KVKK Information Notice

Effective date: 1 October 2026 · Last updated: 7 October 2026

1. Data controller

Emirhan Sarıal (an individual) Email: intimepost.app@gmail.com

2. Personal data we process

• Identity: username, display name, profile photo; when you sign in with Google or Apple, the name supplied by the sign-in provider and (for Google) the address of your profile picture.
• Contact: your email address, when you sign in with Google or Apple.
• Birth year: only for age limits (13 to create an account, 18 for chat).
• User content: capsule messages, photos, voice recordings, bio, the name given to the recipient, secret questions and a one-way hash of their answers.
• Correspondence: chat messages between adults who follow each other (90 days), read receipts, mute settings.
• Social connections and activity records: follows, likes, blocks, the times capsules were sent, received, opened and cancelled, Explore choices, the time you accepted the terms, in-app notification records, notification preferences, app language.
• Reports and safety records: reports made by and about you, results of automated checks, posting bans, account suspension records.
• Usage statistics (only if you allow them): limited events chosen from a fixed list, such as the day you opened the app, finishing a capsule opening and the type of error you ran into; no content, location or device identifier. Crash reports under the same permission: crash trace, phone model, operating system and a random installation ID (no account ID or content).
• Ads (free plan only, 18 and over): the IP address, phone type and version and app name sent to Google AdMob with an ad request; no personalization, no advertising ID, no account ID.
• Subscription (only if you buy Premium): your random user ID, the source of the subscription (store), its expiry time, product (monthly/yearly) and the time of the last event. Your payment details are at Apple or Google, not with us.
• Device and transaction security: notification device token, phone type, the IP address and app information in session records, server access logs.

We do not ask for and do not process for any purpose special categories of personal data (such as health, religion, ethnic origin or biometric data). If you choose to write such information in your capsules, it is processed only to store the capsule and deliver it to your recipient; content is not examined for this kind of information. Voice recordings are only played to the recipient; no voice identification is performed.

3. Purposes and legal grounds

Under Article 5(2) of the KVKK, without your explicit consent (except usage statistics, see "Explicit consent" below):

• Establishing and performing a contract (Art. 5(2)(c)): creating and managing your account, running your Premium subscription, showing your profile, storing capsules and opening them for the recipient at the opening time, share links and secret questions, following and direct sending between people who follow each other, chat between adults who follow each other, likes, showing capsules on Explore with your and the recipient's approval, sending notifications if you turned them on, and deleting your account.
• Our legitimate interests (Art. 5(2)(f)): showing non-personalized ads on Explore on the free plan so the app can stay free, account and system security, preventing abuse (daily limits, reporting and blocking, the banned-word filter, automatic hiding and posting bans), enforcing the minimum age of 13, investigating faults, and complying with app store rules.
• Legal obligations (Art. 5(2)(ç)): requests from competent authorities, reporting child sexual abuse material, data security obligations.
• Establishing, exercising or protecting a right (Art. 5(2)(e)): keeping the records needed in a dispute; keeping content that is the subject of a child safety report, together with the account information, for 1 year so it can be passed to the competent authorities.

Processing that would require explicit consent

The processing based on your explicit consent is usage statistics and crash reports (see the Privacy Policy). The app asks for it separately on first launch, with a "Not now" option; if you decline, no events are sent and no feature is limited. You can withdraw your consent at any time in Settings → Usage statistics; withdrawal does not affect processing before it. If we start doing any of the following, we will first ask for your explicit consent separately, independently of this notice, in a way you can refuse:

• sending marketing, campaign or promotional notifications or emails;
• showing personalized (interest-based) ads, or sharing data with advertising and third-party analytics companies for that purpose (the ad on Explore is not personalized; our usage statistics stay on our own server);
• processing special categories of personal data (for example, health data) for any purpose.

The permissions your phone asks for (microphone, camera, photos, notifications) are operating system permissions; they are not explicit consent within the meaning of the KVKK, and refusing them does not prevent basic use of the app.

Automated decisions

Profile text, messages that are going to appear on Explore and chat messages are checked automatically against a list of banned words (a chat message containing a banned word is not sent). Content that receives a certain number of reports, or a report for a serious reason, is automatically hidden from Explore, and repeated violations automatically lead to a 30-day ban on posting to Explore (Community Guidelines). You can object to these outcomes (Art. 11(1)(g)); a human reviews your objection.

4. How we collect data

Data is collected electronically while you use the app: from the information you enter (profile, capsules, reports), from records the app creates automatically (times, device token, session), from Google or Apple when you sign in with them, and from other users' actions that concern you (sending you capsules, following you, reporting).

5. Transfers

Your personal data is transferred only to provide the service and only as far as necessary, to:

• Service providers (data processors): Supabase, Inc. (database, storage, sign-in; servers in the European Union, Germany); Google (notification delivery through Firebase Cloud Messaging; non-personalized ads on Explore through AdMob; crash reports through Firebase Crashlytics if you allow them; Sign in with Google); Apple (notification delivery to iPhones, Sign in with Apple); RevenueCat, Inc. (managing the Premium subscription); Cloudflare, Inc. (link website); GitHub, Inc. (storing encrypted backups).
• Other users: within the limits described in the Privacy Policy (your profile, capsules opened for your recipient, Explore with both parties' approval, your messages to the person you chat with).
• Competent public authorities and courts: when required by law.

International transfers

The servers of the service providers above are outside Turkey (the European Union for Supabase; several countries, mainly the United States, for Google, Apple, RevenueCat, Cloudflare and GitHub). These transfers are made under Article 9 of the KVKK (as amended by Law No. 7499 in 2024). The Personal Data Protection Board has not issued an adequacy decision for these countries. We therefore intend to make the transfers under one of the appropriate safeguards in Article 9(4), the standard contract published by the Board: the contract is signed with the provider and notified to the Personal Data Protection Authority within five business days of signing.

Where things stand today: these standard contracts have not yet been signed with any of the providers or notified to the Authority. The process is under way; as it is completed for each provider, this section will be updated to say which provider it is completed with. In the meantime the providers are data processors that handle your data only on our behalf and on our instructions, under their own publicly available terms of service and data processing addenda. Those terms do not replace the Board's standard contract. Explicit consent is not used as the basis for these regular, ongoing transfers; the transfer is necessary for the app to work, and if you do not accept it you can delete your account. You can send questions and requests about this to intimepost.app@gmail.com.

6. Retention periods

Data is kept for as long as needed for the purpose it is processed for, and deleted when that period ends. Detailed list: Privacy Policy, How long we keep data. When you delete your account, your data is deleted immediately (except the copy of content that is the subject of a child safety report); copies in backups disappear within 60 days at most.

7. Your rights (KVKK Art. 11)

By applying to us, you have the right to:

• find out whether your personal data is processed;
• request information about it if it is;
• find out the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Turkey or abroad to whom it is transferred;
• ask for it to be corrected if it is incomplete or inaccurate;
• ask for it to be deleted or destroyed under the conditions in Article 7 of the KVKK;
• ask for corrections and deletions to be notified to the third parties to whom the data was transferred;
• object to a result against you that arises from analysis made exclusively by automated systems;
• claim compensation if you suffer damage because your data was processed unlawfully.

How to apply

You can send your application in writing, in line with the Communiqué on the Procedures and Principles of Application to the Data Controller, or by email to intimepost.app@gmail.com from the email address registered in our system. Clearly state your full name, your @username in the app, your contact details and your request. If the address you write from does not match the email on your account (for example, if you hid your email when signing in with Apple), we may ask for additional information to confirm that the account is yours.

We will resolve your application free of charge within 30 days at the latest. If you find our answer unsatisfactory, or if we do not answer in time, you can file a complaint with the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).