1. Controller
The controller and product supplier for Rail is Ahmet Canal, Bahçelievler Mah. 1671 Sok. No:12 D:12, Karşıyaka / İzmir, Türkiye. Email: hello@ahmetcanal.com. KEP: ahmet.canal@hs01.kep.tr.
2. What data is processed?
Limited network/request logs may be processed for site/app security, together with functional preferences such as theme/language and, when you contact support, email, message and necessary diagnostic information.
When Rail Pro Cloud Sync is enabled, account identity plus synced notes, checklists, folders, tasks/Eisenhower state and related timestamps are processed through Supabase infrastructure. With Cloud Sync off, Rail is local-first and local content remains on your device.
For purchase and entitlement verification, Rail may receive customer/email, transaction/subscription identifiers, plan, term and status from Paddle. Rail does not store full card numbers or CVV.
3. Public browser demo
The public demo on rail.ahmetcanal.com works without an account or payment. Demo notes, tasks, folders and settings are kept only in browser localStorage and the demo does not connect to Cloud Sync.
You can delete demo data using the reset command inside the demo or by clearing browser site data.
4. Purpose, legal basis and providers
Data is processed to operate the product/account, provide Cloud Sync, verify licence/entitlement, secure the service, provide support and satisfy legal record obligations. Depending on the activity, Turkish KVKK bases include contract performance, legal obligation, establishment/exercise/protection of rights and legitimate interests; consent is used only where genuinely required.
Rail's web surface uses Cloudflare, Cloud Sync uses Supabase, and payment/subscription processing uses Paddle. Where personal data must be transferred outside Türkiye, the transfer mechanisms required under KVKK Art. 9 and relevant contractual/technical safeguards apply.
5. Retention, deletion and security
Local Rail data remains on your device until you delete it. Cloud Sync data is retained while needed for the account/service relationship; after a deletion request, product data not subject to legal retention enters the operational deletion process. Transaction, invoice, tax and dispute records may be retained for mandatory periods.
Rail uses access controls, per-user data separation, HTTPS, data minimisation and fail-closed entitlement handling. Suspected security incidents may be reported to hello@ahmetcanal.com.