Privacy and personal data notice

At a glance

This notice explains what personal information Auranim uses in its app and web service, why it is used, who may receive it, retention arrangements and your choices. Accepting the membership terms is not consent to every processing activity described here. Regional rights apply according to the relevant law’s conditions of application.

1. Operator and contact

The data controller who operates Auranim as an individual and determines the purposes covered by this notice is Gökhan Güney. Contact and service address: Yeni Mahalle, Abdulhalik Renda Sokak, Kiptaş 2, A16 Blok, Daire 59, 34570 Silivri / İstanbul, Türkiye. Support and personal data requests: destek@auranim.app. Auranim is an application name; using that name does not mean a separate company has been incorporated.

The service is for people aged 18 or over. Users declare their date of birth when registering and their age is calculated from it; membership or a profile photograph does not mean identity, age or trustworthiness has been verified. If you suspect an underage account, use the in-app reporting option or contact support. Do not send unnecessary identity documents or content involving children.

2. Information collected and its sources

Registration and account operations use an email address, username, declared date of birth and calculated age, account identifier, password hash, session information and settings. Passwords are not stored in plain text. If you request password recovery, a single-use code valid for 30 minutes is emailed to you. Ordinary registration does not currently require email verification.

Your profile includes country and city and, if you choose, district, photographs, biography, interests, a conversation starter and additional information such as school, occupation, height, languages, education and lifestyle. Gender, the people you wish to meet, one or more meeting intentions and age, city and distance preferences are used for discovery. Photographs and free text can reveal sensitive information; avoid unnecessary health, belief, sex-life information or another person’s private information. The current version has no facial recognition or biometric identification function.

We process likes and skips, matches, message requests, messages and photo/voice attachments, replies, reactions, answers to shared questions, sending/delivery/opening information, and call type, status, participants and times. User reports, text evidence selected for them and support correspondence are also processed. Most information comes from you, people interacting with you or interactions between your device and the service; a report or verified official request may also come from third parties.

With device permission, location and location accuracy are received; a notification token is received when push notifications are enabled. Operating the service produces IP addresses, request paths, response status/times, connection and error information. Premium/test entitlement periods, gold balances, usage transactions and the time zone for daily resets are recorded to operate the features.

Your date of birth is stored privately with your account to apply the minimum age of 18 and keep your calculated age current; other users see only your age. After saving it, contact destek@auranim.app to request a correction. An authorized administrator can correct it with a recorded reason. Dates of birth are not inferred for older accounts that declared only an age; their declared age is used until they provide a date.

3. What other users can see

Your username, age, visible photographs, profile text, country/city and any district provided, gender and meeting intentions may appear on relevant profile screens. The list of genders you wish to meet is not published on your profile; preferences are used for matching. Your date of birth, email address, password and stored location coordinates are not sent to other users’ profile screens.

Visibility depends on discovery, matching and blocking rules and your settings. Message content is supplied to the conversation participants. Read receipts are shared when both parties enable the relevant setting; the service also processes delivery and opening information. Online/last-seen status, approximate distance and location visibility can be managed through the relevant settings. Typing and voice-recording indicators are transmitted temporarily.

A person who sees information may save it outside the app or share it with someone else. Blocking, hiding your profile or deleting your account cannot recall independent copies already made. Avoid unnecessary detail such as your home or workplace address in your profile.

4. Purposes and legal grounds

Information needed to create the account and maintain a secure session, provide the core profile service you choose, operate matches and conversations, and provide requested password recovery and account support is processed to enter into or perform the contract, to the extent permitted by applicable law. This ground does not cover every use of information that is unnecessary for the service.

Optional sensitive profile and matching preferences are subject to separate explicit consent choices. Using optional device location also depends on your location permission and choice. The registration checkbox or reading this notice is not sufficient for processing that requires consent. Additional conditions for processing special-category information remain applicable; a general legitimate-interest claim does not replace them.

Necessary and proportionate processing for session security, limited abuse prevention, troubleshooting, examining reports and establishing, exercising or defending legal claims may rely on the protection of legal rights or legitimate interests where the applicable legal conditions are satisfied. Reliance on legitimate interests requires consideration of individuals’ rights and freedoms, necessity and proportionality. Any recording or disclosure based on a legal obligation is limited to a specific applicable obligation and the necessary scope; a possible dispute is not a reason to keep every record indefinitely.

5. Separate privacy choices and withdrawal

In the current sign-up flow, membership acceptance applies only to the agreement. Optional profile information and matching preferences are explained next to the relevant fields. When you add information for a purpose you have not yet permitted, “Agree and save”, linked to the displayed explanation, records explicit consent only for the described use of those fields. Opening fields, reading the explanation or leaving fields empty does not create permission. You can leave profile fields blank, set matching preferences later and withdraw permission in Settings → My privacy choices.

Privacy choices provides separate choices for optional profile information and matching based on meeting preferences. You may refuse either or both. Refusing the profile permission lets you use the account while leaving the relevant optional fields empty. Refusing matching permission disables discovery and new matches based on those preferences; existing conversations and account operations remain available.

Withdrawing profile permission clears your biography, interests, conversation starter and relevant additional fields from the active profile. Withdrawing matching permission clears gender/meeting preferences, hides the discovery profile and removes stored location. These actions do not automatically delete your photographs, account or existing conversations. Granting permission again does not restore deleted preferences. Withdrawal does not affect the lawfulness of lawful processing carried out before withdrawal.

The version, purpose text and time of your choices are retained with your account in the permission history; deleted profile content is not copied into that history. Some accounts under the older closed-test process may not have a new permission record; acceptance or explicit consent is not fabricated retrospectively for them. This notice does not replace permission that was never obtained.

6. Location and device permissions

When you choose nearby discovery and grant device permission, coordinates and accuracy information are sent to the server. Stored coordinates are rounded to an approximate area; precise coordinates are not published on your profile. Location stops being used for discovery 24 hours after its last update and becomes subject to periodic cleanup. The city you live in is based on the country/city you declare in your profile, separately from device location.

With permission enabled, location may refresh when the app opens or returns to the foreground. No background route or encounter history is collected. Removing location in the app also stops automatic refresh on that device; you can enable it again by choosing to update location. Device permission can be revoked in device settings. Without location you can still use existing conversations and account operations, and choose city or country discovery where the relevant preferences allow it.

Camera/photo selection, microphone and notification permissions are requested for the function you use. Refusal affects that function. Photo files may contain device or capture information; there is no guarantee that all file metadata is automatically removed from every upload.

7. Messages, view-once photographs and calls

Ordinary matched conversations remain while the match exists. Ending the match or blocking removes the relevant conversation from the active service for both parties; attachment files are cleaned through a deletion queue. Evidence already included in a report and records separately preserved for a specific legal reason may follow different retention rules.

A view-once photograph is delivered in response to the recipient’s first successful opening request; that operation revokes further access and deletes or queues deletion of the server file. Access to an unopened photograph ends after 24 hours. Opening status may remain in the conversation. This feature is also available on the web. Screenshots or recordings cannot be prevented in the browser; mobile protections also depend on device support. We cannot guarantee prevention of capture using another device or an independent copy made by the recipient. View-once files are not opened in the ordinary administrator media viewer.

We do not claim end-to-end encryption for chats. For voice/video calls, the app processes call type, status, participants, times and connection-establishment signals; the current version has no function for recording live call audio or video on the server. WebRTC connections may be direct or relayed; IP and connection information may reach the other party’s device and relevant connection providers. Voice messages are stored as conversation attachments, separately from live calls.

8. Providers and international processing

Google Cloud is used for hosting/server services; Cloudflare for domain/network services and call relaying when configured; and Resend for password recovery email. The recipient email address and message containing the recovery code are sent to Resend for delivery. Depending on the configuration, call connections may also use Google STUN or other configured STUN/TURN services.

When push notifications are enabled, Expo and the relevant mobile notification infrastructure process the device token and routing information. Notifications use a general title/body and relevant record identifiers; ordinary chat text is not placed in the notification body. Support correspondence passes through your email provider and Auranim’s support email infrastructure.

Service providers, authorised support/administration and legally authorised authorities may receive information limited to the relevant purpose. Other members receive information through the visibility and communication functions described in section 3. Optional mobile rewarded ads use Google AdMob as described below; real store payment collection remains disabled.

Infrastructure, communication and support services may process information outside Türkiye, including locations in Europe or the United States. This does not mean a current country list for every sub-provider has been verified. You may ask destek@auranim.app about countries and transfer arrangements. This notice, membership acceptance or device permission is not, by itself, a legal ground for international transfers. Required transfer conditions and safeguards must be established separately; we do not claim that an adequacy assessment, signed standard contractual clauses or an overseas representative appointment has already been completed.

When profile photo moderation is enabled, newly uploaded profile photos are sent to the European endpoint of Google Cloud Vision SafeSearch to assess potentially inappropriate content. Location/capture metadata is stripped from the image. Only image content is sent; usernames, email addresses, chat content and location coordinates are not included in this check. Likelihood labels for adult content, violence and related categories are returned; no face recognition, identity or age verification is performed. Suspicious or incomplete results go to human review; this stage does not automatically ban accounts or reject photos. Users are notified of the decision and reason and may appeal through support. Other users cannot view a photo while it awaits approval. Selected photos and review status are retained until the photo is removed from the profile or the account is deleted; unused uploads are removed during cleanup. Applicable international transfer arrangements for the Google service must be addressed separately.

Optional rewarded ads in the Android/iPhone app use Google AdMob, with Google UMP for consent management. When ads are served, Google may process IP address and inferred general region, device/app identifiers, ad views and interactions, and diagnostic/performance information for ad delivery, measurement and fraud prevention. Requests specify non-personalised ads; this does not mean no data is processed. Profile preferences, chats, email and GPS coordinates are not added to ad requests. Only a random transaction identifier is sent to Google to associate a reward with an account; signed verification is checked by our server. Where required, a consent form appears before ads; Ad privacy preferences is available in app settings. Watching ads is optional. Google data information: https://policies.google.com/technologies/ads . Payments are processed by the relevant app store. Auranim stores the purchase reference and verification result, not the full payment card number.

9. Device storage, cookies and cache

A session cookie maintains web sign-in; in production configuration it is limited through secure-connection and HttpOnly/SameSite settings. Mobile session keys use the operating system’s secure storage. Language, appearance, permission/device preferences and a limited message cache that helps conversations open faster may be stored in the app or browser’s local storage.

Processes clear relevant local records on sign-out, account changes and deleted-conversation notifications. An offline device may update old content only after reconnecting and receiving the new state or after local data is cleared. Clearing browser data does not delete the server account. The mobile ad SDK and UMP may store identifiers and consent preferences on the device. Ad privacy preferences is available in app settings; the web app does not load the mobile ad SDK.

10. Retention periods

Account and profile records remain while the account is open; matched messages, answers, reactions and ordinary attachments remain while the relevant match exists. In-app Admin support conversations are separate from matches and remain until account deletion. Terms acceptance, privacy-choice history and entitlement-use records relate to your account and are removed with it in the current system. Specific legal preservation exceptions are described in section 11.

Text evidence selected for a report normally follows a 30-day cycle; report descriptions/review records and administrative action logs follow a 90-day cycle. Ended-call records, general notifications and previous photo-review applications are cleaned on a 30-day cycle; message notifications may use a shorter 24-hour period. Selfie files submitted for earlier photo reviews expire within seven days. The 24-hour rules for approximate location and view-once photographs are described above.

Managed server logs have a seven-day cleanup configuration and managed backups a 30-day configuration. Backups are not available through ordinary user access. These periods do not mean that all external providers or independent copies erase information at the same time. Deleting support emails within 90 days after the request closes is a separate process that the support operator must carry out.

Cleanup jobs run periodically and retry file-deletion failures. Earlier erasures and withdrawn permissions must be reapplied after restoring a backup. Legally required preservation for a particular event is assessed separately with an appropriate scope and duration. These technical periods do not replace the legally required retention period applicable to an individual event.

Ad transaction records prevent duplicate rewards; records older than 30 days are removed during scheduled cleanup and are deleted with the account. Wallet history follows its own retention rules.

11. Account deletion, report evidence and official requests

You can delete your account through Settings → Safety and account → Delete my account. If you cannot access the app, email destek@auranim.app to request account and data deletion. Uninstalling the app does not delete the account. Active account, profile, session and linked conversation/match records are removed; file cleanup and backup rotation operate separately.

Text evidence previously selected for a report may remain separately for its normal period even after the source conversation is deleted. Existing evidence can be placed under limited preservation with a specific legal reason, reference and end date; any extension needs renewed justification. This tool does not automatically preserve every conversation, photograph or audio file.

Where there is a verified competent-authority request and an applicable legal basis, a separate, time-limited copy may be made of only relevant existing basic account information, texts in selected conversations within a selected date range, selected report texts and terms-acceptance records. Such a copy may remain until its specified expiry despite account or match deletion. The current copying tool excludes photographs, audio, call content and view-once media; it cannot retrieve information already deleted.

Access to a preserved copy ends on expiry and cleanup removes its contents. File metadata and the action trail follow a 90-day cycle after preservation ends. Closing a copy earlier immediately removes its active content. Secure storage and timely disposal of exported files must be handled separately. The official-request tool does not automatically verify an authority’s powers or authorise unlimited disclosure.

12. Security, administrator access and automated operations

Production service connections use HTTPS; passwords are hashed and session credentials are subject to access restrictions. No system can guarantee absolute security. Do not share account credentials or recovery codes; report suspected access to support.

An authorised administrator can access account/profile information, account activity, support correspondence and existing conversations. A reason is recorded for support or abuse-review access to conversations and ordinary attachments; those reviews and certain administrative actions are entered in audit records. This does not mean every screen or file access has a separate log. Access must remain limited to the purpose and necessity of the operation.

Discovery and eligibility may be calculated automatically using your preferences, visibility, mutual choices, location/city and usage rules. Recommendations do not guarantee identity, trustworthiness or compatibility. You may ask support for an explanation and, where applicable, human review of an automated restriction or recommendation. Reports and content review do not mean every message or file is checked in advance.

13. Requests and choices from any location

Wherever you are, you may email destek@auranim.app to request information, access/a copy, correction, deletion, restriction, objection, consent withdrawal or portability. Which requests are statutory rights and which exceptions apply depend on the laws governing your location and the processing; we do not claim the same rights exist identically in every country. You need not create a new account to submit a request.

Include your account email/username and the action requested. Initially, do not send a password, recovery code, identity document or another person’s private content. Proportionate account-ownership verification suitable to the request may be needed to prevent unauthorised disclosure or deletion; an authorised agent’s authority may also need verification. If a request is refused or only partly fulfilled, reasons and applicable appeal options will be explained. Requests are generally free; any legally permitted exceptional charge will be explained in advance.

You will not be penalised for exercising your rights. Removing information or consent genuinely necessary for a feature may prevent that feature from working. Device permissions can be managed in device settings and profile/visibility choices in the app. Statutory procedures and deadlines for complaints to regulators or other authorities remain applicable; for example, a KVKK complaint requires a prior application to the controller. This notice imposes no additional barrier beyond the law.

14. Rights in Türkiye

Where Law No. 6698 (KVKK) applies, you may learn whether your data is processed, request information about processing, learn its purpose and whether use matches that purpose, identify domestic/overseas recipients, correct incomplete or inaccurate data, and request erasure/destruction where the conditions are met and notification of those actions to recipients. You may object to an adverse result from analysis exclusively through automated systems and claim compensation for damage caused by unlawful processing.

Without limiting statutory submission methods, you may contact us through the channels above; the submission method and necessary verification are completed under applicable rules. Requests are resolved as soon as appropriate and within 30 days at the latest. Complaints to the Turkish Personal Data Protection Board and judicial remedies remain available subject to KVKK conditions and deadlines. Notice, membership terms and explicit consent do not replace one another.

15. European Economic Area, United Kingdom and Switzerland

Where the EU/EEA GDPR or UK data protection law applies, you have, subject to its conditions, rights of access and a copy, rectification, erasure, restriction, objection to processing based on legitimate interests and consent withdrawal. For eligible information processed automatically on consent or contract grounds, you may request portability in a structured, commonly used and machine-readable format. You may object to direct marketing if it occurs and invoke statutory safeguards concerning solely automated decisions producing legal or similarly significant effects.

The general response period for requests under these laws is one calendar month; where a lawful extension is needed, its reason and duration will be explained. You may complain to a competent supervisory authority, particularly where you live, work or the alleged infringement occurred; in the UK this includes the ICO. Where Swiss law applies, rights to access, rectification, eligible data delivery/portability and protection of personality, and options to contact the FDPIC, remain available.

We do not state that a regional representative or data protection officer has been appointed. Required representation, transfer arrangements and other regional operational obligations must be completed separately. An English translation alone does not mean a public launch in a particular country or satisfaction of every regional requirement.

16. United States

US rights depend on the state and whether the relevant law applies to Auranim. Where applicable, rights may include knowing what information is collected/used/disclosed, access/a copy, correction, deletion, portability, objection to certain automated decisions and appeal against a refusal. Applicable California CCPA/CPRA rights may also include opting out of sale or sharing for cross-context behavioural advertising, limiting certain sensitive-information uses and freedom from discrimination for exercising rights.

Ads are requested without personalisation. Use Ad privacy preferences in the app or contact destek@auranim.app for regional advertising/data-sharing choices. Applicable sale/sharing opt-outs and mandatory local rights remain available.

17. Canada, Australia and Brazil

In Canada, applicable federal or provincial law may provide rights of access, correction, meaningful consent and withdrawal of consent with legal/contractual limitations explained. You may complain to us and the competent federal or provincial privacy authority. Required express consent for sensitive information is not treated as included in general membership acceptance.

In Australia, where the Privacy Act and relevant principles apply, rights to access, correction and privacy complaint procedures remain available. Contact us using the details above and, under applicable procedures, complain to the OAIC or another competent authority. This section does not claim the law applies to every small business without exception or that Auranim is exempt.

Where Brazil’s LGPD applies, rights may include confirmation of processing, access, correction; anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed information; portability under applicable rules; information about recipients and the consequences of refusing consent; withdrawal of consent and deletion of consent-based data subject to lawful exceptions. You may request review and information about criteria for solely automated decisions affecting your interests. Rights to contact the ANPD and relevant consumer authorities remain available. Request scope and deadlines are handled under applicable law.

18. Changes and new features

We update this notice for new processing purposes, providers, real payment/advertising connections or significant feature changes. Material changes are announced through an appropriate app or communication channel; fresh consent is requested separately when legally necessary. Earlier permission or terms records are not rewritten as though a new text had been accepted.

This notice explains the service’s data practices; it does not, by itself, confer permission to operate in every country, provide an international-transfer safeguard or guarantee complete legal compliance. Mandatory local rights providing greater protection are not limited by this notice. Contact destek@auranim.app with questions or requests.