Privacy notice | Anılcan Çakır

Who is responsible

The controller is me, Anılcan Çakır. I run anilcancakir.com, the docs MCP server at mcp.anilcancakir.com and the snippet playground, and I decide what they collect.

To ask me anything about your data, use the contact section of the home page.

Reading the site

The site's own pages set no cookies and need no account. Everyone gets the same page, served from a cache, with no session behind it.

A page request still leaves a line in the web server's access log: your IP address, the time, the address you asked for, the page that sent you, your browser's user agent and how long the answer took. I use it to keep the site running and to spot abuse. The log rotates daily and seven days of it are kept.

The site sits behind Cloudflare, which sees every request on its way in, filters abuse and caches pages.

Analytics, only if you accept

A banner asks once. Nothing from Google or from Cloudflare's analytics loads until you press Accept. Your answer is kept in your browser's local storage as consent-choice; the site never sees it.

If you accept, Google Tag Manager and Google Analytics 4 load through a path on this site, so your browser talks to this site and this site passes the request on to Google, with your IP address and your country and region. Google then counts which pages are read and how far, how long you stay, which sections of the home page you reach, which links and copy buttons are used (for a link to another site, its address up to 100 characters), the playground's buttons, language switches, and docs searches with how many results they showed and which one you opened, always with the kind of page, its language and its package. A search is recorded as the words you typed, in lower case and cut at 60 characters; text that looks pasted, such as an address or a token, is dropped.

If you accept, Cloudflare Web Analytics also counts visits. Cloudflare says it uses no cookies or local storage to track people and does not fingerprint them.

Decline, or change your mind with Cookie settings in the footer, and Google's measurement stops at once, the _ga cookies Google set are deleted and Analytics is switched off for this browser. Cloudflare's counter cannot be unloaded from a page that already ran it, so that one visit may still be counted; it does not load on the next page you open. With no answer the banner stays and nothing loads.

What stays in your browser

These live on your device. The site sends an edit token only when you change that snippet, and your draft and name only when you save:

_ga and _ga_ cookies: only after you accept, Google Analytics sets them on this site's domain, with a random visitor ID.
consent-choice: your answer to the banner.
motion: whether you paused the animations.
wind-playground: entries: in the playground, the edit tokens of the snippets you saved, your draft, the frame you picked and the author name you typed.
The docs sidebar state, in session storage, gone when the tab closes.

Saving a snippet

The playground runs your code in your browser. Nothing is sent until you press save.

A save stores the code, a title, the settings you chose (theme, centring and overflow), a picture of what the code draws and a hash of an edit token. The token itself stays in your browser and is the only way to edit that snippet again; I cannot recover it. If you ask for a public place you can also give an author name of up to 60 characters; I show it only if I publish the snippet. Forking a snippet makes a copy that is yours, with a link back to the original.

A saved snippet is unlisted: it opens for anyone who has its link, it is kept out of search, the gallery and the sitemap, and I review each request to make one public; once I publish it, its edit token stops working and it can no longer be edited. Do not put secrets in it.

The picture and the link preview image of a snippet are stored on a CDN at cdn.kodizm.com and can be fetched by anyone who knows their address.

Saves are limited per IP address, which is counted for a short time and not kept with the snippet, though the access log above records it with every request. A snippet stays until it is removed. There is no account and no delete button: to remove one, write to me with its link and I delete it with its pictures.

The docs MCP server

mcp.anilcancakir.com answers AI tools that read these docs. It needs no login and no account.

Each request is written to an audit log that only I can read, in the admin: the time, method and path, your IP address, the tool called, your client's user agent and a few other headers, the status and the duration, and the request and the answer as JSON (up to 64 KB each). Keys that look like tokens, passwords or cookies are replaced before saving. Anything you ask a tool, a search phrase for example, is therefore stored. Requests are limited per IP address too.

I use the log to find faults and abuse. A daily job deletes entries after 30 days.

Who handles it for me

Four providers touch your data on my behalf. I do not state a country for any of them: where each keeps data is its own choice, and I list only what I can show.

Hostinger hosts the server this site runs on, so it holds everything on this page: the site's files and database and the logs.
Cloudflare sits in front of the site and receives every request: your IP address, the address you asked for and your browser's headers. If you accept, it also receives the visit counts of Cloudflare Web Analytics.
Google receives, only if you accept, what Analytics counts, with your IP address and your country and region. What Google keeps and for how long is set in my Google account, not on this page.
The CDN at cdn.kodizm.com stores and serves the pictures and link preview images of snippets; it sees the IP address of anyone who loads one.

Why I may do this

Under the GDPR:

Consent (Article 6(1)(a)): Google Analytics and Cloudflare Web Analytics. You give it with Accept and take it back with Cookie settings.
Legitimate interests (Article 6(1)(f)): the access log, the docs MCP audit log, saved snippets and the pictures stored with them, and Cloudflare in front of the site. My interest is to run a small public service, keep it secure and keep abuse out.

As the controller I also inform you under the Turkish Personal Data Protection Law No. 6698 (KVKK).

Writing to me

The contact card on the home page is an ordinary mail link. It opens your own mail app: the site has no form, sends no email and stores nothing about it. Your message reaches me through your mail provider and mine.

If you accepted Google Analytics, a click on the mail link or on its copy button is counted as an event, without the address.

What the site does not do

Apart from what this page describes:

No accounts for visitors.
No newsletter, comments or ads, and no sale of data.
No email sent by the site.
Fonts and scripts come from this site; the only other hosts your browser contacts are named on this page.

Your choices

Change what is optional, or ask for what is not:

Accept or decline Google Analytics and Cloudflare Web Analytics, or change your answer, with Cookie settings in the footer.
Clear this site's local storage in your browser to forget every item listed above; the edit tokens of your snippets go with it.
Ask about your data, or for a snippet to be removed, through the contact section of the home page.