Chax – KVKK Privacy Notice
November 1, 2026 | Mobile app users
This notice explains who processes your personal data in the Chax mobile app, for what purposes and legal grounds, and to whom it may be transferred. It is not a consent form; optional processing that requires explicit consent is asked about separately in the relevant screen.
1Data controller
The data controller is Adem Cihad Birincioğlu, the individual operating the Chax app. For personal data requests and questions: [email protected].
2Data collected and collection methods
Data is collected electronically when you create an account, fill out a profile, share content, attend an event, send a message, make a purchase, or contact support. Session, device, security, and transaction records are generated automatically during use. Only records needed for the relevant function may be received from Apple or Google sign-in, app stores, and subscription services. Reports and peer reviews may also come from other users.
| Data category | Main examples |
|---|---|
| Account and profile | Name, username, email, date of birth or age eligibility, profile photo, city, preferences, interests, and audience choices. |
| Social and event content | Attendance, comments, messages, photos, matches, peer reviews, reports, and feedback. |
| Verification and security | Optional selfie, verification decision, IP/device/session information, and abuse records. |
| Purchase and technical records | Chax+ status, store transaction identifiers, notification token, and error logs. Chax does not receive card numbers. |
Free text, photos, and preferences may contain sensitive information. Where special categories of personal data arise, the requirements of Article 6 of the Turkish KVKK also apply.
3Purposes and legal grounds
| Purpose | Relevant data and KVKK legal ground |
|---|---|
| Account, profile, and core service | Account, profile, matching, event, and message data; necessary for entering into or performing a contract (Art. 5(2)(c)). |
| Purchases and legal records | Subscription, store transaction, and request records; performance of a contract (Art. 5(2)(c)), legal obligation (Art. 5(2)(ç)), and establishment or protection of a right (Art. 5(2)(e)). |
| Security and moderation | Session, device, content, and report records; legitimate interests after consideration of your rights (Art. 5(2)(f)), and where needed legal obligation or protection of a right. |
| Optional features | Photo verification, AI analysis, visibility, and notification preferences are assessed separately for each feature. Processing requiring explicit consent relies on separate consent under Art. 5(1) or Art. 6 of the KVKK. |
Device permission, content visibility, and explicit consent are separate choices. Accepting the Terms of Use is not consent to every optional use of personal data.
4Recipients and international transfers
Data is shown to other members within the audience you choose and to review and support staff as needed. Our infrastructure may use Supabase (accounts and database), Google Cloud (servers and technical logs), Cloudflare R2 (media), OpenAI (relevant AI and content checks), RevenueCat and Apple/Google (subscriptions), Expo (notifications), and Sentry (error logs). TMDB and Open Library supply catalog information and cover images; profile and message content is not sent for catalog queries. We may provide information to competent authorities when required by law.
The production database and app server are in the Frankfurt, Germany region; private media files are stored through Cloudflare R2’s EU endpoint. Provider support teams or subprocessors may be in other countries. Personal data of users in Türkiye may therefore be transferred abroad. Transfers from Türkiye are subject to Article 9 of the KVKK. If separate explicit consent is required for an operation, we ask for it in the relevant screen; general acceptance of the contract is not consent to a transfer.
5Retention and your rights
A request to delete an account has a 15-day recovery period; records are then deleted or anonymized in stages. A submitted verification selfie enters deletion processing 30 days after the decision or session closure; technical deletion is completed separately. Some records may be kept while needed for legal duties, security, or disputes. See the Privacy Policy for details.
Under Article 11 of the KVKK, you may learn whether your data is processed, request information, learn the purpose and recipients, request correction, request deletion or destruction and notice to third parties where conditions apply, object to an adverse outcome based solely on automated analysis, and seek compensation for unlawful processing. Send requests to [email protected]; identity verification may be required. You can withdraw explicit consent in the relevant settings.