Privacy Policy

This policy covers the account, project, team, task, chat, calendar and other features of the PDA web application. When you go to external GitHub or Google pages, the privacy terms of that service apply.

The data controllers are Hamza Taşbay and Alper Temiz, natural persons and maintainers of the open-source PDA project. You can reach us through the contact form or at info@pd-assistant.com.

The detailed information under the Turkish Law No. 6698 (legal bases, transfers, your rights) is in the KVKK Privacy Notice; this policy is a user-oriented summary of the same information.

Depending on the features you use, the following information is kept. Passwords are not stored in plain text; they are protected by a one-way password hash.

• Account: e-mail, nickname, account status, registration times, the ID of a linked external sign-in provider if any; first and last name (on accounts created through an invitation); optional profile photo.
• Two-factor authentication (optional): the authenticator secret is stored encrypted, backup codes as hashes.
• Projects and teams: projects, memberships, roles, invitations, accept or decline responses, project logo and banner, organisations and their images.
• Work content: tasks, comments, file attachments, time entries, success criteria, calendar entries and reminders, project chat messages (with replies and reactions), in-app notifications and the notification history, only for the features you use.
• Session: session times, browser/device information and secure session verification records. The network address is used for request rate limiting.
• Support messages: the name, (optional) last name, e-mail address, category and message you write in the contact form.
• Visit analytics (only with your consent): an anonymous visitor and session ID, page type, source of the visit, active time, whether certain buttons were clicked and the type of an error.

Account information is used for signing you in and protecting your account; project, team and task data is used to provide your shared workspace. Invitations and notifications are delivered to the person concerned. Controls such as sessions, rate limiting and bot traps aim to reduce unauthorised access and abuse. Support messages are used to answer you.

Visit analytics is used only with your consent, to understand anonymously how the site is used and where errors occur. It is not linked to your account.

Do not add special categories of personal data, passwords or unnecessary information about other people to project descriptions, comments, chat and files.

Workspace content is limited by project membership and role permissions. Authorised project members can see your e-mail and nickname in team lists; the project chat is visible to the project's members. The recipient of an invitation can see the invitation preview shown to them.

Only the PDA administrator can see your support messages. The administrator account can see the account list (e-mail, nickname, status), session records and support requests, and can disable accounts. Administrator actions are written to the administration audit log.

When you choose Google/GitHub sign-in, authentication takes place with that provider; the repository connection reads GitHub's public repository information. Your data is not sold and not shared for advertising.

You can delete your account yourself on the account screen. The action is confirmed with a short-lived one-time link sent to your e-mail and your own sign-in credentials.

The moment the account is deleted it is anonymised: the e-mail address, name, nickname and password hash are erased, all sessions are closed and project memberships end. This cannot be undone.

If you own a project or an organisation, you must transfer ownership or delete the project/organisation before deleting your account. The administrator account cannot delete itself. After deletion, the account may still appear with an anonymised identity in other users' project records (for example in task history).

An administrator can disable an account for misuse or security reasons; sessions are then closed and sign-in is blocked, and no data is deleted.

PDA uses no advertising cookies or third-party tracking tools; fonts are loaded from PDA's own server. Session and security cookies are necessary for the application to work. Visit analytics runs only with your explicit choice and is off by default.

Every cookie and storage entry is listed with its purpose and duration in the Cookie Policy; you can change your choice there or with the “Manage cookie preferences” link at the bottom of the page.

E-mails are sent through Hostinger Email SMTP. The optional Google/GitHub sign-in and the GitHub repository features connect to the respective providers (USA). The hosting provider has not been chosen yet; this policy will be updated once it is.

Details of these transfers (recipients, country, which data goes where) and their current status under Article 9 of the Law are in the “Recipients and transfers abroad” section of the KVKK Privacy Notice and in the GDPR sections below; the controllers track compliance of these transfers.

At the end of the periods below, data is deleted or anonymised automatically.

PDA keeps session tokens in HttpOnly cookies, stores passwords as one-way hashes, encrypts two-factor secrets, checks project permissions on the server and protects administrator access with a separate two-factor sign-in. The contact form uses bot traps that send no data to a third party instead of a CAPTCHA.

These measures are not an absolute security guarantee. On shared devices, sign out when you are done and consider enabling two-factor authentication.

PDA is not directed at children. Minors should use PDA with the knowledge of their legal representative.

For visitors in the European Union or the European Economic Area, the following information is given under Articles 13 and 14 of the General Data Protection Regulation (GDPR). The controllers are Hamza Taşbay and Alper Temiz, natural persons and maintainers of the open-source PDA project, based in Türkiye. Contact: the contact form or info@pd-assistant.com. No data protection officer has been appointed.

We process personal data on the following bases.

• Art. 6(1)(b), contract: creating your account, authenticating you and providing the workspace you ask for under the Terms of Use. Providing the e-mail address, nickname and password is necessary for this; without it no account can be created.
• Art. 6(1)(f), legitimate interests: security of accounts and systems, preventing abuse (sessions, rate limiting, bot traps, administration audit log) and answering contact-form messages. Our interest is to run a secure service and to reply to the people who write to us; you can object (see your rights).
• Art. 6(1)(a), consent: optional visit analytics, including button-click and error events, and only after you opt in in the cookie layer. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
• Art. 6(1)(c), legal obligation: answering requests of data subjects and authorities and keeping records where the law requires it.

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22). We do not intentionally process special categories of data (Art. 9).

Recipients are the project members you work with, Hostinger Email (e-mail), Google (optional Google sign-in), GitHub (optional sign-in; repository features) and, once chosen, the hosting provider. The controllers themselves are located in Türkiye, a third country without a European Commission adequacy decision.

Personal data is transferred to the USA, to Google LLC (optional Google sign-in) and GitHub, Inc. (GitHub API; optional GitHub sign-in). Verification and reset codes and notifications about contact-form messages are sent through Hostinger Email; processing locations and transfer terms for the e-mail service are assessed separately against the provider agreement; sign-in identifiers go to Google or GitHub only if you choose that sign-in; repository metadata requests go to GitHub when you use the repository feature. The optional sign-ins and the repository feature can be avoided; you can also register with e-mail and password. The controllers track the compliance of these transfers with Chapter V GDPR and Art. 9 KVKK (appropriate safeguards such as standard contractual clauses under Art. 46) and will update this text as such safeguards are put in place. This text does not claim that any specific safeguard or contract is already in place.

The criteria and periods are those in the retention table above: accounts until you delete them (anonymised at once), analytics data 12 months, ended sessions 30 days, contact-form status records and stored support messages 12 months, administration audit log 24 months.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21), and the right to withdraw consent at any time (Art. 7(3)). Send your request through the contact form (category “KVKK / data request”) or to info@pd-assistant.com; we reply within 30 days at the latest.

You can delete your account yourself. Data portability is not yet a self-service function; we provide your data in a structured, commonly used format on request.

You have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or place of the alleged infringement (Art. 77), as well as with the Turkish Personal Data Protection Board.

The controllers are established outside the European Union. Whether Article 3(2) GDPR applies to PDA, and therefore whether a representative in the Union must be appointed under Article 27, is being assessed. No representative has been appointed at present; this section will be updated when the assessment concludes.

When features or the conditions of data processing change, this policy is updated and the “Last updated” date at the top of the page changes. Significant changes are published on this page.