Privacy Policy

1. Introduction and Scope

This Privacy Policy (the "Policy") explains for what purposes and how your personal data is processed in connection with the Whisperio mobile app and the related web pages on the whisperio.app domain (together, the "App" or the "Service"), to whom it is transferred, how long it is retained, and what your rights are regarding this data.

This Policy has been prepared with regard to the duty to inform under Law No. 6698 on the Protection of Personal Data ("KVKK," Turkey's data protection law). By using the App, you confirm that you have read and accept this Policy.

2. Data Controller

Under KVKK, your personal data is processed by Berk Çolak as data controller (the "Data Controller," "we"). You can reach the Data Controller at the email address in the "Contact" section of this Policy.

3. Personal Data We Process

The following categories of personal data are processed in the course of providing the Service:

• Account and identity data: email address, username, password (stored only in an irreversibly encrypted form; no one, including us, can access your plain-text password) and, if you sign in with Google or Apple, the ID of that account.
• Profile data: date of birth, gender (including the "Prefer not to say" option), interests, your chosen avatar icon and your personality test result (if you took the test).
• Content and communication data: text, photo and voice messages you send in chats; Feed posts, comments and kindness messages; chat and friend requests; information you submit through reports, the contact form and ban appeals.
• Usage data: your match availability, post-chat feedback and reputation score, login streak, referral code relationship and notification preferences.
• Purchase and wallet data: token balance and transaction history, Premium membership status and purchase records provided by the App Store or Google Play. We do not process your payment card details; payments are collected directly by the relevant store.
• Device, connection and security data: IP address, device and app version information, login records, connection timestamps used to show online/offline status, and the push notification token used to send notifications to your device.
• Legal consent records: the versions of the Privacy Policy and Terms of Service you accepted and the date of acceptance.
• Diagnostic data: when the App encounters an error or closes unexpectedly, technical information collected automatically to identify and fix the issue (the error message, the screen or action where it occurred, device and operating system information).

Photos you share are reprocessed on our servers; embedded information such as location (GPS), device model and capture time (EXIF metadata) is removed and not retained.

4. Purposes of Processing

Your personal data is processed for the following purposes:

• To create, verify and secure your account
• To match you with other users and provide the chat, Feed and friendship features
• To run content through automated (AI-assisted) moderation and review reports in order to detect harmful, harassing or unlawful content
• To send push notifications in accordance with your preferences
• To process token, Premium membership and purchase transactions
• To display ads
• To analyze App usage statistically and fix errors
• To prevent abuse, fraud and violations of the Terms of Service
• To fulfill legal obligations and respond to requests from competent authorities

5. Automated Content Moderation

For community safety, chat messages (text, photo and voice messages), Feed posts and comments are evaluated by an automated AI system for harassment, abuse, hate speech and unlawful content. For this evaluation, content is sent to the third-party AI provider OpenAI; voice messages are first transcribed by OpenAI, and the transcript is then evaluated. This process is an automated classification and does not mean that your messages are routinely read by humans.

Content flagged by the automated system is submitted to our moderation team for review; decisions to warn, restrict or close accounts are made only by the moderation team. Content flagged in certain serious violation categories is not published in the Feed, and content that sexualizes minors is not delivered to the other person in chat or is removed once detected (details are in the Terms of Service). Content assessed as indicating a risk of self-harm is reported to the moderation team as a priority, and support resources may be shown to the user who wrote it.

6. Username, Profile and Anonymity

The App shows other users your username rather than your real name. Your username, avatar, age, gender (unless hidden), interests, personality type, reputation score, join date and Feed posts may be visible to other users. You can hide your gender from other users with the "Hide my gender" option in Settings.

In this sense, the App offers an anonymous experience toward other users. However, this does not mean that your data is unknown to the Data Controller: your email address, IP address and account activity are recorded in our systems and may be used in response to a legal request or a violation of the Terms of Service.

7. Transfer of Personal Data

Your personal data is not sold. It may be transferred to the following service providers only to the extent necessary to provide the Service:

• Google Firebase: push notification infrastructure
• Google Firebase Analytics: statistics on App usage (e.g. which features are used); aggregate and statistical data that does not directly reveal your identity
• OpenAI: automated content moderation (including text, photos and the transcription of voice messages)
• Railway: server and database hosting
• Cloudflare: photo and media storage
• Resend: sending account verification, password reset and account deletion emails
• Sentry: diagnosing and fixing app errors
• Google AdMob: displaying ads
• Apple and Google: verifying Apple or Google sign-in and in-app purchases

Your personal data may also be shared with competent public authorities where required by law, a court order or the protection of user safety.

Transfers abroad: Some of the service providers above may process your personal data on servers outside Turkey (e.g. the European Union, the United States). Under Article 9 of KVKK, this transfer is based on the explicit consent you give by accepting this Policy and the Terms of Service when creating your account (or on your first Google or Apple sign-in). Your consent is recorded together with the version and date of the texts you accepted, and is requested again when the texts change. If you delete your account, this record is deleted too.

Ad preferences: Whether ads are personalized depends on the consent obtained through Google's user consent management platform (UMP). You can change this preference at any time from Settings > Legal > Ad Preferences (this option is only shown where legally required in your region).

8. Retention Periods

Your personal data is retained for as long as your account is active. The following data is retained even after you delete your account, for the period stated, only for the stated purpose and accessible only to the authorized team; it is deleted automatically at the end of that period:

• Login records (login time, IP address, device and app information) and the IP address you registered from: 12 months from the date they were created, to ensure security and prevent abuse.
• Report and moderation records and reported or blocked content: if your account is a party to a report, content you sent in a chat or posted in the Feed was blocked on suspicion of sexualizing minors, or your account was closed for violating our rules, 1 year from account deletion, for community safety.
• Messages you sent in the last 30 days (including photos and voice): 1 year from deletion, so that they can still be reported after you delete your account.
• Originals of messages flagged by automated moderation and later deleted or edited (including versions before edits): 1 year, for review.
• For accounts closed for rule violations, an irreversible keyed digest (hash) of the email address and Google/Apple account ID: indefinitely, to prevent the same person from registering again. The email address cannot be recovered from this digest.

In addition, where a legal obligation exists, such as a legal dispute or a request from a competent authority, the relevant data may be retained only to the extent and for the period that obligation requires. More information: whisperio.app/delete-account

9. Deleting Your Account and Data

You can permanently delete your account at any time via Settings > Delete Account or, if the App is not installed, through the form at whisperio.app/delete-account. Deletion cannot be undone; your data, including your messages, posts and wallet history, is removed from our systems, subject to the exceptions in section 8.

If you want to delete only specific data without deleting your account:

• Feed posts: in the "My Posts" list on the Profile tab, tap the trash icon on the post and confirm; deletion is immediate and permanent.
• Profile information: you can change or remove your gender (including "Prefer not to say") and interests from Settings > Edit Profile. Your date of birth is used for age verification and cannot be changed in the App; you can send a correction request to the address in the "Contact" section.
• Conversations: in the Chats screen, you can swipe a conversation to remove it from your own list, and delete your message history with a friend on your side with "Delete Messages." These actions only affect your own view; the other person is not affected and the data continues to be retained for security and moderation purposes.
• Messages: long-press a message you sent and tap "Delete Message" to delete it for everyone. The photo or voice file is deleted too; a file whose automated scan has not finished yet is deleted once the scan finishes, within 2 days at most. For messages flagged by automated moderation, the retention period in section 8 applies.

Deleting individual comments is not currently supported; your comments are removed when you delete your account.

10. Your Rights

Under Article 11 of KVKK, you have the right to apply to the Data Controller to:

a) Learn whether your personal data is being processed,
b) Request information about it if it has been processed,
c) Learn the purpose of processing and whether the data is used in accordance with that purpose,
d) Know the third parties, domestic or abroad, to whom your personal data is transferred,
e) Request correction of your personal data if it is incomplete or inaccurate,
f) Request the deletion or destruction of your personal data,
g) Request that the actions taken under (e) and (f) be notified to the third parties to whom your personal data has been transferred,
h) Object to a result to your detriment arising from the analysis of your data exclusively through automated systems,
i) Request compensation for damages arising from the unlawful processing of your personal data.

To exercise these rights, you can send your request to the email address in the "Contact" section. Under Article 13 of KVKK, your request will be concluded as soon as possible and within thirty days at the latest. If your application is rejected, you find the response insufficient, or no response is given in time, you may file a complaint with the Personal Data Protection Board under Article 14 of KVKK. You can also update your profile information directly from Settings, and delete your account from there as well.

11. Age Restriction

The App is intended only for people aged 18 or over. If it is determined that you are under 18, your account may be suspended or deleted. Messages and posts in which a user states that they are under 18 are automatically flagged for review by the moderation team only; the content is not blocked and the user is not notified. In timed chats, the App may show a safety reminder when there is a large age gap between the two people.

12. Data Security

We apply appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS/HTTPS) and access controls. Nevertheless, no system is completely secure; despite taking reasonable measures, we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Policy from time to time. The current version and the date of the last update are published on this page. You will be notified within the App of material changes and, where necessary, your consent will be requested again.

14. Contact

For privacy questions and requests under Article 11 of KVKK: privacy@whisperio.app