Privacy Policy

In short

We process the data needed to keep your account open, hold the portfolio records you type in, and run the site. We use no advertising network, no tracking pixel, no tag manager and no analytics vendor. We do not sell any data and we do not share it for marketing. There is no cookie consent banner on the site, because we use no cookie that needs consent. Third-party code is loaded into your browser in one place only, and only when you ask for it: the TradingView chart in the VIX box.

1. Who we are

This policy applies to the mergen.finance site. You can reach us about anything to do with the site at info@mergen.finance.

The site is operated by Mergen Finance, which is also the data controller under the KVKK. The data controller’s identity and the address for applications are given in the last section of this policy; the same section closes the KVKK information notice.

2. What this policy covers

The site offers: market screens; news summaries written in our own words with a link to the source; readings of KAP disclosures; AI-generated analyst identities and commentary; a portfolio tracker into which you type your own records; and a credit system. The plans are Ücretsiz (free), Mergen and Pro.

Three things up front, because the rest of this text rests on them:

• There are three ways to sign in: a one-time link sent to your email address, “continue with Google”, or email and password. A password, if you choose one, travels from your browser directly to our authentication infrastructure over TLS and is stored there only as a one-way hash; the password itself never reaches our servers and we cannot see it.
• New sign-ups are currently closed. Registration is switched off at the authentication provider level; no new account can be created until launch.
• Payments are not open yet. There is no checkout step on the site and no payment provider is connected. No card or payment information is collected or stored.

3. The data we process

• Account data. Your email address and your display name. If you choose “continue with Google”, your account is matched to the email address Google verifies.
• Usage data the site needs to function. Keeping your session alive, your language and theme choice, and holding your plan and credit balance against your account; alongside that, the technical records that arise while serving requests, as on any web server.
• Portfolio records. Portfolio name, transaction date and type, asset class, symbol, quantity, unit price, currency, commission and your own notes. You enter these. We do not connect to any exchange, bank or wallet account of yours; we do not, and cannot, verify whether the records you enter correspond to real holdings.
• Credit and referral records. Which task you completed and when, the credit you earned, and your credit balance. If you arrived through an invite link, which invite brought you is held in a short-lived cookie in your browser; that cookie carries no identity.
• Newsletter preference. Whether you ticked the newsletter box while signing up. That preference is recorded; as of today no newsletter is being sent.
• Cookies and browser storage. The full list and the durations live on the Cookie Policy page. We do not copy the list into this text: a table kept in two places eventually drifts apart, and nobody checks the copy that went wrong. The one correct list is there.

What we do not process. No payment or card information is collected or stored. No location data is collected. No special categories of personal data (health, belief, biometrics and so on) are processed. No advertising profile is built. Your data is not sold and is not shared with third parties for marketing.

4. Why we process it, and on what legal basis

• Membership, sign-in, account management, the portfolio tracker, the credit and referral system — necessary for the conclusion and performance of the contract (KVKK art. 5/2-c).
• Security of the service, prevention of abuse and of the same task being credited twice — legitimate interest (KVKK art. 5/2-f).
• Loading the TradingView chart in the VIX box on the US equities page — your explicit consent (KVKK art. 5/1). You give it by pressing the box’s “Show on TradingView” button yourself, and it holds for that one opening only; if you do not press it, the chart never loads.
• Meeting legal obligations — legal obligation (KVKK art. 5/2-ç).

When newsletter sending begins, separate and explicit consent will be obtained for commercial electronic messages; because nothing is being sent today, this text describes no sending practice.

5. Cookies

There is no cookie consent banner on the site. Every cookie we use is strictly necessary to run the site or completes something you did yourself: your session, your language, the invite code that brought you, your newsletter choice at sign-up, and a short-lived marker that brings you back to your profile page when you sign in again to delete your account. None is for measurement or advertising and none is sent to a third party, which is why none depends on consent.

Some of your settings (the theme, the state of the side menu, the currency on the commodities page and the like) are kept not in a cookie but in your browser’s own storage. They stay on this device, carry no identity and are never sent to our server.

Until 22 October 2026 the site had a cookie banner with three classes; it was removed because the permissions it asked for no longer switched anything. A mergen_consent cookie left behind by that banner is no longer read, and deletes itself from your browser when it expires.

Which cookie and which browser-storage entry is used for what, and how long it lasts, is set out row by row on the Cookie Policy page.

6. Third parties your browser connects to directly

Most of the site talks to our own server only: our servers fetch market data from its sources and we show it to you. These are the places where your browser connects directly to a third party; this is the whole list.

• Binance — live crypto prices. When a page shows live crypto prices (the crypto page, crypto symbol pages, the comparison desk and the watchlist in the side rail), your browser connects directly to Binance’s public price stream (stream.binance.com). Over that connection your IP address and browser information reach Binance; your account, email address and portfolio are not sent. Binance processes that data under its own privacy policy: https://www.binance.com/en/privacy
• Supabase and Cloudflare — sign-in and account operations. When you sign in, and for some operations on your account, your browser connects directly to our authentication infrastructure (see section 7).
• Bugsink — when an error happens in your browser, the error report is sent directly from your browser (see section 7).
• Google — only if you choose “continue with Google”.
• TradingView — only when you yourself press “Show on TradingView” in the VIX box on the US equities page. Before you press it, your browser sends TradingView no request at all. Once you do, TradingView’s code runs in your browser; your IP address and browser information reach TradingView, and TradingView may use its own cookies and measurement (Snowplow) on its own domain. TradingView processes that data under its own privacy policy: https://www.tradingview.com/privacy-policy/. The chart is removed when you press “Close” or leave the page; your choice is not stored and you are asked again the next time.

Fonts are served from our own origin; no request goes to Google Fonts or to any other font provider. There is no third-party measurement tool, pixel, advertising network or tag manager on the site. The one thing we do measure is a page-view counter on our own server: for each news and KAP item it keeps a single integer total, no identifier and no timestamp, and it sets no cookie; the detail is in the Cookie Policy.

7. Service providers and where the data physically sits

We use the following providers to deliver the service. This is the whole list.

• Hetzner Online GmbH — web and API servers. The servers are in Nuremberg, Germany.
• Supabase — membership, database and authentication. Hosted on AWS infrastructure inside the European Union; region: eu-central-1 (Frankfurt). Your account, portfolio, credit and referral records are held here.
• Resend (over Amazon SES) — sending transactional email such as the sign-in link. The sending infrastructure is in Ireland. Your email address is passed to the provider for this.
• Cloudflare — the edge network in front of the Supabase API endpoint; global.
• Bugsink — error reporting. Errors on the site and in the API are reported here. The service is provided by Bugsink B.V.; under its data processing agreement (DPA) the data is stored and processed only inside the European Union (infrastructure: Hetzner, Nürnberg (DE)). A report carries: the type and message of the error, a stack trace, the lines of our own source code around the failure (sent for errors that happen on our servers; not for errors that happen in your browser), your browser information, the page you came from (the referer), and the address of the page the error happened on — including the query part after the question mark. Those last three apply only to errors that happen on the site’s own side; an error in the API carries the error alone, with no request information, no address and no browser information. In that address only the values of eight keys whose names denote a secret (code, token, key, secret, access_token, refresh_token, apikey, next) are removed; every other key, and its value, goes as it is. Never sent at all, structurally: your session cookies, the body of the request, the query-string field, the user record and the local variables of stack frames — these are dropped whole when the report is built. On top of that, anything in the outgoing text shaped like an email address, a JWT or a “Bearer” token is rewritten; because that is a shape match, an address carried in an unrecognisable form (percent-encoded, say) can get through, and we say so here. Errors that happen in your browser are sent to Bugsink directly from your browser, so whatever the report contains, your IP address reaches Bugsink. Retention is not defined in days: Bugsink keeps the number of most recent reports this installation is configured for and deletes the oldest once that number is reached. That is a setting in the provider’s own console; we cannot independently measure it.
• Google LLC — only if you choose “continue with Google”, for authentication. Google operates globally, including in the USA.
• Binance — the live crypto price stream; your browser connects directly (see section 6). Global.
• TradingView — only if you open the chart in the VIX box yourself (see section 6).

There is no analytics vendor, advertising network, pixel or tag manager on this list, because we use none. Our page-view counter is not on this list either: it writes to our own server, not to a third party. Our servers fetch market data from public or licensed sources, chiefly gold-api.com, Twelve Data, TEFAS, the CBRT, the EIA and FRED. Nothing about you is sent in those requests, which is why those sources are not on the list above.

8. Transfers abroad (KVKK art. 9)

Let us be plain: our servers being in Germany and in the EU is itself a transfer abroad under KVKK. Data resting in Europe does not make it data kept inside Türkiye; our old text did not present this as a transfer, and this text does.

• Hosting, membership infrastructure and transactional email (Hetzner, Supabase, Resend/Amazon SES, Cloudflare) — the transfer is necessary for the contractual performance of the service we provide to you (KVKK art. 5/2-c). Without these providers your account cannot exist.
• Live crypto prices (Binance) — when a page shows live crypto prices your browser connects directly to Binance and your IP address reaches Binance. Binance operates globally. Legal basis: delivering the live prices you asked to see — performance of a contract and legitimate interest (KVKK art. 5/2-c, art. 5/2-f).
• The TradingView chart in the VIX box — this transfer happens only when you open the chart yourself, and rests on the explicit consent that click gives. If you do not open it, the transfer never happens.
• Sign in with Google — happens only if you choose that method yourself; Google operates globally, including in the USA.

There is no separate consent checkbox at sign-up for transfers abroad. In reality there are two acts: creating your account and, if you wish, opening the VIX chart. This text relies on those two and nothing else.

You will find the detailed breakdown in the KVKK Aydınlatma Metni; the two texts use the same legal bases.

9. Retention periods

• Account data (email, display name, plan): for as long as your account exists.
• Portfolio records: until you delete them or your account is closed.
• Credit ledger and referral records: for as long as your account exists — they are needed to stop the same task being credited a second time.
• Newsletter preference: for as long as your account exists, or until you withdraw it.
• Pro early-access request: until it is settled, one year at most. It is deleted within 30 days of Pro sales opening; a request a year old is deleted by the nightly job. To have it deleted sooner, write to info@mergen.finance.
• Access request (“Request access”): until it is settled, then 12 months; deleted by the nightly job.
• Plan box measurement (no identity): single records 90 days, then daily totals only.
• Server access logs (IP address, browser information, requested address): 14–15 days. The nginx access log is rotated daily, 14 archived copies are kept and the oldest is deleted; so long as the log is written to every day, the window is between 14 full days and 15 days. This period is verified by the date of the oldest record that actually survives on the server, not read off a configuration file.
• Server error logs (the same IP addresses; requests that hit the rate limit or ended in an error): no fixed ceiling. The error log is rotated by the same rule, with 14 archived copies; but rotation is skipped on days when the file is empty. Those same 14 copies therefore cover a stretch appreciably longer than 15 days whenever errors are sparse — at the last measurement that meant a stretch of about nineteen days. Until the period is pinned to a number of days we do not describe this log as a 14–15 day one.
• Application logs (journald): bounded by size rather than by time — 1 GB at most. That bound is currently full, so the window is set by the volume of logging rather than by a period: more logging shortens it, less lengthens it. Today it reaches back about as far as the access logs, but that is a consequence of current volume, not an undertaking.
• Abuse and blocking records (fail2ban): 365 days, and indefinitely for permanently blocked sources. These are kept for sources that try to log in to the server; an ordinary site visit’s IP address does not enter them — the rules enabled today watch SSH login attempts and repeat offenders, nothing else. What is kept is not only the address: beside nearly every record we also store the raw log lines that show the attempt, including the username that was tried. A source blocked five times in quick succession is blocked permanently, and its record is exempt from the 365-day purge and kept indefinitely. The 365 days is read from the setting rather than measured; the store is not yet that old.
• Cookies and browser storage: the duration written next to each row in the Cookie Policy applies. We do not repeat those durations here; the one correct list is there.

A nightly job deletes records whose period has expired: how long each record is kept and the mechanism that deletes it are set out record by record in the Retention and Destruction Policy. For records with no defined period, the principle we apply is this — data is deleted when the purpose of processing has fallen away and any statutory retention obligation has ended.

You can delete your account and records yourself, with the “Delete my account” button on your Profile page. Deletion is irreversible; for security it requires a recent sign-in and asks you to confirm by typing your account’s email address. You may also write to info@mergen.finance if you prefer. When you press the button, the account and the records attached to it (portfolio, credit ledger, referral record, your address on the launch-notification list) are deleted from the live database while you wait. There is no backup or archive in which those records are kept; deleted records cannot be brought back. The launch-notification list is searched by the address on your account only: if you joined it with a different address, that row is not found and is not deleted with your account. The launch announcement has not been sent yet; when it is, the link in that email will delete the row rather than merely unsubscribe it. The route that works today is this: write to info@mergen.finance and we will delete that row. Some things the deletion does not reach; the main ones are: records for which a statutory retention obligation has arisen stay, severed from your identity; and the server logs keep your connection details on the terms written in the list above. A third thing stays, and we write that down too: the record of your request. That it was received and carried out is written to a record that cannot be altered afterwards — the account identifier, the timestamps, and a short technical note about how the request arrived or why it failed — and it outlives your account, because it is the proof you exercised the right. It carries no name, no email address and no IP address.

10. Your rights

Under KVKK art. 11 you have the right to learn whether your data is being processed, to request information about it, to have it corrected, to request its deletion, to know the third parties it has been transferred to, to withdraw your explicit consent, and to complain to the Personal Data Protection Authority (Kişisel Verileri Koruma Kurulu).

The full list of rights and how to make an application are on the KVKK Aydınlatma Metni page. For requests: info@mergen.finance. Your application is concluded within thirty days at the latest.

You do not need to make an application to withdraw the consent you gave for the VIX chart: pressing “Close” or leaving the page removes the chart, and because your choice is not stored you are asked again the next time. You can delete the cookies TradingView set on its own domain from your browser settings; they sit on its domain and we cannot delete them.

11. Security

Without overstating it:

• Passwords are held by our authentication infrastructure, not on our servers, and only as a one-way hash; we hold no plain-text password that could leak. Anyone who prefers not to use one can sign in with a one-time email link or with Google.
• Site and API traffic is encrypted in transit with TLS.
• Row-level access rules apply in the database: you cannot read anyone’s records but your own.
• The security of your account depends largely on the security of your mailbox; the sign-in link goes there.

Absolute security cannot be promised for any system, and we do not promise it.

12. Children

The site is not aimed at anyone under 18, and we do not knowingly collect data from anyone under that age.

13. Changes to this text

This text is updated when the data we process, the providers we use or the cookies change. No cookie that needs consent, and no new third-party component loaded into your browser, is added without asking you first.

14. Governing text

The Turkish version of this policy governs. The English translation is provided for convenience only; if the two differ, the Turkish text prevails.

15. Contact and data controller

Data controller: Mergen Finance — Ediz Emre Yıldırım.

For questions about this policy, about your personal data and for applications under Article 11 of the KVKK: info@mergen.finance. How to apply, and how quickly an application is concluded, is set out in section 9 of the KVKK information notice.