Privacy Policy

Last updated: 2026-10-05

Ushkur is a simple notebook that asks for no email and no username. This page explains in plain language what data is processed and why.

In short

  • You are not asked for personal details such as a name, email or phone number.
  • Your account is identified only by your key. The key itself is not stored, only an irreversible hash of it.
  • Your note titles, subtitles and text are stored encrypted on the server.
  • There are no ads, no analytics and no third-party trackers. Your data is not sold.

What is stored

No name, email, phone number or IP address is stored with your account. What is stored:

  • A hash of your key. The key itself is never stored or logged.
  • Your notes: title, subtitle, text (encrypted), creation and update times, the time it was moved to the trash, and its category.
  • Your category names (stored unencrypted).
  • Your account counters: number of notes, number of categories and space used. They are needed to enforce the limits.
  • Session records: one record per open session. Only a hash of the session token and timing information are stored.

Encryption

Title, subtitle and note text are encrypted on the server with AES-256-GCM before they are saved. The encryption key is kept in Ushkur's server secrets, not in the database. The database provider also encrypts its disks.

This is not end-to-end encryption: to show and search your notes, the server decrypts them. The encryption protects against a database leak and against backups, not against the server itself.

Your key is hashed with PBKDF2 together with a secret value that exists only on the server. When you sign in, your key is sent to the server once over HTTPS and is hashed right away.

Cookies and browser storage

The only cookie is the refresh cookie that keeps you signed in (__Secure-refresh). JavaScript cannot read it (HttpOnly), it is set only when you sign in, it is valid for up to 30 days (it is extended as you use it) and it is removed when you log out. It is strictly necessary, so no separate consent is asked.

The browser's localStorage holds only your settings: language (ushkur.lang), theme (ushkur.theme) and the editor's full-page preference (ushkur.pref.fullPage). Your key and note text are not stored in the browser. Unsaved text stays in memory only while the page is open. If the page is reloaded during an update, a temporary timestamp is kept in session storage.

A service worker is used to open the interface offline. It caches only the interface files and never touches API requests or your notes.

Service providers

Ushkur runs on Cloudflare: Cloudflare Workers (the application), Cloudflare D1 (the database) and Cloudflare KV (small settings without personal data, such as a maintenance flag). The domain and traffic also go through Cloudflare.

On the sign-in and account creation screens, Cloudflare Turnstile runs a bot check. It may send some technical information from your browser to Cloudflare, which processes it under its own privacy policy.

Fonts are loaded from the app itself, with no external services such as Google Fonts. There are no analytics, ad or social media trackers.

Logs and abuse protection

The server writes a short technical record for every request: method, route pattern, status code, duration, error code, database counters, the Cloudflare data center and, if you are signed in, your account's random id. Some security events are also written (failed sign-in, account creation, log out of all devices, key change, account deletion).

Your key, tokens, cookies, note contents and IP addresses are not written to these records.

To limit abuse, Cloudflare's rate limiting briefly processes your IP address. The application does not store it.

How long data is kept

  • Notes and categories are kept until you delete them. Notes moved to the trash are deleted permanently after 30 days.
  • Accounts are not deleted automatically, you delete your account yourself.
  • Session records expire and are deleted after 30 days without use. They are deleted immediately when you log out.

Your control

  • You can delete your account from the account menu by confirming with your key. All notes and categories are deleted immediately.
  • You can move notes to the trash, delete them permanently or empty the trash.
  • You can log out of all devices and change your key.
  • There is no bulk export at the moment. You can copy a note's text.

Security and limits

If you lose your key, your account cannot be recovered. This is by design. Choose a long key that is hard to guess; “Generate one” creates a strong key.

No system is completely secure. Keep a separate copy of notes that matter.

Changes and contact

This text may change. The last updated date is at the top of the page. Questions: emrecankkaratas@gmail.com

KVKK notice (Turkish data protection law)

Information under article 10 of the Turkish Personal Data Protection Law no. 6698 (KVKK).

Data controller

Emre Can Karataş, an individual who operates Ushkur (no company). Contact for all requests: emrecankkaratas@gmail.com

Data processed

A hash of your key, the notes and categories you write, account counters, session records, technical logs and security records. Your IP address is processed briefly for rate limiting. Details are above.

Purposes

  • Opening your account and verifying you with your key.
  • Storing, listing and searching your notes.
  • Enforcing the limits.
  • Keeping the service secure and preventing abuse.
  • Operating the service and finding errors.
  • Meeting legal obligations.

Legal basis

KVKK article 5/2: (c) processing is directly related to the conclusion or performance of a contract (providing the service), (f) the legitimate interests of the controller (security, preventing abuse, debugging) and (ç) a legal obligation (if there is a legal request).

Ushkur does not read the content of your notes and does not use it for any other purpose. What you write in your notes is up to you. This content is stored encrypted only to provide the service you asked for.

Transfers

Data is transferred to and processed by the infrastructure provider Cloudflare (based in the USA, with a global network). This can mean a transfer abroad. A Western Europe location is preferred for the database. Data is not passed to anyone else and is not sold, except where the law requires it.

How data is collected

Data is collected from what you enter while using the app and automatically (technical records).

Your rights (article 11)

You can apply to the data controller to:

  • Find out whether your personal data is processed and ask for information.
  • Learn the purpose of processing and whether it is used accordingly.
  • Know the third parties your data is transferred to, in Turkey or abroad.
  • Ask for correction if it is incomplete or wrong.
  • Ask for deletion or destruction under the conditions in the law, and for this to be notified to third parties the data was transferred to.
  • Object to a result against you that comes from analysis by automated systems.
  • Ask for compensation if you suffer harm because of unlawful processing.

How to apply

To apply: emrecankkaratas@gmail.com. Ushkur does not know who you are (no name or email is stored), so we can verify that an account is yours only by its key. The easiest way to delete your data is “Delete account” in the account menu of the app.

Your application is answered as soon as possible and within 30 days at the latest. If you are not satisfied with the answer, you keep the right to complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).