Privacy Policy

Effective date: 3 August 2026

Last updated: September 02, 2026

This document explains how the Takıl mobile application processes your personal data. It serves as our disclosure notice under Turkish Personal Data Protection Law No. 6698 (KVKK) and as our information notice under the EU General Data Protection Regulation (GDPR).

1. Data Controller

No separate data protection officer (DPO) has been appointed; all data protection enquiries go to the address above.

Takıl is operated by an individual, not a legal entity. This notice will be updated if that changes.

2. What Data We Process

2.1 Account and authentication

• Email address, user identifier (UID) and name received through Sign in with Apple or Sign in with Google
• Timestamp of your age confirmation (to enforce the 18+ limit)
• Username (handle), invite code and — if applicable — the identifier of the user who invited you

2.2 Profile

Name, profile photo, short status text ("now" text), bio, city, interest tags, links/social handles, your stated intent ("why I'm here") and notification preferences.

All of these fields are optional; fields you leave empty are not processed.

2.3 Location — how this actually works matters

Takıl does not store precise coordinates.

While the app is open, your device location is rounded to an approximately 150-metre grid cell, and only that cell identifier (grid_x, grid_y) plus a last-updated timestamp is kept on your account. In other words, the server does not hold "this street, this building" — it holds "somewhere in this 150-metre square".

• used to sort nearby events by distance and for the map view.
• You can turn location sharing off entirely in Settings.
• An event's address and coordinates are separate data, entered by whoever creates the event, and visible if the event is public.

2.4 Events and social interaction

Events you attend and your attendance status, check-in time, your messages in event chats, comments, poll votes, emoji reactions, event photos you upload, likes, people you save and your notes on them, mutual matches, thank-you notes, and points you earn.

2.5 Messaging

The content of your direct messages, sender/recipient information and read timestamps.

2.6.1 Direct Messages and Limits on Access

Private messages between users, along with club and event chats, are stored on our servers in Germany (European Union) for the purposes of organising events, enabling communication between participants, and performing the service (KVKK Art. 5/2-c). These messages are not end-to-end encrypted; they are protected with TLS in transit and restricted by row-level security (RLS) rules in the database.

The data controller does not review message content arbitrarily. Message contents may only be accessed under the following legitimate and strictly defined circumstances:

• User reports — establishment and protection of a right (KVKK Art. 5/2-e): Upon an in-app report by one of the participants, strictly limited to the reported content,
• Legal obligations (KVKK Art. 5/2-ç): To comply with lawful requests and court orders served by competent judicial or administrative authorities under Law No. 5651, the Code of Criminal Procedure, or related legislation,
• Platform security and technical maintenance — legitimate interest (KVKK Art. 5/2-f): During technical work conducted to ensure service continuity, database integrity, debugging and the prevention of abuse, message content may be visible. Reading content is not the purpose of such work; access is limited to the minimum extent required by the task and rests solely with the data controller,
• Emergencies and prevention of serious crime: In cases involving imminent threats to life, urgent public safety concerns, or suspected child sexual abuse material (CSAM), to take protective action and to notify competent law enforcement and judicial authorities.

Automated content filter: Messages pass through an automated server-side content filter on submission. The filter may detect prohibited expressions and block the message from being sent. It operates automatically and does not mean the message is read by a person.

Message data and the related processing records are retained for the periods set out in our Data Retention and Destruction Policy. Upon expiry of statutory retention periods, closure of the account, or a valid erasure request, your data is securely deleted, destroyed or anonymised within the six-month periodic disposal cycle, or within thirty days at the latest where a request has been made.

2.7 Contacts matching (optional)

See section 4 for the full explanation.

2.8 Notifications

Your device's push notification token, platform (iOS/Android) and delivery status. If registration fails, that error record is also kept.

When a notification is sent, the title and body shown in it — for message notifications, the sender's name and the message itself — are transmitted to the service that delivers the notification to your device. That service and its location are listed in Section 5. You can hide notification previews from your device's system settings; this does not change how the notification is transmitted.

2.9 Safety and moderation

Reports you submit, users you block, flags produced by the automated content filter, and their resolution status.

2.10 Technical diagnostic data

If the app crashes, we collect the crash stack trace, device model, operating system version, app version and the trail of actions preceding the crash. We also measure performance on a small share of sessions (20%). This data is not linked to your identity — we do not send your user identifier to our diagnostics provider.

2.11 Link click statistics

When someone clicks a promotional link for the app, we record the operating system, language, campaign tag and a coarse location derived from the IP address (country/region/city/district). This record is not linked to any user account.

2.12 Access and traffic logs (Law No. 5651)

Pursuant to Article 5 of Law No. 5651 as hosting provider; connection IP address, timestamp, user ID, and action type during login, logout, and account deletion actions are recorded. These records are isolated from the public database, restricted from user access, used strictly upon lawful requests by competent judicial authorities, and retained for the statutory period of 1 year.

2.13 What we do NOT process

• We do not collect advertising identifiers (IDFA/AAID)
• The app contains no advertising SDKs whatsoever
• We do not sell or share your data with advertisers
• We do not perform cross-app tracking
• We do not process payment or card data

3. Purposes and Legal Bases

You may withdraw consent at any time for consent-based processing by turning the relevant feature off in Settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. Contacts Matching — The Full, Honest Explanation

This feature runs only when you start it and can be turned off at any time. Here is exactly what happens:

1. Phone numbers and email addresses in your address book are hashed on your device using SHA-256.

2. The numbers and email addresses themselves are never sent to our servers.

3. However, in order for matching to work, those hashes are sent to the server. The server compares the incoming hashes only against registered users' own stored hashes and returns the matches to you.

4. The hashes you send are not stored on the server. They disappear with the query once the comparison completes; no persistent record is created.

5. A hash of your own phone number and email address is stored on your account so that others can find you.

6. If you turn off "discoverable via contacts" in your profile, your hashes are excluded from matching entirely.

People in your address book may not be Takıl users and may not have consented to this processing. For that reason: hashes that do not match are never recorded, used, or processed to build any profile.

5. Third-Party Service Providers

These providers act as data processors, solely for the purposes stated here and on our instructions. None of them is authorised to use your data for their own purposes.

Development and maintenance access

AI-assisted development tools are used for technical maintenance, schema changes and debugging. Results of queries run against the database through these tools are processed on the provider's servers outside Türkiye.

Such queries are made through technical views that exclude fields including name, email address, phone number, biography and message content. Access occurs only on the data controller's instruction and is not used for user profiling, marketing or advertising. Under the providers' commercial terms, this data is not used to train AI models.

6. International Transfers

Your user data is hosted on servers in Germany (European Union). Some of the providers listed in section 5 are established outside Türkiye and outside the European Economic Area.

Under KVKK: Writing data to servers outside Türkiye is a transfer abroad within the meaning of Article 9. As amended by Law No. 7499 of 2 March 2024, Article 9 provides three routes in order: an adequacy decision (Art. 9/1), appropriate safeguards (Art. 9/4), and derogations that apply only on an incidental basis (Art. 9/6).

Because our transfer is continuous rather than incidental, the Article 9/6 derogation does not apply to it. We rely on the standard contract published by the Turkish Data Protection Board under Article 9/4(c); the process of signing that contract with our service providers and notifying the Authority within five business days of signature, as required by Article 9/5, is underway. This section will be updated with a date once that is complete.

Risks inherent in the transfer: the law of the country where the data is held differs from Turkish law, its competent authorities may request access to data under their own legislation, and you may need to invoke a foreign legal system to exercise your rights.

Under GDPR: Our primary hosting location in Germany (European Union), is within the European Economic Area, so no third-country transfer arises for core data hosting. For transfers outside the EEA: an adequacy decision exists for the United States — the European Commission's EU-US Data Privacy Framework decision of 10 July 2023 — and where a provider is certified under that framework, the transfer relies on it. For providers that are not certified, transfers rely on the Commission's Standard Contractual Clauses (SCCs / DPA). You may request a copy of these documents at destek@takil.app.

7. Retention Periods

When you delete your account via Settings > Delete Account, your profile and content data are permanently erased immediately together with all associated records. This action cannot be undone.

The retention and destruction schedules are further detailed in our Data Retention and Destruction Policy.

8. Your Rights

Your rights under KVKK Article 11

By applying to the data controller you may:

1. Learn whether your personal data is being processed

2. Request information if it has been processed

3. Learn the purpose of processing and whether the data is used in accordance with that purpose

4. Know the third parties to whom your data is transferred, domestically or abroad

5. Request rectification of incomplete or inaccurate data

6. Request erasure or destruction within the conditions of Article 7

7. Request that rectification, erasure and destruction be notified to the third parties to whom the data was transferred

8. Object to an adverse outcome arising from analysis carried out exclusively by automated systems

9. Claim compensation for damages suffered as a result of unlawful processing

Your rights under GDPR

You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and not to be subject to automated decision-making (Art. 22). You also retain the right to lodge a complaint with the competent supervisory authority.

9. How to Submit a Request

You may send requests concerning your rights to destek@takil.app.

Under the Turkish Communiqué on the Procedures and Principles of Application to the Data Controller, you may also submit your request:

• In writing, by wet-signed petition
• Via secure electronic signature or mobile signature
• From an email address you have previously notified to us and which is registered in our system

Your application should state your name and surname, signature (for written applications), Turkish ID number (for foreign nationals, nationality and passport number), an address for notification, your telephone and email if any, and the subject of your request.

10. Age Limit: 18+

Takıl is intended for users aged 18 and over. During registration, an 18+ age declaration is collected and the timestamp is recorded. Accounts found to belong to users under 18 are closed and their data deleted.

If you believe we are processing data belonging to a person under 18, please notify us at destek@takil.app.

11. Data Security

• All network traffic is encrypted with TLS.
• Row-level security (RLS) is enabled in the database; the default behaviour is to deny access.
• Administrator privileges are held by only a small number of accounts.
• Uploaded images pass through automated moderation checks.
• Phone numbers and email addresses are stored in the database only as hashes.

No system can promise absolute security. If you discover a vulnerability, please report it to destek@takil.app.

12. Data Controllers' Registry (VERBİS)

Article 16 of the Law requires natural and legal persons who process personal data to register with the Data Controllers' Registry, and empowers the Board to grant exemptions on the basis of objective criteria. Takıl is operated by a natural person and its main activity is not the processing of special categories of personal data; it is therefore treated as falling within the exemption set by the Board. Should this change, registration will be completed and this notice updated.

13. Policy Changes

This Privacy Policy and Disclosure Notice may be updated to reflect legislative changes or technical requirements. The current version becomes effective upon publication at takil.app/privacy, and the "Last updated" date at the top of the page will be revised.

If the purpose of data processing changes, additional notice will be provided prior to processing in accordance with Article 5 of the Turkish Communiqué on the Procedures and Principles of Application of the Disclosure Obligation, and explicit consent will be obtained where required by law.

14. Contact

Barbaros Köklü

destek@takil.app

Reports and urgent notifications receive a response within 48 hours. The statutory period for data subject requests is the 30 days stated in section 9.