Privacy Notice (KVKK Information Notice)

Prepared under Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).

Last updated: 25 September 2026

Translation notice: This is an English translation provided for convenience. The Turkish version (Gizlilik ve KVKK Aydınlatma Metni) is the legally binding text; if the two versions differ, the Turkish version prevails.

In short: SameScene has no accounts, no database, no advertising and no analytics tools; our site itself sets no cookies. Rooms, display names and recent chat messages are kept only in the server’s working memory and are deleted 10 minutes after the room becomes empty (or when the server restarts). A video you open from your computer is not uploaded to our server; it goes directly from your browser to the viewers. Because of this direct connection, your IP address may be visible to the other people in the room.

1. Data controller

The data controller for the SameScene service (the “Service”) available at samescene.com is Yasin Mert, a natural person who operates the Service in a personal capacity (“we”, “us”).

E-mail: info@samescene.com
Postal address: Birlik Mahallesi, Şehit Sadık Erişen Sokak, Çankaya/Ankara, Türkiye

The Service is provided free of charge not by a company but by an individual resident in Türkiye. No data controller representative has been appointed.

2. How the service works

The Service lets people who open the same “room” link watch a video in sync, chat and send emoji reactions. No registration or account is needed. A video can be opened in three ways:

YouTube link: the video is played in your browser from YouTube’s servers through YouTube’s own embedded player (IFrame Player).
Direct video link (e.g. .mp4): your browser loads the video directly from the third-party server given in the link. We do not host, copy or transmit that video; only the link itself is relayed to the people in the room.
Open from my computer: the file is not uploaded to our server. The browser of the person who picked the file plays the video and streams it directly (peer-to-peer) to the viewers using WebRTC technology. Our server only relays the technical messages (“signalling”) needed to set up the connection; the video picture and sound do not pass through our server.

3. Data we process, purposes and legal grounds

Your data is collected electronically, by automated means, through your browser while you use the Service. The legal grounds below are those listed in Article 5(2) KVKK.

3.1. Display name

Data: The name you type when entering a room (at most 24 characters). You don’t have to use your real name; a nickname is fine. If you don’t enter a name, “Misafir” (“Guest”) is used.
Purpose: Showing the other people in the room who you are; linking chat messages and reactions to you.
Legal ground: Providing the service under the Terms of Use: processing directly related to the conclusion or performance of a contract (Art. 5(2)(c)).
Who can see it: Everyone in the same room.

3.2. Chat messages and emoji reactions

Data: The text of the messages you write, the time they were sent and your display name; the emoji reactions you send. System messages such as joining/leaving the room and changing the video also contain your name.
Purpose: Delivering messages to the people in the room; letting people who join later see the recent messages.
Legal ground: Performance of a contract (Art. 5(2)(c)).
Who can see it: Everyone in the room at the time and people who join the room later (the last 50 messages kept in the room).

Please do not share special categories of personal data such as health, religion or political opinions, or other people’s personal information, in the chat.

3.3. Video information

Data: The video link pasted into the room; the file name and duration of a video opened from a computer; play/pause/seek information and who did it.
Purpose: Playing the video in sync for everyone in the room.
Legal ground: Performance of a contract (Art. 5(2)(c)).
Note: The file name is shown to everyone in the room. If the file name contains personal information (e.g. a full name or address), we recommend renaming the file before sharing it. We do not process the content of the video (picture and sound).

3.4. Connection and technical data

Data: Access records such as IP address, browser/device information (User-Agent), request time and the page requested; a random connection identifier used during the session; the technical information needed for a WebRTC connection (network addresses and connection parameters).
Purpose: Technically delivering the page and the real-time connection; the security of the service, fixing errors and preventing misuse (e.g. attacks, spam).
Legal ground: Performance of a contract (Art. 5(2)(c)) and our legitimate interest in keeping the service secure, provided it does not harm your fundamental rights and freedoms (Art. 5(2)(f)). For records that must be kept by law, compliance with a legal obligation (Art. 5(2)(ç)).
Where: Access records are kept on the infrastructure of our hosting provider Render (see section 5). Our application does not write IP addresses to a separate database.

3.5. When you write to us

Data: Your e-mail address, your name and the content of your message; in copyright or rights-infringement notices, the identity, authority and contact details contained in the notice.
Purpose: Assessing and answering your request, complaint or notice; meeting our legal obligations; protecting rights in possible disputes.
Legal ground: Compliance with a legal obligation (Art. 5(2)(ç)), the establishment, exercise or protection of a right (Art. 5(2)(e)) and legitimate interest (Art. 5(2)(f)).

The Service does not process data for advertising, profiling, marketing or decisions made solely by automated systems. We do not sell your personal data.

4. Streaming from your computer: IP address warning

Please read

The “Open from my computer” feature sends the video directly from your device to the viewers’ devices, not through the server. For this direct connection to work, the browsers learn each other’s IP address. This means:

The IP address of the person streaming may be visible to every viewer who connects.
A viewer’s IP address may be visible to the person streaming.

An IP address can reveal your approximate location (city/region) and your internet provider. Use this feature only with people you know and trust. Don’t share the room link in public places.

To help set up the connection, your browser connects to a public STUN server owned by Google (stun.l.google.com); that server sees your IP address. If a TURN relay server is introduced in the future to reduce connection problems, this text will be updated.

5. Recipients and transfers abroad

We share your personal data with the recipients below, and only for the stated purposes, or the parties below access your data because of how the Service works:

Other users in the room: your display name, messages, reactions, the video link/file name you share and — when streaming from a computer — your IP address.
Render Services, Inc. (USA) — hosting: our server and access records run on Render’s infrastructure in the USA. Render acts as a data processor on our behalf.
Google LLC (USA): the public STUN server for WebRTC connections. (The fonts on our pages are loaded from our own server; no connection to Google is made for them.)
YouTube (Google): when a YouTube video is opened in a room, the YouTube player is loaded into your browser directly from YouTube, via YouTube’s “privacy-enhanced mode” address (youtube-nocookie.com). YouTube collects data such as your IP address in the process and may use its own cookies and similar technologies. YouTube/Google is independently responsible for this processing under its own privacy policy: policies.google.com/privacy.
Sites behind direct video links: when a user shares a link to a video file on another site, the browser of everyone watching connects to that site; that site may see your IP address. We do not choose or control these sites.
Our e-mail service providers: e-mails you send us are received by Natro (servers located in Turkey) and forwarded to Google LLC's Gmail service (USA), where they are stored so that we can read them.
Competent public authorities and courts: only where required by law and limited to the scope requested.

Transfers abroad

Because Render’s servers are located in Germany (Frankfurt) and those of Cloudflare and Google are located outside Türkiye, mainly in the USA, part of the data above is transferred abroad. These transfers take place under the terms of service and data processing agreements of those providers. No standard contract notified to the Turkish Data Protection Board under Article 9 KVKK (as amended by Law No. 7499) is in place yet; we will update this notice if that changes. For questions about transfers abroad, contact us at info@samescene.com.

6. Retention periods

Room information, display names, the last 50 chat messages, the video link/file name: kept only in the server’s working memory (RAM), never written to disk or a database. Permanently deleted 10 minutes after the last person leaves the room, or when the server is restarted. When a room has more than 50 messages, the oldest ones are deleted immediately.
Emoji reactions and WebRTC signalling messages: not stored; only relayed.
The hosting provider’s access records (including IP addresses): 7 days on our current Render plan (Hobby); 14 or 30 days if we move to a paid plan. We do not keep separate copies of these records.
Display name and preferences stored in your browser: stay on your own device until you delete them (see section 7).
E-mail correspondence and notices: for as long as needed to resolve the request and afterwards for the relevant statutory limitation periods for possible disputes; then deleted.

We cannot technically prevent other users from saving chat messages or videos on their own devices (e.g. by taking screenshots).

7. Cookies and local storage

Our site itself does not set cookies and uses no analytics or advertising tools.

Only the following is stored in your browser’s local storage (localStorage):

your display name (key ss_name) — so you don’t have to type it again next time;
your language preference (ss_lang) — to remember whether you chose Turkish or English;
that you have read the streaming warning (ss_p2p_ok) — so the warning isn’t shown every time.

This information is not sent to us; it stays on your device only. When you enter a room, your name is sent to the server as described above. You can delete these entries at any time by clearing your browser’s site data.

Third parties: when a YouTube video is opened in a room, YouTube may use its own cookies and similar technologies. Sites behind direct video links may also use their own cookies. We do not control these; you can block third-party cookies in your browser settings.

8. Your rights under Article 11 KVKK

By applying to the data controller, you have the right to:

learn whether your personal data is processed,
request information about it if it has been processed,
learn the purpose of the processing and whether the data is used in line with that purpose,
know the third parties in Türkiye or abroad to whom your personal data is transferred,
request correction if your data is incomplete or inaccurate,
request deletion or destruction under the conditions of Article 7 KVKK,
request that correction, deletion or destruction be notified to third parties to whom the data was transferred,
object to a result against you arising from the analysis of the processed data exclusively by automated systems,
claim compensation if you suffer damage because your personal data was processed unlawfully.

Because there is no account system and data is held only briefly in memory, in most cases we may not have any record that can be linked to you at the time you apply. If so, we will tell you this clearly.

9. How to make a request

You can send requests about your rights, in line with the Communiqué on the Procedures and Principles for Applications to the Data Controller:

by a petition with a wet signature to the postal address above,
signed with a secure electronic signature or mobile signature, to info@samescene.com,
or simply by e-mail to info@samescene.com.

In your request, it is enough to state your name and surname, your contact details, your request, and information that helps us understand which use it concerns (e.g. date and time, room code, the display name you used).

We will resolve your request free of charge as soon as possible depending on its nature and within 30 days at the latest; if the action requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged. If your request is rejected, you find the answer insufficient, or no answer is given in time, you can file a complaint with the Personal Data Protection Board under Article 14 KVKK.

If you use the Service from the European Union or the European Economic Area and the General Data Protection Regulation (GDPR) applies to you: the data controller is the person named above. We process your data on the legal grounds of performance of a contract, to the extent needed to provide the Service (Art. 6(1)(b) GDPR), and our legitimate interest in security and preventing misuse (Art. 6(1)(f)). You can exercise your rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest by writing to info@samescene.com; you can also lodge a complaint with the data protection supervisory authority of the EU member state where you live or where the infringement took place. The data is processed by the data controller in Türkiye and, through the service providers named above, in the USA.

11. Children

The Service is not designed for children under 13. Users aged 13–18 must use the Service with the permission and under the supervision of their parent or guardian. If you notice that data of a child under 13 is being processed, please write to us.

12. Security

The connection between the site and your browser is encrypted with HTTPS; WebRTC streams are encrypted end-to-end between the browsers (DTLS-SRTP). Data is not stored permanently, inputs are validated on the server and request rate limits protect against misuse. Room links are made of hard-to-guess random codes; however, anyone who has the link can join the room, so share it only with the people you want to watch with. No system is completely risk-free; if we become aware of a data breach, we will make the notifications required under Article 12 KVKK.

13. Changes

We may update this notice as the Service or the law changes. The current text is always published on this page and the “Last updated” date at the top is changed. If there is a significant change in the purposes of processing, we will also announce it on the home page.