This policy explains which personal data TamBiri processes, on which legal basis, who we share it with, how long we keep it and what rights you have. Data controller: Emre Eser Keser (an individual). Contact: tambiridestek@outlook.com. Where we rely on your consent, we ask for it separately; reading this policy is not consent.
TamBiri is for people aged 18 and over only.
We do not sell or rent your data and we do not share it for advertising. The app contains no ad networks, trackers or third-party analytics SDKs.
Your messages are stored on our servers and transmitted over encrypted connections; they are not end-to-end encrypted. Reported content may be reviewed by a human.
Your location is processed as an approximate value (rounded to about one kilometre); your precise coordinates never reach our servers.
You can permanently delete your account from inside the app.
Account data: your email address or phone number, an irreversible hash of your password, the name and email received from Google if you sign in with Google, your verification status, sign-up and last sign-in time.
Profile data: your name, date of birth (to calculate your age and enforce the 18+ limit), gender, dating intent, the gender you are interested in, city, interests, hobbies, music and game preferences, your about text, the photos and videos you upload and your written or voice answers to profile prompts. Height and weight are optional.
Location: only with your permission. The coordinates from your device are rounded to two decimals (about 1 km) before they are sent to the server, and are used to show distance in discovery and to suggest your city. City lookup uses your operating system services (Google Play services on Android). You can revoke the permission at any time and choose your city manually.
Communication content: the text, photos, videos, GIFs and voice messages you send and receive, your group chat content, your posts and comments.
Usage data: likes, passes, matches, message timestamps, boost usage and in-app screen and button events. These event records are stored with your user id.
Device and technical data: your notification token (Firebase Cloud Messaging), operating system and platform, app version, error and crash logs. Your IP address is kept in our infrastructure provider’s security logs when you sign in.
Payment data: your subscription and purchase status and store transaction identifiers. Your card number, bank details and billing address never reach us; Google Play processes the payment.
Safety and moderation data: reports you send, reports about you, accounts you block, your verification selfie, the outcome of the human review of your images and flags produced by the word filter that runs on our server.
Support correspondence: requests you send from the app or by email and our replies.
To create your account, show your profile, suggest people, run matching, messaging, groups and the discovery feed, and recognise your subscription. Legal basis: performance of a contract (GDPR Art. 6(1)(b); Turkish DPL Art. 5/2-c).
To fight fake accounts, fraud, harassment and adult content, to review reports and to keep the service safe. Legal basis: legitimate interests (GDPR Art. 6(1)(f); Turkish DPL Art. 5/2-f and 5/2-e).
To enforce the 18+ limit, respond to lawful requests from authorities and comply with retention duties. Legal basis: legal obligation (GDPR Art. 6(1)(c); Turkish DPL Art. 5/2-ç).
To improve the app by measuring completed steps and errors. Legal basis: legitimate interests. These records are never used for advertising.
Optional processing — location, notifications, voice answers, the verification selfie, the gender you are interested in, and processing on servers outside Türkiye. Legal basis: your consent (GDPR Art. 6(1)(a) and 9(2)(a); Turkish DPL Art. 5/1, 6/2 and 9/6-a).
The following happen only with your separate consent, and refusing any of them does not stop you using the rest of the service:
• Processing your data on servers outside Türkiye (a separate checkbox at sign-up).
• Collecting your location (device permission).
• Sending you notifications (device permission).
• Uploading a selfie for profile verification (entirely optional).
• Telling us the gender you are interested in and your dating intent, which together may reveal your sexual orientation and are therefore protected as special category data.
You can withdraw consent at any time by turning the feature off or writing to tambiridestek@outlook.com. Withdrawal does not affect processing carried out before it.
We never ask for health, religion, political opinion, ethnic origin, trade union membership or criminal record data. Please do not put such information in your profile.
Your dating intent and the gender you are interested in may reveal your sexual orientation. We process them only for matching and only with your explicit consent; you decide what appears on your profile.
The verification selfie is used only to confirm that your profile photo is really you. The review is done visually by an authorised person: no facial recognition, no biometric template and no automated age estimation. It is never shown to other members.
The ordering of the discovery feed and the compatibility percentage you see are calculated automatically from whether your dating intents match, how many interests you share and the approximate distance between you. It only produces suggestions and never a decision with legal effects for you.
Messages and profile texts are scanned automatically against a word list stored on our server. The scan only flags content for human review; account closures are always decided by a human.
You may object to the result of automated analysis if you believe it works against you.
Other members: only the information you choose to show on your profile and the approximate distance. Your email address, phone number, date of birth and coordinates are never shown to other members.
Supabase (hosting, database, file storage and authentication): your account, profile, message and media data are stored there. The database region is Frankfurt, Germany (eu-central-1).
Google Firebase Cloud Messaging (push notifications): your device token and the notification title and body.
Google Play (payments) and RevenueCat (subscription validation): your purchase and subscription status.
Google (sign-in): if you use Google sign-in, authentication is handled by Google.
Twilio Verify (SMS): if you register with a phone number, it is used to send a verification code.
GIPHY (GIF search): when you search for a GIF, only your search term and technical request data are sent; we never send who you are chatting with.
Authorities: only where the law requires it and after reviewing the legal basis of the request.
These providers process data on our behalf and on our instructions only.
All of our infrastructure is outside Türkiye: data is stored in Supabase’s Frankfurt (Germany) region, while notifications, payments, subscription validation, SMS and GIF search are provided by companies based in the United States. Provider support teams in the United States may also have access.
As there is no adequacy decision from the Turkish Personal Data Protection Board for these countries, transfers are made on the basis of your explicit consent under Art. 9/6 of the Turkish DPL. You give that consent in a separate checkbox at sign-up; without it an account cannot be created, because the service cannot run without this infrastructure.
Data processing agreements and, where applicable, the EU standard contractual clauses apply with these providers. Work on the standard contract required by Art. 9 of the Turkish DPL, and its notification to the Board, is ongoing; this policy will be updated when it is complete.
Profile, message and interaction data is kept while your account is open.
If you pause your account nothing is deleted; your profile simply stops appearing in discovery and likes until you reactivate it.
When you delete your account, your profile, photos, videos, voice recordings, prompt answers, matches, messages, notification token and location data are permanently deleted.
Verification selfies and verification requests are deleted automatically one year after the decision.
Reports and moderation records are kept for one year so repeated violations can be assessed.
Store (subscription) event records are kept for one year. Invoices are issued and retained by Google Play.
Delivered notification records are deleted after 90 days.
Product event logs and error logs may be kept for statistics after the link to your account is removed.
These deletions run automatically every day on the server.
Row level security is enforced in the database: each member can reach only their own data and content shared with them. Photos, videos and voice recordings are served through time-limited signed links, never from public storage.
Passwords are stored irreversibly and all traffic uses encrypted connections.
The only person with access to the data is the app owner, and access happens only for support, moderation and troubleshooting.
No system is entirely risk-free. If we detect that personal data has been obtained unlawfully by others, we will notify you and the competent authority as soon as possible.
You have the right to access your data, to be informed about how it is processed and who it is shared with, to have inaccurate data corrected, to have your data erased, to restrict or object to processing, to data portability, to object to the outcome of automated analysis and to claim compensation for damage caused by unlawful processing.
Send your request from the email address registered on your account to tambiridestek@outlook.com. We answer within 30 days at the latest and free of charge. If you want to send a written request, ask us for a postal address at the same email address.
You can also correct your profile, pause your account or delete it from inside the app.
You may lodge a complaint with your local data protection authority. In Türkiye this is the Personal Data Protection Authority (KVKK).
TamBiri is for people aged 18 and over; we do not knowingly collect data from anyone under 18.
If we identify a user under 18 the account is closed immediately and the data is deleted. You can report such an account at tambiridestek@outlook.com or with the report button in the app.
TamBiri is operated from Türkiye and is primarily aimed at users in Türkiye.
If you live in California: we do not sell your personal information or share it for advertising. Send access and deletion requests to the same email address; we will not treat you differently for exercising your rights.
If we update this policy we publish the new version in the app and at https://emrreeser-maker.github.io/tambiri-legal and change the update date. If a new purpose or a new transfer is involved we will tell you in the app and ask for your consent again where required.