Privacy Policy
This policy explains what data is processed, why and how, when you use the Halkora mobile app (iOS and Android) and the halkora.app website ("Halkora"). Data controller: Enes Seval (Kurucu), contact: support@halkora.app.
Data we collect
- Account information. You can use the app as a guest; in that case only a name you choose and an automatically generated anonymous user ID (UUID) are stored. If you sign in with Apple or with Google, the identifier and email address the sign-in provider shares with us are linked to your account (with Apple, if you chose to hide your email, the private relay address is shared instead).
- Usage content. The challenges you create or join, your daily check-ins, your joker uses, your in-circle messages and your "wave" interactions. This content is shown only to other members of your circle; it is not public.
- Notification token. If you allow notifications, your device's push notification token (Expo Push token) is stored. You can revoke the permission any time from your phone's settings.
- Language preference. Your app language (tr/en) is stored so notifications can be sent in the right language.
- Subscription status. If you purchase Halkora Pro, your subscription status is processed through our payment provider RevenueCat with an anonymous user ID. Payment is handled by the store you downloaded the app from (Apple on the App Store, Google on Google Play); your payment details (card, etc.) never reach us.
- Notification records. Which notification was sent to you and when, and whether you tapped it. The only purpose is to stop sending notifications that do not work. The content of the notification is not written to this record.
- Reports and blocks. If you report a message, your reason and a copy of the reported message are stored — so the report can still be reviewed if the message is later deleted. The list of people you block is also kept on your account.
- Feedback you send us. If you send a suggestion or report a problem from inside the app, the text you write, the category you pick, the app version and your language are stored. Without the version, a bug report is usually not actionable.
- Usage events and error records. A short, fixed list of events is recorded: your answer to a permission prompt, opening a screen, and — when an error is shown to you — which operation failed with which code. These exist to show us what is broken. We do NOT record which screens you browse, how long you stay, or anything you write.
What we don't collect
- No ads, no advertising identifier, no third-party tracking SDKs.
- We use no third-party analytics service (Google Analytics, Firebase Analytics, Amplitude and the like). The few events we do measure stay on our own server and are listed one by one above.
- We do not track your screen browsing, session durations, your behaviour outside the app, or your identity across devices; we build no behavioural advertising profile.
- We do not request or access location, contacts, photos or microphone data.
- We do not sell your data to anyone.
How and on what legal basis we collect data
Your personal data is collected by wholly or partly automated means while you use the app and the site. Which data is processed on which legal basis is set out below (Turkish DPL art. 5 and GDPR art. 6):
- Performance of a contract. Your account information, the circles you create and join, your check-ins, your messages, your language preference and your subscription status. Without these the service cannot work — a circles app cannot exist without circles.
- Your explicit consent. The notification token. If you do not grant notification permission this data is never collected; when you revoke the permission in your phone's settings, notification delivery stops.
- Our legitimate interests. Notification records, usage events, error records, and report/block data. The purposes, in order: to stop sending notifications that do not work, to see and fix what is broken, and to keep circles safe. You have the right to object to this processing (see below).
Where data is processed
Data is stored on the servers of our infrastructure provider Supabase in the London (eu-west-2) region. Push notifications are delivered through Expo, and then through Apple's notification service (APNs) on iPhone or Google's (Firebase Cloud Messaging) on Android. When you sign in with Apple or Google, that provider performs the authentication. Subscription validation is done through RevenueCat. These providers process your data solely to provide services to us and on our instructions; under their contracts they are required to provide protection equivalent to what this policy commits to. Because the servers are located outside Türkiye, your data is transferred abroad.
Retention and deletion
Your data is kept for as long as your account is active. Notification records and usage/error records are deleted automatically after 90 days. You can delete your account any time from within the app (Settings → Delete Account); your account, circles, check-ins, messages, notification records and reports are permanently deleted. The feedback you sent us and the usage/error records are not deleted — their link to your account is severed and they are kept anonymously, because a suggestion is valuable regardless of who sent it and error records are needed to fix the app. Details: halkora.app/hesap-silme. Expired invite links are automatically cleared within reasonable periods.
Your rights
Under the Turkish DPL (KVKK) art. 11 and the GDPR you have the following rights:
- To learn whether your personal data is processed, and if so to request information about it.
- To learn the purpose of processing and whether the data is used in line with that purpose.
- To know the third parties, in Türkiye or abroad, to whom the data is transferred.
- To request rectification if the data is incomplete or incorrect.
- To request erasure or destruction.
- To request that rectification, erasure or destruction be notified to the third parties to whom the data was transferred.
- To object to processing and to request portability of your data.
- For processing based on consent, to withdraw your consent at any time — withdrawal does not affect the lawfulness of processing carried out before it.
- To object to an adverse outcome reached solely by automated analysis.
- To claim compensation if you suffer damage due to unlawful processing.
To make a request, write to support@halkora.app; we respond within 30 days at the latest. If you are not satisfied with our response, you may lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr); if you are in the European Union you may contact the data protection authority in your country.
Automated decision-making
Halkora does not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
Children
Halkora is not intended for children under 13. If we become aware of a user under 13, we delete their account and data.
Changes
If there is a meaningful change to this policy, we announce it from within the app or on this page. Questions: support@halkora.app