Privacy policy

Who is responsible

arkadash is built and run by Zeynep Aslı Erhan, an individual developer based in Istanbul, Türkiye, who is the data controller. Questions and requests: destek@arkadash.app.

What data we process

Only what the app needs to work:

• Profile: your display name, avatar color and invite code.
• Sign-in identity: an anonymous account identifier; your email address if you sign in with an email one-time code; your Apple account identifier and the email Apple shares (possibly a private relay address) if you use Sign in with Apple.
• Friendships: pair links created with invite codes or by tapping phones nearby.
• Hangout records: category, date/time, duration, an optional short note, plus confirmation status and points.
• Plans: category and date.
• Live hangouts: category, start/end and who joined.
• Reports and blocks you file.
• Error and crash diagnostics: error text (email addresses masked), app build number, iOS version, a random per-install identifier, and your account id if you're signed in. Kept for 30 days.
• Push notification token: only if you allow notifications.

What we don't do

We never ask for location permission, and there is no GPS or background tracking; a place name, if ever shared, is chosen by hand. We don't access your contacts. No ads, no advertising or analytics SDKs, no tracking across apps, and we never sell or share your data for marketing.

What stays on your phone

• Nearby pairing uses Bluetooth/local network directly between two phones, only when you start it.
• NFC tags only store an arkadash:// link.
• "Add to calendar" writes a single event only when you tap it. It's write-only; we never read your calendar.
• Saving a story card to Photos is add-only, and only when you tap save. The weekly story card never shows your friends' names.

Who sees it

A pair's data is visible only to the two people in that pair. That's enforced by database row-level security, not just a promise. Points are calculated on the server.

Service providers (sub-processors)

• Supabase: database, authentication, realtime. Servers in Frankfurt, EU.
• Resend: sends the sign-in code emails. EU region, Ireland.
• Apple: Sign in with Apple, push notifications via APNs, and App Store distribution.
• Vercel: hosts this website only.

Apple services may involve a transfer of data outside Türkiye/the EU, for example to the USA (KVKK Art. 9). This is done as needed to provide the service you use and, where required, on the basis of your explicit consent.

Legal bases

Performance of the service you asked for (KVKK Art. 5/2-c, GDPR Art. 6(1)(b)); legitimate interest for security, abuse prevention and error diagnostics (KVKK Art. 5/2-f, GDPR Art. 6(1)(f)); and explicit consent where required. For example, notifications are opt-in.

How long we keep it

• Account data: until you delete your account.
• When you unpair from a friend, that pair's shared data is deleted 30 days later.
• Error and crash diagnostics: 30 days.
• Anti-abuse rate-limit counters are short-lived.

Deletion and export

You can delete everything inside the app: Me → Your data → Delete all my data. Deletion is immediate and permanent, including your friendships and records on the server. You can also export your data from the same place (Me → Your data → Download my data).

Your rights

Under KVKK Art. 11 and the GDPR you can ask for access, correction, deletion, data export, objection and restriction of processing. Write to destek@arkadash.app; we answer within the 30 days the law gives us. General support and report reviews get a reply within 72 hours. You also have the right to complain to the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) or your EU supervisory authority.

Children

arkadash is not intended for children under 13.

Changes

We'll announce material changes in the app.