Privacy Policy

Effective date: 1 October 2026 · Last updated: 7 October 2026

Who is responsible for your data?

InTimePost is developed and run by one person, not a company: Emirhan Sarıal. He is the "data controller" for your personal data, meaning the person who decides why and how it is used, under Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies to you, the EU or UK General Data Protection Regulation ("GDPR"). In this policy, "we", "us" and "our" mean him.

For any question, request or complaint: intimepost.app@gmail.com

What data we collect and why

For each kind of data below we say why we need it and the legal basis we rely on. "Contract" means the data is needed to provide the service you signed up for under the Terms of Use. "Legitimate interests" means we need it to keep the service safe and working, and we have weighed that against your rights. We do not currently rely on your consent for any processing.

Your account

• If you sign in with Google or Apple: the account ID the sign-in provider gives us, your email address, your name (if provided) and, for Google, the address of your Google profile picture (if you have one). Your name is used as the first version of your display name on your profile; you can change it. If you choose to hide your email when signing in with Apple, we only see the relay address Apple gives us.
• Session data: a session record that keeps you signed in. It also stores the IP address and app information of the device you signed in on. Our sign-in service (Supabase Auth) may also keep sign-in, sign-out and session refresh events, with the IP address, in a separate audit log; we have not yet set our own deletion period for that log, and even if you delete your account it may stay for the provider's own retention period. Purpose: keeping your account secure.
• Your Premium status: whether you have Premium, where it comes from (a gift or a store subscription), and its start and end dates. Gift Premium is granted or withdrawn by an administrator; the reason is written to the administrative record. An ended or withdrawn Premium record is deleted after 1 year. Purpose: unlocking Premium limits and themes for you.

Why: without an account you cannot send or receive capsules. Legal basis: contract; for session security, legitimate interests.

Your profile

• Your username (@name), display name, optional bio and profile photo, the date you created your account, and your follower and following counts.
• Your birth year: asked only to enforce age limits: children under 13 cannot create an account, and people under 18 cannot use chat. No one else can see it and it is not used for any other purpose.
• The time you accepted the Terms of Use.

Why: to show you to other users, to let your friends find you, and to apply age limits. Legal basis: contract; for age limits, legitimate interests.

Your capsules

• Content: the message you write, the photos you add and your voice recording (how much you can add on the free plan and with Premium is set out in the Terms of Use and shown in the app when you create a capsule).
• Capsule details: the name you give the recipient, the theme you choose, the types of content (text/photo/voice), the opening time, when the capsule was created, opened and cancelled, whether it was sent by link or directly, your Explore choices and the number of likes.
• Secret question: if you add one, the question itself and its answer. We never store the answer in readable form; we keep only a one-way scrambled version of it (a hash) and the number of wrong attempts.
• Share link: a random, unguessable key for each capsule.
• Repeating capsule (Premium): if you choose "Every year" or "Every month", your message, your file paths and the recipient are kept in a repeat chain; each time a repeat comes due, a new capsule is created with the same content (files are not copied). You can stop the chain any time from Sent; if you or the recipient delete the account, the chain is deleted immediately. If your Premium ends, repeats that have not been created yet are not created, and the ones already sent are not affected.

Photos are resized on your phone before upload, and the location and device information embedded in the photo (EXIF data) is removed.

Why: to store the capsule and open it for the recipient when the time comes. Legal basis: contract.

Social features

• Who you follow and who follows you, and since when.
• The Explore posts you like.
• The people you block.
• The times you followed people, so we can apply the daily follow limit.

Why: following, direct sending between people who follow each other, Explore and blocking. Legal basis: contract; for the follow limit and blocking, also legitimate interests.

Chat

Chat only opens between two users who follow each other and are both 18 or over. People under 18 cannot use chat.

• Your messages: the text you write (up to 2,000 characters) or a reply card you send about an opened capsule, when it was sent and, if you deleted it, when. Photos and voice cannot be sent in chat.
• Read receipts: the other person sees "Seen" when you have seen their message, and you see theirs. For now this cannot be turned off.
• Mute: your choice if you mute a chat's notifications.
• Abuse limit: the times you sent messages (to apply the limit of 30 messages a minute and 500 a day).

So that messages arrive instantly while a chat is open, they are delivered through Supabase's real-time messaging service; only the two people in the chat can connect to that channel. Chat messages are not end-to-end encrypted: they are stored on our servers and pass through a banned-word filter. If you report a message, that message becomes visible to the moderator so it can be reviewed.

Why: so you can write to adults who follow you back, and to keep chat safe. Legal basis: contract; for the abuse limit and the filter, legitimate interests.

Reports and safety

• Reports you make: what or whom you reported, the reason, any note you add (up to 500 characters), the date and the status of the report.
• Reports made about you and, if one applies, the end date of a ban on posting to Explore.
• If your account was suspended: when the suspension started and was lifted, the reason and, if it is linked to a child safety report, the number of that record.
• If you appeal a suspension: the appeal text you write (up to 1000 characters, free text; you do not have to write any capsule or message content), the date of the appeal and our decision (suspension lifted or appeal rejected). Only administrators can see it; the purpose is to review your appeal.
• If you received a warning for breaking the rules (a strike record): the reason, the date, the number of the related report and, if it was removed, when. A warning in the last 30 days may cause your Explore posts to be shown to others behind a cover.
• Profile text, messages that are going to appear on Explore and chat messages are checked automatically against a list of banned words. We do not run the private content of capsules through this filter, only the content that is going to appear on Explore.
• If you report a chat message for child safety, that message and the last 20 messages of the same chat (from the last 7 days at most) are copied into a separate, locked record (How long we keep data).
• Record of administrative actions: when an administrator takes an action concerning your account, a post or a report (for example a suspension, removal from Explore or closing a report), who did it, when, what they did and why is kept in a record that cannot be changed. The admin panel cannot see the content of your capsules or your messages; the only exception is the child safety copy of reported content.

Why: to prevent abuse, protect the community and children, and follow app store rules. Legal basis: legitimate interests and compliance with legal obligations. How automated decisions work is explained in the Community Guidelines.

Notifications

If your phone allows InTimePost to send notifications (on Android 12 and earlier this permission is on by default), then when you first send or receive a capsule we store a device token issued by Google (Firebase Cloud Messaging) and your phone type (iOS/Android), so we can send notifications to your phone. When you turn notifications off in Settings, the token is deleted from our server.

We send a notification when: someone follows you or follows you back; your Explore post is liked (several likes are grouped into one notification), removed or hidden; someone sends a capsule directly to you; a capsule sent to you is ready to open; a capsule you left is opened; a capsule you received is ready but you have not opened it yet (a gentle reminder 1 day and 7 days after it becomes ready, at most two per capsule and one a day, and only between 09:00 and 21:00 Turkey time); a capsule sent to you is cancelled or its opening date changes; something important happens to your account (for example, it is suspended); and you receive a chat message.

A notification never contains anything from the capsule's content, nor the content of a message; only the other person's name appears. Muted chats do not send notifications. In Settings you can turn off push notifications and the in-app record separately for each type of notification; these choices (only the ones that differ from the default) are stored on our server with your account, and we do not send notifications of a type you turned off. If a sender cancels a capsule or changes its date, your phone receives a silent message with no text (to update the reminder on your phone). So that notifications reach you in your language, the language you choose in the app (English or Turkish) is saved to your profile on our server; no one else can see it.

Notifications waiting to be sent are kept in a queue for at most 7 days after they are sent. The same events are also saved as a record so you can see them on the Notifications page in the app (who, when, which capsule; no content, except for message notifications). These records are deleted after 90 days, or immediately if you delete your account.

Why: to tell you when a capsule's time has come. Legal basis: contract. We do not send advertising or marketing notifications.

Premium subscription

If you buy Premium, the payment is taken by Apple (App Store) or Google (Play Store); we never see or store your card or billing details. We use RevenueCat (RevenueCat, Inc., USA) to manage subscriptions. When you sign in (while store subscriptions are switched on), the app tells RevenueCat your account's random user ID (your name, email or any other personal information is not sent), to tie purchases to your account and to finish a purchase that was interrupted; when you buy or restore purchases it also sends the purchase information supplied by the store. After you buy, our server may ask RevenueCat about your status using only that ID, to verify it; RevenueCat also processes your IP address and phone type. When your subscription status changes (purchase, renewal, cancellation, expiry, refund), RevenueCat sends a notification to our server, and we store only this: the source of your Premium (store), its expiry time, the subscription product (monthly or yearly) and the time of the last event. Why: to unlock your Premium limits and themes (performance of a contract). A store subscription is not cancelled by deleting your account; you cancel it in the store's subscription settings. When you delete your account, we delete this record and your RevenueCat record. Whether your Premium is on is shown to other people only as a yes or no: a thin Premium ring appears around your profile photo; nobody can see the source, the expiry time or the product of your subscription. For details and the auto-renewal terms see the Terms of Use.

Ads (free plan only)

On the free plan, only on Explore and at most once every 4 cards, a clearly labelled "Sponsored" ad that looks like a post card is shown. There are no ads inside capsules, when a capsule opens, in Messages, in notifications or in the create flow. There are no ads with Premium. Users under 18 (and accounts that have not entered a birth year yet) are never shown ads; our server grants the right to see ads accordingly. The ad is served by Google AdMob (Google, USA) and the request is not personalized: ads are not chosen by interest, your advertising ID and account details are not sent to Google, and no tracking permission is requested on iPhone. To request an ad, Google still receives the usual connection details (your IP address and the approximate location derived from it, phone type and operating system, app name); Google processes them to show the ad, prevent fraud and measure ads under its own privacy policy. If you are in the European Economic Area, the United Kingdom or Switzerland, Google's consent dialog may appear; if you do not consent, no ad is shown. If you tap an ad you go to the advertiser's page or store, which has its own policy. Your capsules, messages and profile information are never sent to the ad or linked to it. Why: to keep the app free (legitimate interest). Ad data is not stored on our server.

What stays on your phone

The following stay only on your phone and are not sent to our server: your session data, your general notifications on/off choice, your app language choice, an unfinished capsule draft (the text you wrote, the recipients' usernames, the date, the theme, and the secret question and answer, but not photos or voice), a voice recording you made but have not sent yet, the local reminders set on your phone for opening times, whether you have seen the first-launch intro, and, for the app rating prompt, how many capsules you have opened and when you were last asked.

In addition, the limits and theme list we last received from our server together with your Premium status (kept with your account ID so they still show correctly offline and never get mixed up if another account signs in on the same phone), and the numbers of the announcements you have closed, are stored on your phone; they are not sent back to our server. Your decision about usage statistics (allow or "not now") and up to 200 measurement events that have not been sent yet also wait on your phone; when you turn the permission off, the waiting events are deleted.

Microphone, camera, photos and motion sensors

• The microphone is turned on only in two situations and only when you take action: when you record a voice message, and when you blow out the candle in the Birthday Candle theme. When you blow, nothing is recorded; the app only measures, in the moment, how strongly you blow, and that measurement never leaves your phone. The microphone turns off as soon as you are done or the app goes to the background.
• Photos: the app only accesses the photos you pick; it does not read your whole photo library.
• The camera opens only when you tap "Take a photo" while creating a capsule, using your phone's own camera screen; the app never opens the camera by itself or in the background. Only the shot you keep is added to the capsule; like photos from your library, it is resized and its photo details (EXIF), including location, are removed before upload.
• Motion sensors (shaking, tilting) are used on your phone, in the moment, for the opening gesture of some themes; this data is not stored or sent.
• On-device translation: Under text written in a different language you may see a "See translation" link. Detecting the language and translating happen on your phone; the text you translate, its translation and its language never leave your phone, are not sent to our server or to Google, and are not stored anywhere. Translation never happens by itself; it happens only when you tap the link. For this, a language pack (about 30 MB) is downloaded to your phone once; you are asked before it downloads. The pack comes from Google's model server, and during the download only the download request itself (ordinary connection details such as your IP address) reaches Google; your content and your account are not part of that request. You can delete the pack in your phone's settings.

The app works even if you do not grant these permissions; every gesture has a tap alternative.

Technical logs

When the app or the link website (intimepost.com) connects to our servers, our service providers keep the IP address, the time and the requested address of the connection in short-lived server logs. We use these logs only to investigate faults and attacks. Legal basis: legitimate interests.

Language cookie on the website: to remember whether you chose Turkish or English, intimepost.com writes one small functional cookie named `dil` (`tr` or `en`) to your browser; it lasts a year, is written only when you tap the "TR | EN" switch, and you can delete it in your browser. It does not identify or track you and is shared with no one; the website has no advertising or tracking cookies.

The fonts are built into the app; the app does not download fonts from Google or anywhere else, so your phone's IP address is not sent to anyone for that purpose.

Usage statistics (optional)

To understand how the app is used, and only if you allow it, a very limited set of usage information is sent to our own server. We ask once on first launch; if you choose "Not now", nothing is sent and no feature of the app is limited. You can change your mind at any time in Settings → Usage statistics; when you turn it off, the pending records on your phone are deleted.

What is sent comes from a fixed list and contains no free text: which day you opened the app (with your phone type and the app version), opening the "New capsule" screen, tapping share or opening a link in the app, a capsule's opening screen appearing and you finishing the opening (the theme name, whether you opened it by gesture or by tapping, and roughly how long it took), opening the Explore tab, your answer to the notification permission prompt (yes/no) and the short code of an error type you ran into. Message content, names, location, device identifiers and IP addresses are not recorded for this purpose.

These records are linked to your account: raw events are kept for 3 days and the "which days were you active" record for 35 days; after that only daily totals from which nobody can be identified remain (for example, "120 people opened the app today"). If you delete your account, these records are deleted immediately. Numbers such as capsules, links and Explore are counted in aggregate from the service's own records, and we do not ask for your permission separately for that. These statistics are not sent to any new company; they stay on the server we already use. Legal basis: your explicit consent.

Crash reports. Under the same permission, if the app crashes, the technical trace of the crash (which line of code it happened in), your phone model, operating system and app version, and a random installation ID generated by Crashlytics are sent to Google's Firebase Crashlytics service. Your account ID, name, email or any content is not sent. Google keeps these reports for about 90 days. When you turn the permission off, or never give it, no crash reports are sent either. Legal basis: your explicit consent.

What we don't collect

• Location, contacts, call history. We deliberately do not use the advertising ID (IDFA/AAID): the ad request is not personalized, and we show no "tracking permission" prompt on iPhone.
• Tracking you across other apps, personalized advertising or selling data: none. The ad network runs only for the Sponsored card on Explore (see Ads); there is no third-party analytics tool. The only other exception is crash reporting, which runs only if you allow it (Google Firebase Crashlytics, see Usage statistics). We do not sell your personal information and we do not share it for targeted (cross-context behavioral) advertising.
• We never use the content of your capsules for advertising, profiling or training artificial intelligence.

Who can see what

• Your profile (username, display name, bio, profile photo, follower counts, your follow lists): anyone signed in to the app, except people you have blocked. No one can see your birth year.
• Your capsule's content: you, always; the recipient only after the opening time. Our server enforces this rule, so setting a phone's clock forward does not work.
• Before the opening time, the recipient sees only who it is from, the opening time, the theme and the types of content (for example "has a voice recording"); they cannot even see how long the recording is.
• Anyone who has the share link (even without signing in) can see the sender's display name and username, the opening time, the theme, the secret question (if any) and whether the link has been claimed; they can never see the content. The first person to claim the link becomes the capsule's recipient. So only send the link to the recipient.
• Explore: a capsule becomes visible to everyone signed in (except blocked users) if the sender offered it and the recipient approved it after opening it. What is shown: the message, the photos, the sender's name and (unless the recipient hid it) the name given to the recipient. Voice recordings are never shown on Explore. Either of you can remove it at any time.
• The sender can see who claimed the link.
• "Sample" capsules on Explore belong to the app's official account (@intimepost). They are not messages from real people; we wrote them to show how the app works. Their like counts come from real users.
• Verified badge: a small verified badge appears next to the name of the app's official account (@intimepost). Only we can give or remove it; users cannot give it to themselves. We do not give new accounts usernames that could be mistaken for the official account (for example "intimepost", or words like "official" and "support", including versions with dots, underscores or digits).
• Your chat messages: only the two people in the chat. If either of you blocks the other, the chat is hidden from both of you. A message you report is not shown to you again; the moderator sees the reported message.
• Us: technically we can access the database; content is not end-to-end encrypted. We look at content only to review a report, when the law requires it, or at your request.

Service providers and international transfers

We use the following services to run InTimePost. Each of them processes your data only on our behalf and only to provide its service (as a "processor"):

• Supabase (Supabase, Inc., USA): database, file storage, sign-in and server functions. The servers that hold your data are in the European Union (Germany).
• Google Firebase Cloud Messaging (Google): delivering notifications. Your device token and the notification text (the other person's name) pass through Google's servers.
• Google Firebase Crashlytics (Google): crash reports, only if you allowed usage statistics. The crash trace, phone model, operating system and a random installation ID are sent; your account and content are not.
• Apple Push Notification service (Apple): delivering notifications to iPhones (via Firebase).
• Google AdMob (Google, USA): non-personalized ads on Explore (free plan only, 18 and over; details: Ads).
• RevenueCat (RevenueCat, Inc., USA): managing the Premium subscription. Your random user ID (not your name or email), purchase information, IP address and phone type are processed; your payment details exist only at Apple or Google. When you delete your account, your RevenueCat record is deleted too.
• Apple App Store and Google Play: they take the Premium payment and are subject to their own privacy policies; we never see your card details.
• Sign in with Google and Apple: if you sign in this way, the sign-in provider knows that you signed in to InTimePost. If you signed in with Apple and delete your account, we also revoke Apple's access: we send Apple a fresh authorization code, immediately revoke the token Apple returns, and never store it anywhere.
• Cloudflare (Cloudflare, Inc., USA): hosting the link website (intimepost.com: capsule links and these pages).
• GitHub (GitHub, Inc., Microsoft, USA): storing the nightly backups. Backups are sent to GitHub already encrypted with our own passphrase; GitHub cannot read them.

These providers' servers are outside Turkey, so your data is transferred abroad. The legal basis and safeguards for these transfers under Turkish law are explained in the KVKK Information Notice. Supabase's servers are inside the European Economic Area; Google, Apple and Cloudflare may process data in the United States and other countries.

We never sell your data to anyone. We may share it with the competent authorities when the law requires us to (for example, a court order or a request from an authorized authority) and when we detect child sexual abuse material (Child Safety Standards).

How long we keep data

• Your account and profile: until you delete your account.
• Capsules you send (including content): until you delete your account. If the recipient deletes their account, the capsule stays in your account and only its link to the recipient is removed; if it is on Explore, it is taken down.
• A capsule you cancel: its message text is deleted at the moment you cancel; its photo and voice files are deleted the next time your app is online, unless another capsule still uses them (the other recipients of a group send, or a repeating capsule chain). The capsule record (the name you gave the recipient, the dates, the theme, the content types and any secret question) remains until you delete your account.
• Capsules sent to you: if the sender deletes their account, the capsule is deleted with it. If you delete your account, your access ends; the sender's record remains.
• Chat messages: 90 days; after that they are deleted automatically every night. When you delete a message for everyone, its text is deleted immediately. If you or the other person deletes their account, the chat between you is deleted immediately for both of you. The times you sent messages (for the limit): entries older than one day are deleted every night.
• Follows, likes, blocks: until you remove them or the account is deleted. The times you followed people (for the daily follow limit): entries older than one day are deleted every night.
• Account suspension records: until the account is deleted (including lifted suspensions).
• Suspension appeals: deleted 1 year after a decision is made (an appeal without a decision stays until one is made); deleted immediately if you delete your account.
• Warning (strike) records: until the account is deleted (including removed warnings).
• Record of administrative actions: 2 years, then deleted automatically every night. It stays for that period even if your account is deleted (so that decisions can be audited).
• Reports: until the reporting account, the reported account or the reported capsule is deleted; reports that have been reviewed and closed are deleted after 1 year at the latest.
• Child safety reports: a copy of the reported content (the message text and the names of the photo and voice files; when the reported account is deleted, the files themselves are also copied to a separate locked store; in chat, the reported message and the last 20 messages of that chat) and of the account (username, display name) is kept in a separate, locked record for 1 year so the case can be passed to the competent authorities, even if the reported account is deleted. Only the person responsible for child safety can access this copy (Child Safety Standards).
• Notification device token: until you turn notifications off, sign out, delete your account or Google treats the token as invalid. Notification queue: at most 7 days. Records on the Notifications page: 90 days.
• Usage statistics (if you allowed them): raw events 3 days, the "which days were you active" record 35 days; after that only daily totals from which nobody can be identified remain. If you delete your account, the first two are deleted immediately.
• Crash reports (if you allowed them): about 90 days in Google Firebase Crashlytics.
• Premium subscription record (source, expiry, product, time of the last event): deleted in the nightly cleanup 1 year after it ends; deleted immediately if you delete your account.
• Session records: until the session ends or the account is deleted. The sign-in service's separate audit log (contains IP addresses): for the provider's own retention period; we have not set a deletion period of our own yet.
• Server logs: for the provider's own retention period; about 1 day in our admin panel. Real-time delivery records for chat stay in Supabase's short-lived logs for a few days.
• Backups: copies left in backups are deleted when the backup expires (after at most 60 days).

If there is a legal obligation, an ongoing investigation or a dispute, the relevant data may be kept for as long as that obligation requires.

Deleting your account and your rights

To delete your account: in the app, go to Profile → Settings → Delete account. For details, and what to do if you cannot access the app, see Delete your account.

When you delete your account, your profile, the capsules you sent, your photos, voice recordings, chats (on the other person's side too), follows, likes, block list, reports and notification records are deleted on the server in a single operation, immediately (within a few minutes automatically if the network drops). The only exception is the copy of content that is the subject of a child safety report (How long we keep data). What is deleted and how is explained on the Delete your account page.

Without deleting your account you can also: turn off notifications in Settings (your device token is deleted from our server), remove your Explore posts, cancel a capsule you sent before it opens, and edit your profile.

You have the right to ask us whether we process your data and to get information about it, to have it corrected, to have it deleted, to object to processing, and to object to a decision against you made solely by automated means. If the GDPR applies to you, you also have the right to restrict processing and to receive the data you gave us in a portable format. Your rights under the KVKK, and how to apply, are set out in the KVKK Information Notice; you can use any of the rights above the same way, by emailing intimepost.app@gmail.com. We respond free of charge within 30 days.

If you are not satisfied with our answer, you can complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or, if you live in the EU, the EEA or the UK, to the data protection authority where you live.

Security

• All traffic between the app and the server is encrypted (HTTPS).
• Every database table is protected by a "deny by default" rule: each user can only see the rows they are allowed to see. Access to capsule content and files is enforced on the server.
• Files are accessed only through short-lived, signed addresses.
• Share links cannot be guessed (144 random bits); a secret question allows at most 5 wrong answers.

No system is perfect. If there is a security breach, we will notify the Turkish Personal Data Protection Board and the affected users as required by the KVKK, and anyone else that applicable law requires us to notify.

Children

InTimePost is not for children under 13. No ads are shown to anyone under 18. We ask for your birth year when you create an account, and children under 13 cannot create one; we do not knowingly collect personal information from children under 13. If you notice that a child under 13 has created an account, write to us and we will delete it. If you are under 18, we recommend using InTimePost with your parents' knowledge. Our rules for protecting children: Child Safety Standards.

Changes to this policy

If the app starts collecting new data or using data for a different purpose, we will update this policy beforehand and announce important changes inside the app. The date at the top of each document shows when it was last updated; that version applies from that date.

Contact

intimepost.app@gmail.com