Privacy Policy

Last updated: 20 October 2026

This policy explains how Tinkermoss ("we") handles personal data collected through this website, in line with the EU General Data Protection Regulation (GDPR) and Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

1. Who is responsible (data controller)

Tinkermoss, an independent seller. Contact: hello@tinkermoss.com.

2. What we collect

• Your email address
• Which kit you picked (Kit A or Kit B)
• The referral source (for example "reddit"), if the link you used included one
• Technical data your browser sends to our hosting and form providers (such as IP address and timestamp), used for security and spam prevention

We do not use advertising cookies or tracking pixels.

3. Why we use it and on what legal basis

• To tell you when the kit you picked launches and send you the early-bird offer. Basis: your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent).
• To count interest in each kit so we know which one to build. We do this with aggregated counts only.

You can withdraw consent at any time. Withdrawing doesn't affect anything we did before.

4. Processors (who handles the data for us)

• Form and hosting provider: Netlify, Inc. (Netlify Forms)
• Email provider (launch email): MailerLite (data stored in the EU)
• Payment platform at launch: Lemon Squeezy, acting as merchant of record under its own privacy policy

Some providers are outside Turkey or the EU. Transfers rely on the provider's safeguards, such as Standard Contractual Clauses.

5. We never sell your data

We don't sell, rent or share your email with anyone except the processors listed above.

6. How long we keep it

Until the kit launches, plus up to 12 months, or until you unsubscribe or ask us to delete it, whichever comes first.

7. Your rights

Under GDPR and KVKK (Art. 11) you can ask to access, correct, delete or export your data, object to or restrict processing, and withdraw consent. Email hello@tinkermoss.com. We reply within 30 days. Every email also has an unsubscribe link. You can complain to your local data protection authority, or in Turkey to the KVKK Authority (Kişisel Verileri Koruma Kurumu).

8. Security

Data is stored with the providers above, who use encryption in transit. We keep access to the minimum needed.

9. Children

This site isn't intended for anyone under 18.

10. Changes

If this policy changes, we'll update the date at the top.