

• The KONYAMUN organising team is the data controller. Accounts are created by the team; there is no self sign-up in the app.

02What we process

• Account details: full name, username, a one-way hash of your password, role (delegate, academy, organisation), committee, represented country, title or unit, language preference and accommodation status.
• Contact details: email address and phone number, both optional.
• Application details: full name, the five-character application code issued by the team, email and phone if given, the role applied for, committee and country preferences, the status of the application and the note shown to you.
• Conference records: attendance, feedback written by your chairs, your answers to the 22:00 hotel check, messages with your PR contact and chairs, and your minigame scores.
• Technical records: time of your last sign-in, a counter of failed sign-in attempts and the end time of a temporary account lock if one applies, your device’s notification address if you allowed notifications (including an iOS device token), and an audit log of changes administrators make in the panel.

03What we do not ask for

• No national ID, passport or other official document numbers.
• No access to your location, contacts, photos or files. The camera only opens while the organising team scans an attendance code; nothing is recorded or sent to the server.
• No payment details and no special category data such as health, religion or political opinion.

04Why we use it

• To take attendance; to bring you the schedule, announcements and committee information; to connect you with your PR contact and chairs; to run applications; and to look after participants staying in conference accommodation at night.
• Notifications are sent only if you allow them, and you can withdraw that permission in your device settings at any time. They are sent for new messages, announcements, published feedback and the hotel check; a message notification shows only who sent it, never what the message says.
• Your data is never used for advertising or profiling, and it is never sold.

05Who sees what in the app

• The organising team sees attendance, schedule and accommodation records. A PR member only messages the delegates assigned to them and only receives their hotel-check alerts.
• Chairs see attendance for their own committee only and write feedback for those delegates. Feedback stays hidden from the delegate until the chair publishes it.
• Administrators can access all records, including applications.
• Delegates in the same committee see each other’s name and represented country on the committee page, which also lists the committee’s chairs by name and title.
• On the minigame leaderboard, if you have played, your name, committee and country are listed to people in your own unit.

06Service providers and international transfers

• The app runs on Vercel and the database is hosted by Neon. The servers we use for both are located in the United States, so your data is transferred to these providers under the cross-border transfer rules of the KVKK and the GDPR.
• Notifications are delivered through Apple’s push service and your browser’s own push service; only the notification text and device address are sent to them.
• If the organising team turns it on, admin tables are mirrored to Google Sheets, in which case account and conference records are also written to a spreadsheet in the team’s Google account.
• Prayer times are fetched from the Aladhan service; no information about you is included in that request.
• Like any website, the hosting providers may keep requests, including the IP address, in technical logs for a short time; we do not use these logs to track you. To slow down repeated sign-in attempts, your IP address is counted only temporarily in server memory and is never written to the database.

07What stays on your device

• A session cookie that keeps you signed in: valid for one year if you tick "Remember me", otherwise for at most 12 hours. We use no advertising or tracking cookies.
• Your language choice, kept in the browser’s local storage and in a language cookie (kmun_locale) valid for one year, so pages opened without signing in appear in your language.
• In the mobile app, a copy of your attendance QR code so it can be shown without an internet connection. When you sign out, that copy and your notification registration are removed.

08Security

• Passwords are never stored in plain text, only as one-way bcrypt hashes.
• Every connection to the app and to the database is encrypted (HTTPS and certificate-verified TLS).
• Attendance QR codes are signed with a per-person key; rotating the key invalidates the old code. Changing a password or closing an account ends every other open session immediately, and from your profile you can sign out of all devices at any time.
• After 10 wrong password attempts in a row the account is locked for 5 minutes, so your password cannot be guessed by trial and error.

09How long we keep it

• Account, application and conference records are kept for as long as they are needed to run the conference. After the event the organising team deletes them; this is done by hand and is not tied to an automated schedule.
• If you want it gone sooner, just write to us by email: your account and its messages, attendance, feedback and score records will be deleted by the team.

10Your rights

• Under Article 11 of Turkish Law No. 6698 (KVKK) and the GDPR you may learn whether your data is processed, access it, ask for it to be corrected or deleted, object to its processing and find out which recipients it has been shared with.
• Send requests to the address below; we reply within 30 days at the latest.

11Participants under 18

• Details of participants under eighteen are entered by the organising team with the consent of a parent or their school.

12Changes to this policy

• If the information the app collects or the services we use change, we update this page. The effective date is always shown at the top.

Contact us

For any privacy question or request: