Introduction
This Privacy Policy explains how Kohistani (www.kohistani.com, "the Website"), operated by Kohistani Media AB ("we", "us", "our"), collects, uses, shares, and protects your personal data.
Kohistani Media AB is the data controller. We are a company registered in Sweden and are subject to the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Swedish supplementary legislation.
For privacy questions or to exercise your rights, contact us at .
What Data We Collect and Why
Account data
When you register for an account, we collect your email address, chosen username, hashed password (we cannot read your password), optional display name, and language preference.
Legal basis: Performance of a contract (GDPR Art. 6(1)(b)). This data is necessary to provide you with an account and the associated features.
Social sign-in data
If you choose to register or sign in using Google or Facebook, we receive from that provider:
- Your email address (if one is associated with your provider account)
- Your display name (used only as a suggested username during first-time registration)
- A provider-specific identifier (a numeric ID issued by Google or Facebook, used solely to recognise your account on future sign-ins)
We do not receive your password from Google or Facebook, and we do not send your personal data back to them. You may connect or disconnect social sign-in methods at any time from Dashboard → Profile → Connected Accounts.
Legal basis: Performance of a contract (GDPR Art. 6(1)(b)). This data is necessary to create and authenticate your account when you choose this sign-in method.
Automatically collected usage data
When you visit the Website we automatically collect your IP address, browser type and version, operating system, pages visited, time spent on each page, and referring URL. This data is processed via Google Analytics.
Legal basis: Legitimate interests (GDPR Art. 6(1)(f)). To understand how the Website is used so we can improve it. You may opt out via the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).
Cookies and tokens
We use the following cookies and similar technologies:
Session cookie: keeps you logged in during your browser session. Required for the Website to function.
Remember-me cookie (ks_remember): keeps you signed in for up to 30 days if you tick "Remember me" at login.
Trusted device cookie (ks_2fa_trust): remembers that a device passed two-factor verification for up to 30 days, so you are not asked for a 2FA code on every login.
Language cookie (ks_lang): remembers your language preference (English or Persian).
Analytics cookies (_ga, _gid, etc.): set by Google Analytics to distinguish users and sessions. See the Cookies section below.
Advertising cookies: set by Google AdSense to deliver and measure relevant ads.
Turnstile token: a short-lived security token issued by Cloudflare when you submit a form, to confirm you are a human. Not stored after the request is verified.
Newsletter subscriptions
If you subscribe to our mailing list, we collect and store your email address.
Legal basis: Consent (GDPR Art. 6(1)(a)). You may withdraw consent and unsubscribe at any time via the unsubscribe link in any newsletter email.
Comments
If you leave a comment, we store the comment text linked to your account.
Legal basis: Legitimate interests (GDPR Art. 6(1)(f)). To provide community features.
Cookies in Detail
Strictly necessary cookies
These cookies are essential for the Website to work. They include your login session token, CSRF security tokens, and the language cookie. No consent is required under GDPR for strictly necessary cookies.
Analytics cookies (Google Analytics 4)
We use Google Analytics 4 to understand visitor behaviour. Google may set cookies such as _ga (expires 2 years) and _gid (expires 24 hours). Where possible, IP addresses are anonymised before storage. Data may be processed by Google in the United States under Standard Contractual Clauses.
You can opt out of Google Analytics measurement at any time by installing the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
Google's Privacy Policy: policies.google.com/privacy
Advertising cookies (Google AdSense)
We display advertisements served by Google AdSense. Google may use cookies to personalise ads based on your browsing activity across websites. You can manage or opt out of personalised advertising at: adssettings.google.com
Google's Privacy Policy: policies.google.com/privacy
Bot protection (Cloudflare Turnstile)
We use Cloudflare Turnstile, an invisible CAPTCHA, on registration and login forms to prevent automated abuse. Turnstile analyses your IP address, browser characteristics, and interaction patterns. Cloudflare does not use Turnstile data for advertising or tracking. It operates without setting persistent cookies on your device.
Cloudflare's Privacy Policy: cloudflare.com/privacypolicy/
Third-Party Processors
We share data with the following processors as necessary to operate the Website:
Google LLC
Purposes: Website analytics (Google Analytics 4) and advertising (Google AdSense).
Data shared: Usage data, IP address, device and browser information, and advertising identifiers.
Transfer safeguards: Standard Contractual Clauses (SCCs) cover transfers to the United States.
Google Privacy Policy: policies.google.com/privacy
Cloudflare, Inc.
Purpose: Bot protection (Turnstile) and content delivery.
Data shared: IP address, browser fingerprint, and interaction data for form submissions.
Cloudflare Privacy Policy: cloudflare.com/privacypolicy/
Google LLC (Sign-In)
Purpose: Optional sign-in and account creation via Google Sign-In.
Data received: Your Google account email address, display name, and a Google-issued user identifier. We do not send personal data back to Google via this integration.
Transfer safeguards: Standard Contractual Clauses (SCCs).
Google Privacy Policy: policies.google.com/privacy
Meta Platforms, Inc. (Facebook Login)
Purpose: Optional sign-in and account creation via Facebook Login.
Data received: Your Facebook account email address (if set on your Facebook account), display name, and a Facebook-issued user identifier. We do not send personal data back to Meta via this integration.
Transfer safeguards: Standard Contractual Clauses (SCCs).
Meta Privacy Policy: www.facebook.com/privacy/policy/
We do not sell, rent, or trade your personal data to any third party.
Social Accounts and Data Deletion
Connecting and disconnecting social accounts
You can connect your Google or Facebook account to your Kohistani account at any time from Dashboard → Profile → Connected Accounts. You can disconnect them at any time from the same page, provided you have at least one other way to sign in (a password or another linked provider).
Removing the app from Facebook or Google
If you remove Kohistani from your Facebook app permissions (via Facebook Settings → Apps and Websites), we automatically unlink your Facebook account on our side. Revoking access in your Google account settings has the same effect for Google. Your Kohistani account and all associated data are not deleted by either action.
Requesting deletion of your data
If you connected to Kohistani via Facebook and would like your data removed, you have three options:
- Delete your Kohistani account - go to Dashboard → Account Settings → Delete Account. This permanently removes your account and all associated data, including your Facebook or Google connection, within 30 days.
- Disconnect the provider only - go to Dashboard → Profile → Connected Accounts → Disconnect. This removes the social link without deleting your account or other data.
- Contact us - email and we will manually process your deletion request within 30 days.
Data Retention
We retain your personal data for the following periods:
- Account data: retained until you delete your account, plus up to 30 days for recovery purposes, then permanently deleted.
- Session and authentication tokens: valid for up to 30 days; expired tokens are deleted automatically.
- Analytics data: governed by Google Analytics retention settings (default 14 months from last activity).
- Newsletter subscriptions: retained until you unsubscribe.
- Comments: retained until you delete them or your account is permanently deleted.
- Server access logs (IP address, timestamps): up to 90 days, then deleted.
Your Rights Under GDPR
If you are in the European Economic Area or the United Kingdom, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Ask us to correct inaccurate or incomplete data.
- Right to erasure: Ask us to delete your personal data ("right to be forgotten"), subject to legal retention obligations.
- Right to restriction: Ask us to restrict how we process your data in certain circumstances.
- Right to data portability: Request your data in a structured, commonly used, machine-readable format.
- Right to object: Object to processing based on legitimate interests, including profiling for analytics.
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
To exercise any right, email . We will respond within one calendar month as required by GDPR. Requests are free of charge unless manifestly unfounded or excessive.
You also have the right to lodge a complaint with the Swedish data protection supervisory authority:
Integritetsskyddsmyndigheten (IMY)
Website: imy.se
Email:
International Data Transfers
The Website is hosted within the European Union. Some third-party processors (Google, Cloudflare) may transfer and process data in the United States or other countries outside the EEA. We ensure all such transfers are protected by appropriate safeguards, primarily Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46.
Requests from Public Authorities
If a government body, law enforcement agency, or other public authority requests access to personal data about our users, we apply the following:
- Legality review: We examine every request to verify it is legally valid, proportionate, and issued by a competent authority under applicable law before we take any action.
- Data minimization: We disclose only the minimum personal data strictly required to satisfy the specific legal obligation. We do not provide broader access than the request demands.
- User notification: Where we are legally permitted to do so, we will notify the affected user before or promptly after complying with such a request.
- Right to challenge: If we believe a request is unlawful, disproportionate, or exceeds the authority's jurisdiction, we reserve the right to object or seek legal advice before responding.
All such requests must be submitted in writing to . We do not comply with informal, verbal, or undocumented requests.
Children's Privacy
This Website is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If you believe we have inadvertently collected such data, please contact us at and we will delete it without delay.
Users between 13 and 17 are permitted to use the Website with parental or guardian consent.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify registered users by email at least 14 days before the change takes effect.
Contact Us
For any privacy questions, data subject requests, or complaints:
Kohistani Media AB
Email:
Website: www.kohistani.com
Supervisory authority (Sweden): Integritetsskyddsmyndigheten (IMY) at imy.se
