Privacy and Cookie Policy
In short: no ads, no tracking, no analytics. We do not sell your data or share it with anyone for marketing. We keep only the minimum the site needs to work.
Last updated: 3 November 2026. This notice is given under Article 10 of Turkish Law No. 6698 on the Protection of Personal Data (KVKK) and, for visitors from the European Union, Article 13 of the GDPR. It covers www.yamanzoo.com and the YamoFarm game. The Turkish version prevails; this English version is a translation for information.
1. Data controller
The data controller is Yaman Yağız (a natural person). For anything about privacy, write to zoo@yamanzoo.com.
2. Cookies and data stored in your browser
We use strictly necessary cookies only. No advertising, analytics or tracking cookies. Under the Turkish Data Protection Authority's cookie guidelines and the EU ePrivacy rules, strictly necessary cookies do not require consent, but you have the right to know what they are:
| Name | Where | Purpose | Lifetime |
|---|---|---|---|
yz_oturum | Admin panel only (/yonetim) | Keeps the site administrator signed in. Never sent to visitors. | Until sign-out if “remember me” is ticked, otherwise until the browser closes |
yamo_oturum | YamoFarm | Keeps you signed in to the game. | 30 days or until you sign out |
yamo_durum | YamoFarm | Security check that a Google sign-in request really came from you. | 10 minutes |
Your browser's local storage also holds data that stays on your device and is never sent to us: game records and progress, your place in the book, your chess nickname, kindness-card ticks, your name and grades on the teacher page, the fact that you closed this notice (keys starting with yamanzoo-), and the YamoFarm guest name and recovery code (yamo_misafir). If you install the app, pages are cached so they open offline. You can delete all of this at any time by clearing the site data in your browser.
3. What we keep, why and for how long
| When | Data | Purpose and legal basis | Retention |
|---|---|---|---|
| Every visit | IP address, date and time, page requested, browser details (server logs) | Security, preventing abuse and attacks, fixing errors. KVKK Art. 5(2)(f), GDPR Art. 6(1)(f) (legitimate interests). | 14 days, then deleted automatically |
| “Ask Yaman” | Your first name (first word only) and your question. Phone numbers, e-mails and addresses are blocked. | Answering; if selected, publishing the question with your first name. KVKK Art. 5(2)(c),(f); GDPR Art. 6(1)(b),(f). | Until you ask us or we delete it |
| “Report an injured animal” | Name, phone, (optional) e-mail, location and description, up to 3 photos | Helping the animal and contacting you. Your explicit consent given in the form (KVKK Art. 5(1), GDPR Art. 6(1)(a)) and legitimate interests. | Deleted automatically with the photos 90 days after the report is closed |
| Adventure leaderboard | Your one-word nickname, time and steps. No IP address. | Showing the leaderboard. KVKK Art. 5(2)(c), GDPR Art. 6(1)(b). | Until you or we delete it |
| YamoFarm, Google sign-in | Google account ID, e-mail, name, profile photo URL; sign-in dates | Creating and protecting your account. KVKK Art. 5(2)(c), GDPR Art. 6(1)(b). | While the account exists |
| YamoFarm, guest sign-in | Player name and 4-digit recovery code (no e-mail) | Letting you return to your farm. KVKK Art. 5(2)(c), GDPR Art. 6(1)(b). | While the account exists |
| YamoFarm gameplay | Farm, land, crops, animals, market activity; game log | Running the game, preventing cheating and abuse. KVKK Art. 5(2)(c),(f); GDPR Art. 6(1)(b),(f). | While the account exists |
| Forms and sign-in | IP address (memory only, never stored) | Rate-limiting submissions and failed sign-ins. KVKK Art. 5(2)(f), GDPR Art. 6(1)(f). | Up to 1 hour in server memory |
Backups are taken every night and kept for 30 days, so deleted data disappears from backups within 30 days.
4. Who we share data with
We never sell or rent personal data or share it for advertising. Data is passed on only as needed to: our hosting and network providers (acting on our instructions); Cloudflare, Inc. (USA) for the Turnstile bot check on forms (IP address and browser data); Google LLC (USA) only if you choose “Sign in with Google” on YamoFarm; and public authorities where required by law. Transfers to Cloudflare and Google are international transfers made with safeguards under Article 9 KVKK. Fonts, images and all other page parts are served from our own server.
5. Children
The site is made for children and therefore collects very little on purpose. The question form asks for a first name only. Injured-animal reports by under-18s should be sent together with a parent or guardian. Google sign-in on YamoFarm is subject to Google's age rules; younger children can use the guest sign-in, which needs no e-mail, under parental supervision. If you think a child's data was sent without permission, write to zoo@yamanzoo.com and we will delete it.
6. Your rights
Under Article 11 KVKK and, in the EU, Articles 15–22 GDPR you can ask whether we process your data and get a copy, have it corrected or deleted, restrict or object to processing, receive it in a portable format, and withdraw consent at any time (without affecting earlier processing). Send your request to zoo@yamanzoo.com with your name and what you are asking for. We reply free of charge within 30 days and may ask for information to confirm your identity. You can complain to the Turkish Personal Data Protection Authority (kvkk.gov.tr) or, in the EU, to your national data protection authority.
7. Security and changes
Connections are always encrypted (HTTPS), the admin password is stored only as a hash, and failed sign-ins and recovery-code attempts are rate-limited and locked. If a breach ever happens we will notify the authority and those affected as the law requires. We may update this policy; the current version is always on this page with its date, and important changes will be announced on the site.
See also the Terms of Use.