Privacy policy

Zero-Shot is a team site where members publish their own page and portfolio. The site owner and data controller is Zero-Shot; you can reach us at info@zeroshotteam.com.

There is no ad network and no third-party tracking code on this site. The only measurement is Vercel's cookieless visit and speed analytics: page views, referring address and load timings are collected, with no per-person records. We do not profile visitors and we do not sell data to anyone.

Account details. Your email address and password when you sign up. Your password never reaches us in readable form — our authentication provider, Supabase, stores it as a bcrypt hash.

If you sign in with Google. Google sends us only your email address and, if available, your name. Google never shares your password with us.

Profile content. Your handle, display name, role, bio, what you are currently learning, location, skills, links, the year you started teaching yourself, and your sigil settings. You enter these and can change them at any time.

Profile photo (optional). If you upload one, it is cropped square and resized to 512 pixels in your own browser before being uploaded to our storage. You never have to upload one — your default image is the sigil computed from your handle.

Portfolio content. The title, description, tags, cover image and links of the projects you add.

Technical logs. Our hosting and infrastructure providers keep short-lived access logs for security and debugging (IP address, browser details, requested address). We do not read these for marketing.

Account details are processed so you can open an account and sign in safely — that is, to perform the agreement between us.

Profile and portfolio content is published at your explicit request. Nothing is public until you mark your page as Live; once you do, the content is open to the internet and may be indexed by search engines.

Technical logs rest on our legitimate interest in keeping the site up and secure.

When you sign up or change your password, we check whether the password you chose appears in known data breaches, using Have I Been Pwned.

The check uses k-anonymity: your password is never sent. Only the first five characters of its SHA-1 hash are queried, and the comparison happens against the list returned to your own browser. If the service is unreachable, the flow is not blocked.

There are no advertising or tracking cookies on this site. The cookies in use are:

Session cookie. Set by Supabase when you sign in. It is flagged httpOnly, secure and sameSite=lax, so JavaScript cannot read it. Session tokens are not kept in browser storage.

`zs-lang`. Remembers the language you picked, so you don't have to choose Turkish or English on every visit.

Your theme preference (light/dark) is kept in your browser's own storage under zs-theme. That is not a cookie and is never sent to the server.

Everyone. If you have taken your page live, your profile and published projects are public. Anything left as a draft is visible only to you — this is enforced by row-level security policies in the database itself.

Supabase. Our authentication, database and file storage provider.

Vercel. The infrastructure the site is hosted and delivered on.

Google. Involved only if you choose to sign in with Google.

We share your data with no one else. If a legal obligation arises, we disclose only what is strictly required.

These providers may operate servers outside your country; by opening an account you also consent to your data being transferred internationally through those services.

For as long as your account exists. When your account is deleted, your profile, portfolio and uploaded files are permanently removed.

Infrastructure providers' security logs follow their own retention periods and usually expire automatically after a short time.

Under GDPR and Turkey's KVKK you have the right to access, correct, delete, restrict the processing of, and receive a portable copy of your data.

For access and correction you don't need to write to anyone: /dashboard shows and edits every profile and portfolio field, and /dashboard/account handles your email and password.

Account deletion. You can do it yourself from the Delete account section of /dashboard/account. You are asked to type your email address to confirm; the moment you do, your profile, portfolio and uploaded files are permanently deleted. No email, no waiting.

If something goes wrong, reach us at info@zeroshotteam.com.

If you have a complaint, write to us first. If you are not satisfied, you may contact your local data protection authority.

This site is not directed at people under 16 and we do not knowingly collect their data. If we notice such an account, we delete it.

If something meaningful changes we update the date above, and for changes that affect your account we also notify you by email.