Privacy Policy

Last updated: October 2, 2026

This policy explains what personal data is processed when you use MinborAI (minborai.com), why, who it is shared with and what your rights are. It is based on Turkey's Personal Data Protection Law (KVKK) and, where applicable, the EU GDPR.

1. Controller

The data controller is MinborAI. For any question or request: [email protected]

2. Data we process

  • Account data: email address, username, display name, profile picture (from Discord/Google if you sign in with them).
  • Authentication: your password is stored only as a one-way hash (bcrypt); your 2FA secret is encrypted (AES-256-GCM) and backup codes are stored only as hashes.
  • Security logs: sign-in times, IP addresses, failed sign-in and 2FA attempts, password/2FA changes.
  • Abuse prevention: a random device id stored in your browser and a one-way hash of browser properties (screen, time zone, graphics card, etc.). At sign-up, your IP address is checked against VPN/proxy/Tor/data-center lists and the proxycheck.io service. These are used only to prevent abuse of free credits through multiple accounts.
  • Content: your projects, source code, version history, build outputs and your conversations with the AI assistant.
  • Your own API keys: stored encrypted (AES-256-GCM); never sent back to the browser, only the last 4 characters are shown.
  • Credit activity: spending and grants (when payments are added, payment details stay with the payment provider; we never store card data).

4. Who we share data with

Your data is never sold or shared for advertising. It is shared only with these service providers, only as needed to run the service:

  • AI providers (Google Gemini by default; OpenAI, Anthropic, etc. depending on the model you choose): the messages you send to the AI assistant and the relevant files of your project are sent to the selected provider to generate a response. If you use your own API key the request is made on your own account. These providers may be located abroad.
  • Cloudflare: traffic passes through Cloudflare for DNS, DDoS protection and bot verification (Turnstile).
  • Spacemail (Spaceship): sending account and security emails.
  • Hosting: data is hosted in a data center in Istanbul, Turkey.
  • Discord / Google: only if you choose to sign in with them, your basic profile is received from them.
  • GitHub: only if you connect your GitHub account, we store your username and an encrypted access grant; your project's code is sent only to the repository you choose, when you ask (or via automatic pushes you turn on). Disconnecting also revokes the grant on GitHub.

5. Retention

  • Account and project data: as long as your account exists. When you delete your account, your projects, files and build outputs are deleted immediately.
  • Database backups: daily backups are kept for 14 days and weekly backups for 8 weeks, then deleted automatically.
  • Security logs: kept for a reasonable period to detect abuse and meet legal obligations.

6. Cookies

Only essential cookies are used: a session cookie (keeps you signed in), a CSRF protection cookie and your theme/language preference. No advertising or tracking cookies, no third-party analytics. Cloudflare Turnstile may set its own cookies for bot protection.

7. Security

  • All traffic is encrypted with HTTPS; the server is only reachable through Cloudflare.
  • Optional two-factor authentication (2FA), rate-limited sign-in, email alerts on password/2FA changes and the ability to sign out all sessions.
  • User code and test servers run in containers isolated from the server and from other users.

8. Your rights

You can request access to, correction or deletion of your data, object to processing, and ask which parties it was shared with. You can delete your account yourself under Settings → Account; for other requests write to [email protected]. We respond within 30 days.

9. Age

MinborAI is not intended for children under 13. If you are under 18 you should use the service with a parent's or guardian's knowledge.

10. Changes

This policy may change; for significant changes we notify your registered email. The current version is always on this page.