PRIVACY POLICY
Your data stays under your control.
In short: Ayna does not offer stranger search, does not upload raw address-book numbers, and never shows who assigned a specific tag. This policy describes the app’s actual data flow.
1. Controller and contact
Ayna is operated and controlled by Sajad Abdolvandi. For privacy or data-rights requests, email sajadabdolvandi@gmail.com.
2. Data we process
Phone and account
Google Firebase Auth processes your phone number for OTP verification and fraud/abuse prevention; after successful verification, Supabase Auth associates it with your Ayna account session. Ayna’s profile table stores a one-way salted SHA-256 hash of the normalized number instead of the raw number. We also store your display name, 18+ eligibility declaration (a boolean, not date of birth), language, and preferences.
Contacts
Contacts are not read without explicit device permission and separate consent. Numbers are normalized and one-way hashed on your device; raw address-book numbers do not leave the device. Only hashes are uploaded to find mutual Ayna users.
Tags and portraits
We store the selected curated word with author and subject account IDs. There is no free text. Results are disclosed only as an aggregate portrait after at least three distinct authors contribute; individual author-tag relationships are not shown to the subject.
Safety and preferences
Reports, blocks, consent records, and anti-abuse counters are used to protect the service. Optional analytics consent is separate and off by default. When enabled, only curated product events are added to daily aggregate counters without a user or device identifier. The current free v1 has no third-party advertising or tracking SDK.
Invite measurement
When you enable analytics, an opaque code may be added to your invite link. If the recipient separately enables analytics, the inviter sees only aggregate activation and mutual-match counts; the recipient’s identity, phone, and individual activity are never disclosed. If either party withdraws analytics consent, the related referral record is deleted. Without consent, the invite still works without attribution.
Operational reliability
Error messages and stack traces are not sent. To detect app regressions, only an opaque fingerprint, fixed error class/source, platform, app version, and daily count may be kept for up to 30 days; no user, account, or device identifier is stored.
3. Purposes and legal bases
Account, profile, and core social data are collected electronically through your actions and used to provide the requested service and maintain safety. Contact hashes and any optional analytics processing require separate consent. Reports and safety records may be processed to meet legal obligations and protect users and the service.
4. Service providers
Google Firebase provides phone verification and abuse prevention. Supabase provides the resulting Ayna session, database, and hosting infrastructure (the current Supabase project region is Australia). Apple processes distribution-related data under its own terms. This support site is hosted by Vercel and may generate standard access logs. RevenueCat, ad networks, and third-party analytics are not active in the current free v1.
5. International processing
Infrastructure providers may process limited data outside Türkiye. Ayna must apply the notices, permissions, and transfer safeguards required by applicable Turkish data-protection law. This statement does not claim an unnamed certification, registry entry, or contract.
6. Retention and deletion
- Non-member contact hashes are kept for no more than 90 days.
- Revoking contact consent deletes uploaded hashes and derived matches.
- Safety and support records are retained only as needed for their purpose and applicable legal periods.
- Account deletion permanently removes the profile, tags by and about the user, contact hashes, consent and referral records, and entitlements, except independent records that law requires us to keep.
7. Your choices and rights
You can revoke contact access, hide your portrait, block users, and delete your account in the app. Under Turkish KVKK Article 11, eligible users may request access, information about purposes and recipients, correction, deletion, notification to recipients, objection to solely automated adverse results, and compensation for unlawful processing. Email sajadabdolvandi@gmail.com; requests are answered within 30 days.
8. Age and changes
Ayna is for people aged 18 or older. Material policy changes will be announced in the app or on this site before they take effect.