🔐 PRIVACY POLICY

1. INTRODUCTION

At Sormalı ("we", "our", "the app"), protecting the privacy of our users ("you", "your") is a top priority. This Privacy Policy explains how we collect, use, store and protect your personal information.

By using this app, you confirm that you have read, understood and accepted this Privacy Policy. If you do not accept this policy, please do not use the app.

2. PERSONAL INFORMATION WE COLLECT

We collect the following personal information:

📱 Account Information:

• First and last name
• Email address
• Phone number
• Date of birth (for the 18+ age check)
• Username

👤 Profile Information:

• Profile photos (up to 6)
• Bio / About me text
• Gender and the gender you are interested in
• Education (university, major)
• Interests and hobbies
• Personality test results

📍 Location Information:

• GPS location (to find users near you)
• City and country
• Location history (optional)

💬 Usage Data:

• App usage statistics
• Interactions (likes, matches)
• Q&A session data
• Messaging metadata (not content!)
• Search history and filters

📱 Device Information:

• Device model and manufacturer
• Operating system version
• App version
• IP address
• Language preference

3. HOW WE USE PERSONAL INFORMATION

We use the information we collect for the following purposes:

✅ Providing the Service:

• Creating and managing profiles
• Running the matching algorithm
• Calculating compatibility scores
• Organizing Q&A sessions

🔍 Matching and Discover:

• Showing users near you
• Recommendations based on your interests
• Matching based on the personality test
• Compatibility analysis

🔒 Security:

• Identity verification
• Fake profile detection
• Fraud prevention
• Blocking harassment and spam

4. SHARING OF PERSONAL INFORMATION

🔧 Third-Party Service Providers:

Your personal data may be shared with the following service providers for the purpose of providing the service:

• Google Firebase (USA): Database (Firestore), file storage (Storage), authentication (Auth), cloud functions and push notifications. The profile and location data we collect and your messages (content and metadata) are processed on Firebase infrastructure and may be stored on servers in the USA.
• Agora.io (Singapore): Video and voice call infrastructure. During calls, your audio and video data is processed over encrypted channels; temporary processing for service quality takes place on Agora servers.
• Google Maps: Location services and map display. Your location is used to show users near you and for matching features.
• Google Analytics / Firebase Analytics: App usage statistics (anonymous/aggregated data).
• Firebase Crashlytics: Error and crash reporting (anonymous technical data).
• Google AdMob: In-app advertising. The advertising ID, device information and usage data may be processed for personalized ads. See the "Advertising" section below for details.
• Anthropic (USA): The in-app AI Assistant feature runs on Anthropic's Claude API. The messages you write to the assistant and the profile information the assistant accesses to answer your request — name, username, age, gender, city/district, bio, interests, profession, education, profile photo link; both your profile and the profiles of users recommended to you — are sent to Anthropic's servers and processed there to generate a response. ⚠️ The content of your private messages (DMs) is NOT sent to the AI Assistant. If you do not want to use the AI Assistant, you can simply never open the feature.
• Google Cloud Vision (USA): Profile and story photos you upload are analysed with Google Cloud Vision (SafeSearch) to automatically detect inappropriate content such as nudity and violence. Photos are processed only for this moderation decision; no facial recognition is performed and they are not used for advertising.
• Resend (USA): Delivery of email verification messages. Only your email address and display name are processed for this purpose.

📢 Advertising (Google AdMob):

We show ads in the app. In this context:

• Advertising ID: Your device's advertising identifier may be used for ad personalization and measurement.
• Data collected: Ad impressions, clicks and interaction data; device type, language and approximate location (country/region) may be processed by ad networks.
• Preferences: You can turn off personalized ads in your Android settings (Ads → Opt out of Ads Personalization). This does not stop ads; it only limits personalization.

Google advertising policies: Google Ads Privacy.

❌ WHAT WE NEVER SHARE:

• The content of your messages
• Your private conversations
• Your payment card details
• Your password (stored hashed)

5. DATA SECURITY AND PROTECTION MEASURES

🔐 Encryption:

• All data transfers are encrypted with SSL/TLS
• Messages and other data are stored encrypted with AES-256 on Google Cloud servers (encryption at rest)
• Within the app, only the participants of a chat can access its messages; access is enforced by server-side security rules
• The Sormalı team accesses message content only to review a report or to meet a legal obligation
• Passwords are stored one-way hashed (scrypt) by Firebase Authentication

Transparency note: Messaging is not end-to-end encrypted. End-to-end encryption means only the sender and recipient can decrypt a message — Sormalı does not offer this.

🛡️ Security Safeguards:

• Firebase Security Rules (strict access control)
• DDoS protection
• Rate limiting (spam prevention)
• Input validation (protection against XSS and injection)

6. USER RIGHTS (KVKK AND GDPR)

🇹🇷 KVKK (Turkish Personal Data Protection Law No. 6698)

Users residing in Turkey have the following rights:

• Right to information: To learn whether your personal data is processed, the purpose of processing and related information
• Rectification: To request correction of incomplete or inaccurate data, or to update your profile information
• Erasure / Right to be forgotten: To request deletion of your data; when you delete your account, all data is deleted within 30 days
• Objection and withdrawal of consent: To object to the processing of your data or to automated profiling; and, for any processing based on your consent (for all users), to withdraw that consent at any time. In the app: Settings → Privacy → Location Sharing, AI Assistant and Ad Preferences; notification, camera and microphone permissions in your device settings. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

🇪🇺 GDPR (EU General Data Protection Regulation)

Users residing in the EU/EEA additionally have the following rights:

• Access: To request a copy of the personal data we process
• Rectification and erasure: To have inaccurate data corrected or deleted
• Restriction of processing: To have processing halted under certain conditions
• Data portability: To receive your data in a structured, commonly used format
• Objection: To object to processing based on legitimate interest and to direct marketing
• Complaint: The right to lodge a complaint with the competent data protection authority (e.g. the Personal Data Protection Authority in Turkey, or the relevant national authority in the EU)

Legal basis (GDPR): Provision of the service (performance of a contract), legal obligations, legitimate interest (security, analytics, advertising) and, where required, your explicit consent.

7. DATA RETENTION

• Active accounts: For as long as your account is active
• Deleted accounts: Fully deleted within 30 days
• Messages: Kept until both participants have deleted the chat. When you tap “Delete Chat”, the messages are hidden only on your side; the other participant can still see them. Once both participants have deleted the chat, the messages are moved to a server archive that the participants cannot access and are permanently deleted after a 24-hour waiting period; this waiting period allows a report made right after the deletion to be reviewed as well. If one of the participants deletes their account, this waiting period is reduced to 1 hour. If there is a report between the participants of the chat, or the chat is under moderation review, the archived messages are not deleted; they are retained to review the reported content and as evidence against possible legal claims (KVKK Art. 5/2-e), for as long as necessary for the review and any related legal proceedings.
• Stories: Automatically deleted after 24 hours
• Log records: 90 days (for security)
• Legal obligations: For the statutory period (6 years)

8. CHILDREN'S PRIVACY

⚠️ IMPORTANT:

Sormalı is not available to people under 18. We do not knowingly collect data from anyone under 18. If you become aware of a user under 18, please notify us immediately.

App store age signal: During sign-up, if your device's app store provides this information (“Declared Age Range” on the Apple App Store, “Age Signals” on Google Play), we may request your store account's age range (e.g. “18 or over”) from the store; the store may show a separate consent prompt for this. We use this information only to prevent people under 18 from signing up, on your device at that moment: we do not send it to our servers, store it, or use it for analytics or advertising. If the store does not provide this information, only the date of birth you declared is used.

9. INTERNATIONAL DATA TRANSFERS

Your data is stored on Google Firebase (USA) and Agora (Singapore) servers. When you use the AI Assistant, the relevant data is also processed on Anthropic (USA) servers. Photo moderation runs on Google Cloud Vision (USA) and verification emails are sent via Resend (USA). These companies apply GDPR- and KVKK-compliant data protection measures.

10. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of significant changes. Changes take effect on the date they are published.

11. CONTACT

📧 Contact Us:

General Questions and Support: support@sormali.app

KVKK Requests: kvkk@sormali.app

Security: support@sormali.app

Data Deletion: Settings → Account Settings → Delete Account · Account and data deletion page

Note: General requests go to support@sormali.app; KVKK requests go to kvkk@sormali.app.

12. KVKK APPLICATION PROCESS

To exercise your rights:

• Send an email to kvkk@sormali.app
• Verify your identity (copy of your national ID)
• State your request clearly
• We will respond within 30 days
• If your request is rejected, you may apply to the Personal Data Protection Authority

13. DATA CONTROLLER

📋 Data Controller Information (KVKK - Law No. 6698):

Data Controller: Sormalı Team

Email: support@sormali.app

ℹ️ Note: You can send your requests under KVKK (Law No. 6698) and the GDPR to kvkk@sormali.app.

© 2025 Sormalı. All rights reserved.

This document complies with KVKK (Law No. 6698) and the GDPR.