KVKK Shield: An AI Privacy Guard for Turkish Companies

01 The problem

AI apps have become a normal part of everyday work. A staff member pastes a customer list to write an e-mail. A support agent pastes a complaint to get a quick summary. An analyst pastes a report to "clean it up." This saves time. But in Türkiye, it is often against the law.

The Turkish data-protection law, KVKK (Law No. 6698), has strict rules about sending personal data outside the country. Article 9 of the law covers this, and the rules were updated in June 2024 to set out exactly when data may be sent abroad. Popular AI apps — ChatGPT, Claude, Gemini, Copilot — run on servers abroad. So the moment someone pastes a Turkish ID number (T.C. Kimlik No), a local phone number, a customer e-mail, or an IBAN into one of these apps, personal data has just left the country. Usually there is no consent and no record. That is a real KVKK risk.

There is one key idea here. The only safe place to clean the data is the user's own computer, after they finish typing and before the message is sent. A company firewall cannot help, because the message is already encrypted and on its way. So the guard has to live in the browser itself.

02 The solution: clean the text in the browser

KVKK Shield is a browser extension. It has no server, no login, and no tracking. All the work happens inside the user's own browser. When it finds personal data in a message, it replaces that data with a safe label (for example, a real ID number becomes [ID_1]) before the message is sent. So the message that actually leaves the computer has no real personal data in it.

For the user, it feels normal. They type as usual, and the AI answers as usual. But the private data never leaves their computer. If the tool is not sure whether something is private, it stops and asks instead of guessing. Safe is the default.

03 How it finds personal data accurately

Finding data correctly is the hard part. A simple rule like "hide any 11 digits" would also hide order numbers and product codes. Too many false alarms, and people switch the tool off. So KVKK Shield does not just check the shape of a number — it checks if the number is really valid. For a Turkish ID number, it runs the official math test that real ID numbers must pass.

// Check if a Turkish ID number (TCKN) is really valid,
// not just "11 digits". This removes almost all false alarms.
function isValidTurkishID(value) {
  if (!/^[1-9]\d{10}$/.test(value)) return false;
  const d = [...value].map(Number);

  const oddSum  = d[0] + d[2] + d[4] + d[6] + d[8];
  const evenSum = d[1] + d[3] + d[5] + d[7];

  const check10 = ((oddSum * 7) - evenSum) % 10;
  const check11 = (oddSum + evenSum + d[9]) % 10;

  return d[9] === check10 && d[10] === check11;
}

It checks the most common types of personal data, and gives each one a clear label so the message still makes sense:

The labels are numbered on purpose. If a message has two people and two phone numbers, the numbers keep them apart — "call [NAME_2] on [PHONE_2]" — so the AI's answer still makes sense and the real words can be put back correctly.

04 How it catches the message in time

KVKK Shield checks the message in two places, for safety. First, it cleans the text in the chat box the moment the user presses Enter or clicks Send. Second, it checks the message again at the last step, just before it goes out over the network. If the first check is ever missed, the second one still catches it.

// Step 1: clean the text when the user tries to send it.
function onSend(event) {
  const box = getChatBox(event.target);
  if (!box) return;

  const original = getText(box);
  const result   = cleanText(original);   // finds and labels private data

  if (result.unsure) {
    event.preventDefault();             // not sure? stop and ask the user
    showQuickReview(box, result);
    return;
  }
  setText(box, result.cleaned);         // real data never reaches the network
}

document.addEventListener("keydown", e => {
  if (e.key === "Enter" && !e.shiftKey) onSend(e);
}, true);

• It runs first. The check happens before the AI website's own code, so it cannot be skipped.
• It has a backup. A second check at the network step catches anything the first one misses.
• It only runs where needed. The tool is active only on a short list of approved AI sites, so every other website is untouched.
• It keeps working. If the page reloads parts of itself, the tool re-attaches to the new chat box automatically.

05 Before and after

Here is what changes. The user writes the same message either way. But the message that leaves the computer is very different.

The AI writes a perfect reminder for [NAME_1]. On the user's screen, KVKK Shield can quietly put the real name and details back into the reply. So the user gets a finished message, and the private data never went anywhere.

06 Why you can trust it

A privacy tool should not collect data itself. KVKK Shield is built so this is easy to prove:

• No server and no account. The tool has nowhere to send data, and makes no calls of its own. Anyone can check this in the browser.
• Nothing is saved. The list that links labels to real values lives in memory only, during the chat, and is then thrown away. It is never written to disk.
• A simple local log. The company can keep a record that says a piece of data was hidden (its type, time, and site) — but never the data itself. This gives proof that the tool is working.
• Company settings. A company can decide which data types are required and which AI sites are allowed, and roll the tool out to all staff.
• Safe by default. When in doubt, it stops and asks instead of sending.

07 Why it matters, and what's next

KVKK Shield is made for Türkiye. It solves a problem that Turkish companies face every single day. It is built for local needs from the start — it knows Turkish ID numbers, Turkish phone formats, and Turkish bank accounts. And it answers a hard legal question with a practical tool instead of a ban.

I bring the full skill set to build it — the design, the code, and more than ten years of cloud and data-protection work from US government and company projects. The next step is moving from a working prototype to a real product, side by side with the founders, lawyers, and companies who are its first users. I would also like to give back to the local tech community through mentoring and shared work along the way.