DATA PROCESSING NOTICE
Know how data is used before processing starts.
Important: This is the information notice required by Turkish KVKK Article 10, not a consent form. Contact matching and optional analytics choices are requested separately in the app.
1. Controller
Ayna is controlled by Sajad Abdolvandi. Send privacy and data-rights requests to sajadabdolvandi@gmail.com.
2. Data and purposes
- Phone and account: Google Firebase Auth processes the raw phone number for OTP verification and fraud/abuse prevention; after successful verification, Supabase Auth associates it with the Ayna session. Ayna stores a one-way salted hash, display name, 18+ declaration, language, and preferences.
- Contact matching: Only after separate consent and device permission, phone numbers are normalized and hashed on-device; only hashes, account ID, and upload time reach the server to find mutual users.
- Tags and safety: Curated word, author/subject IDs, time, reports, blocks, and rate-limit records provide the social feature and protect users. Individual author-tag relationships are never disclosed to the portrait subject.
- Optional measurement: Allowed product events become daily aggregate counters. Referral measurement requires both parties’ separate analytics choice and exposes totals only.
- Reliability: No error message or stack is sent; only an opaque fingerprint, fixed class/source, platform, version, and daily count may be processed.
3. Collection and legal bases
Data is collected electronically from forms, in-app actions, the device address book after permission, and service providers. Core account/profile/tag data is processed to form or perform the service agreement (KVKK 5/2-c). Safety and reliability use legal-obligation and/or rights-respecting legitimate-interest grounds (5/2-ç and 5/2-f). Contact hashes, optional analytics, and referral measurement require separate explicit consent (5/1).
4. Recipients and international processing
Google Firebase provides phone verification and abuse prevention; Supabase provides the resulting Ayna session, database, and hosting in the current Australia region; Apple distributes the app; Vercel hosts this site and may create standard access logs. Authorities receive data only when legally required. RevenueCat, ads, and third-party analytics are inactive in the free release. Ayna will not enable general availability in Türkiye until the appropriate KVKK Article 9 transfer safeguard and required operational filings are complete; this notice does not claim an unfinished contract or registry entry.
5. Retention and deletion
- Non-member contact hashes: up to 90 days.
- Contact-consent withdrawal: uploaded hashes and matches are deleted.
- Identity-free error totals: up to 30 days.
- Account deletion permanently removes the profile, tags by/about the user, contact hashes, consent/referral records, and entitlements, except independently required legal records.
6. Rights and choices
KVKK Article 11 rights include access, purpose/recipient information, correction, deletion, recipient notification, objection to solely automated adverse results, and compensation for unlawful processing. Export, withdrawal, visibility, and deletion controls are in Settings. Email sajadabdolvandi@gmail.com; eligible requests are answered within 30 days.
7. Separate choices
Reading this notice is not consent. Contact matching uses an explicit button; analytics uses a separate off-by-default switch. Each can be withdrawn independently. Material purpose changes are disclosed before new processing starts.