Introduction
This Privacy Policy explains how Kohistani (www.kohistani.com, "the Website") — operated by Kohistani Media AB ("we", "us", "our") — collects, uses, shares, and protects your personal data.
Kohistani Media AB is the data controller. We are a company registered in Sweden and are subject to the General Data Protection Regulation (GDPR) (EU) 2016/679 and applicable Swedish supplementary legislation.
For privacy questions or to exercise your rights, contact us at .
What Data We Collect and Why
Account data
When you register for an account, we collect your email address, chosen username, hashed password (we cannot read your password), optional display name, and language preference.
Legal basis: Performance of a contract (GDPR Art. 6(1)(b)) — this data is necessary to provide you with an account and the associated features.
Automatically collected usage data
When you visit the Website we automatically collect your IP address, browser type and version, operating system, pages visited, time spent on each page, and referring URL. This data is processed via Google Analytics.
Legal basis: Legitimate interests (GDPR Art. 6(1)(f)) — to understand how the Website is used so we can improve it. You may opt out via the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout).
Cookies and tokens
We use the following cookies and similar technologies:
Session cookie — keeps you logged in during your browser session. Required for the Website to function.
Remember-me cookie (ks_remember) — keeps you signed in for up to 30 days if you tick "Remember me" at login.
Trusted device cookie (ks_2fa_trust) — remembers that a device passed two-factor verification for up to 30 days, so you are not asked for a 2FA code on every login.
Language cookie (ks_lang) — remembers your language preference (English or Persian).
Analytics cookies (_ga, _gid, etc.) — set by Google Analytics to distinguish users and sessions. See the Cookies section below.
Advertising cookies — set by Google AdSense to deliver and measure relevant ads.
Turnstile token — a short-lived security token issued by Cloudflare when you submit a form, to confirm you are a human. Not stored after the request is verified.
Newsletter subscriptions
If you subscribe to our mailing list, we collect and store your email address.
Legal basis: Consent (GDPR Art. 6(1)(a)). You may withdraw consent and unsubscribe at any time via the unsubscribe link in any newsletter email.
Comments
If you leave a comment, we store the comment text linked to your account.
Legal basis: Legitimate interests (GDPR Art. 6(1)(f)) — to provide community features.
Cookies in Detail
Strictly necessary cookies
These cookies are essential for the Website to work. They include your login session token, CSRF security tokens, and the language cookie. No consent is required under GDPR for strictly necessary cookies.
Analytics cookies (Google Analytics 4)
We use Google Analytics 4 to understand visitor behaviour. Google may set cookies such as _ga (expires 2 years) and _gid (expires 24 hours). Where possible, IP addresses are anonymised before storage. Data may be processed by Google in the United States under Standard Contractual Clauses.
You can opt out of Google Analytics measurement at any time by installing the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
Google's Privacy Policy: policies.google.com/privacy
Advertising cookies (Google AdSense)
We display advertisements served by Google AdSense. Google may use cookies to personalise ads based on your browsing activity across websites. You can manage or opt out of personalised advertising at: adssettings.google.com
Google's Privacy Policy: policies.google.com/privacy
Bot protection (Cloudflare Turnstile)
We use Cloudflare Turnstile, an invisible CAPTCHA, on registration and login forms to prevent automated abuse. Turnstile analyses your IP address, browser characteristics, and interaction patterns. Cloudflare does not use Turnstile data for advertising or tracking. It operates without setting persistent cookies on your device.
Cloudflare's Privacy Policy: cloudflare.com/privacypolicy/
Third-Party Processors
We share data with the following processors as necessary to operate the Website:
Google LLC
Purposes: Website analytics (Google Analytics 4) and advertising (Google AdSense).
Data shared: Usage data, IP address, device and browser information, and advertising identifiers.
Transfer safeguards: Standard Contractual Clauses (SCCs) cover transfers to the United States.
Google Privacy Policy: policies.google.com/privacy
Cloudflare, Inc.
Purpose: Bot protection (Turnstile) and content delivery.
Data shared: IP address, browser fingerprint, and interaction data for form submissions.
Cloudflare Privacy Policy: cloudflare.com/privacypolicy/
We do not sell, rent, or trade your personal data to any third party.
Data Retention
We retain your personal data for the following periods:
- Account data: retained until you delete your account, plus up to 30 days for recovery purposes, then permanently deleted.
- Session and authentication tokens: valid for up to 30 days; expired tokens are deleted automatically.
- Analytics data: governed by Google Analytics retention settings (default 14 months from last activity).
- Newsletter subscriptions: retained until you unsubscribe.
- Comments: retained until you delete them or your account is permanently deleted.
- Server access logs (IP address, timestamps): up to 90 days, then deleted.
Your Rights Under GDPR
If you are in the European Economic Area or the United Kingdom, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you.
- Right to rectification: Ask us to correct inaccurate or incomplete data.
- Right to erasure: Ask us to delete your personal data ("right to be forgotten"), subject to legal retention obligations.
- Right to restriction: Ask us to restrict how we process your data in certain circumstances.
- Right to data portability: Request your data in a structured, commonly used, machine-readable format.
- Right to object: Object to processing based on legitimate interests, including profiling for analytics.
- Right to withdraw consent: Where processing is based on consent, withdraw it at any time; this does not affect the lawfulness of processing before withdrawal.
To exercise any right, email . We will respond within one calendar month as required by GDPR. Requests are free of charge unless manifestly unfounded or excessive.
You also have the right to lodge a complaint with the Swedish data protection supervisory authority:
Integritetsskyddsmyndigheten (IMY)
Website: imy.se
Email:
International Data Transfers
The Website is hosted within the European Union. Some third-party processors (Google, Cloudflare) may transfer and process data in the United States or other countries outside the EEA. We ensure all such transfers are protected by appropriate safeguards — primarily Standard Contractual Clauses (SCCs) approved by the European Commission under GDPR Art. 46.
Children's Privacy
This Website is not directed to children under 13. We do not knowingly collect personal data from anyone under 13. If you believe we have inadvertently collected such data, please contact us at and we will delete it without delay.
Users between 13 and 17 are permitted to use the Website with parental or guardian consent.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify registered users by email at least 14 days before the change takes effect.
Contact Us
For any privacy questions, data subject requests, or complaints:
Kohistani Media AB
Email:
Website: www.kohistani.com
Supervisory authority (Sweden): Integritetsskyddsmyndigheten (IMY) — imy.se
