Last updated: {{last_updated}}

This Privacy Policy explains how {{controller_name}} processes your personal data when you use SafaChat. Read it together with the KVKK Disclosure Notice, which contains the disclosures required by Turkish data protection law.

1. Data We Collect

We process: profile data (name/nickname, birth date, photos, bio, interests, preferences); location data (see Section 3); communication metadata — not message content (which accounts communicated, when, delivery/read status, and connection information such as IP addresses); and device and usage data (device model, OS, app version, language, identifiers needed for push notifications, and interaction events such as likes and matches).

2. End-to-End Encryption and Message Content

Messages are end-to-end encrypted; our servers cannot decrypt message content. We do not claim that nothing is ever visible to us — the accurate picture is: (a) we retain the communication metadata described above; (b) the app may flag a conversation for review based on keyword matching that runs on your device; and (c) when a user reports a conversation, the reported messages as decrypted on the reporting user's device, together with any screenshots provided, are transmitted to our moderation team and processed to investigate the report. Undelivered encrypted messages are held temporarily in encrypted form until delivery and then deleted.

3. Location

Discovery is distance-based, so we process your device location only while the app is open; we do not track location in the background. Coarse location and distance are derived for matching; other members see approximate distance, never your exact coordinates.

4. Cookies and Similar Technologies

Our websites and the app use strictly necessary cookies (session, security) and, with consent where required, functional and measurement technologies. You can manage cookies through your browser or device settings; blocking necessary cookies may break sign-in.

5. Purposes of Processing

We process data to: provide and secure the Service (account management, matching, message delivery, single-active-device enforcement); moderate and keep the community safe (report handling, fraud and abuse prevention, age enforcement); provide paid features and billing; comply with legal obligations; and, with your consent where required, send notifications and improve the Service through aggregated analytics.

6. Sharing and Transfers

We share data only as needed: push notification providers (Google FCM, Apple APNs — delivery tokens and encrypted payloads); infrastructure providers (hosting, object storage for encrypted media, search infrastructure for discovery); payment/app stores for purchases; and competent authorities where a valid legal request or obligation requires it. We do not sell personal data.

7. Retention

Profile data is kept while your account exists and deleted or anonymized after account deletion, subject to the grace period. Communication metadata and consent records are retained for the periods required for legal compliance, security, and the establishment of legal claims, then deleted. Encrypted message content is not stored on our servers beyond the temporary delivery queue described in Section 2.

8. Security

We apply technical and organizational measures including end-to-end encryption for messages, encryption in transit and at rest for stored data, access controls, audit logging, and admin access restrictions. No system is perfectly secure; we notify affected users and authorities of breaches as required by law.

9. International Transfers

Some providers (for example push notification services) process data outside your country. Where data is transferred internationally we rely on the safeguards required by applicable law, including explicit consent or adequacy/contractual mechanisms under KVKK Article 9 and, where applicable, GDPR Chapter V.

10. Your Rights

Under KVKK Article 11 and, where applicable, the GDPR you may: learn whether your data is processed; request information, correction, or deletion; object to certain processing; request restriction; receive a copy (portability); and withdraw consent at any time without affecting prior processing. Use the in-app tools or the contact details below; we respond within the statutory deadlines. You may also complain to the competent supervisory authority.

11. Children's Privacy

The Service is for adults (18+). We do not knowingly process children's data; accounts reasonably believed to belong to minors are terminated and their data deleted, subject to legally required retention.

12. Changes and Contact

We may update this Policy; material changes are announced in the app and the current version is always available. Contact: {{controller_name}}, {{address}}, e-mail {{contact_email}}.