Chax – Privacy Policy

Last updated: November 1, 2026 | Users aged 18 and over

Controller: Adem Cihad Birincioğlu, the individual who operates the Chax app. For privacy and personal data requests, contact [email protected]. This policy covers the Chax mobile app and related web services. The service is available only to people aged 18 or over.

This policy explains how personal data is processed; it does not itself constitute consent. Where consent is required, we request it separately for the relevant purpose in the app, and you may withdraw it. Device permissions, visibility of a profile field, and consent to process personal data are distinct choices.

Profile fields, preferences, messages, and free text may contain sensitive personal information. Consider your chosen audience when sharing it. We may process device, session, and security data to operate the app; cookies and similar technologies on the website are explained in the relevant interface.

We process data needed to create accounts, check age eligibility, sign users in, apply profile and preference settings, provide member discovery, matching, events, messaging, and Chax+ access; to keep the service secure, prevent fraud, moderate content and review reports; and to answer support requests and meet legal obligations. Optional AI analysis, photo verification, visibility, and notification choices are explained in their own flows.

For account, profile, matching, event, messaging, and purchase operations, we process data necessary to enter into or perform our contract. For security, fraud prevention, and service improvement, we process necessary data under legitimate interests while considering your rights and freedoms. For legal records and requests, we rely on legal obligations or the establishment or protection of rights. The relevant conditions of Article 5 of the Turkish KVKK, and where applicable Article 6 of the GDPR or UK GDPR, apply. Where special categories of personal data are involved, Article 6 of the KVKK and applicable foreign law requirements also apply. We ask separately for consent where optional analysis or sharing relies on consent; accepting the terms is not blanket consent to every data use. Separate choices and permissions for marketing messages are presented in the relevant screen.

When enabled, a processed version of an uploaded photo may be sent to an AI provider to check for inappropriate content. Raw peer review text and permitted trait codes, or raw host feedback, may be classified separately to derive community traits. This classification is separate from creating an AI summary shown to a user.

With the separate AI analysis permission enabled, structured trait codes and aggregated bands may be used for personality, dating, and host summaries. This one permission covers the creation of several types of summary. Summary requests do not send private messages, raw peer reviews, or the user’s name. If you request comment translation, the full comment text may be sent to the AI provider. The AI provider processes data needed to provide and secure the service; this may involve an international transfer.

AI results may be incomplete, biased, or wrong. They are not definitive judgments about a real person’s character, intentions, safety, or romantic compatibility. You can give feedback on your own summary and report peer reviews that contributed to an analysis. Reports are reviewed; reviews hidden after review are excluded from later calculations. An existing summary may take time to update. Assess important decisions independently before relying on AI output. Your statutory rights to correction, deletion, and objection to an adverse result based solely on automated analysis remain intact; Chax does not use an AI summary as the sole basis for a decision with legal or similarly significant effects on a user.

Photo verification is optional. A selfie you upload may be compared with your profile photo by authorized staff. This does not guarantee legal identity or future behavior. A submitted selfie enters the deletion process 30 days after a decision on the verification request or closure of the session; physical deletion from storage completes after technical processing and any necessary retries. Unsubmitted selfie files enter the deletion process earlier when the session closes. Verification decisions, abuse records, and security records may be kept longer where needed.

Your general profile audience; the audience for city, height, weight, and lifestyle fields; visibility of upcoming events; feed cards about attendance at completed events; participation in matching; AI analysis permission; and the audience for AI summaries are independent choices. Enabling one does not enable the others. One AI analysis permission covers several summary types; the audience for personality and host summaries is chosen separately. A dating AI summary is initially visible only to its owner and may be shown to eligible matching profile viewers when a separate sharing setting is enabled. You can change choices in Settings; changes cannot retract copies already viewed or saved by others.

Other members may see certain profile and event information according to your chosen audience and the service rules. Event organizers can see attendance and questions addressed to them; chat members can see the relevant messages. Other members may keep copies of content they saw outside the app. You initiate any sharing of a share card to another platform, whose subsequent processing is governed by its own rules.

Other Chax members may see personal data within your chosen audience, and authorized review and support staff may access it when needed. To provide the service, account and app data may go to Supabase; server operations and technical logs to Google Cloud; uploaded media to Cloudflare R2; relevant images, text, or structured data to OpenAI for content review, AI analysis, and translation; subscription and purchase records to RevenueCat and Apple/Google; notification data to Expo; and error information to Sentry. Sharing is limited to what the function needs. TMDB and Open Library are sources of movie, TV, book, and cover information; profile and message content is not sent to them for catalog queries. We may share data with competent authorities when legally required. We do not sell user data to third parties for advertising.

Our production database and app server are in the Frankfurt, Germany region; private media files, including selfies, are stored through Cloudflare R2’s EU endpoint. Because of this infrastructure and providers such as OpenAI, personal data of users in Türkiye may be transferred abroad. Providers’ support teams or subprocessors may be in other countries. Transfers from Türkiye are subject to Article 9 of the KVKK; transfers originating in the EEA or the United Kingdom are subject to the relevant data protection rules. If a specific operation requires separate consent, we ask for it in the relevant screen; accepting the terms is not general consent to transfers. Contact [email protected] for information on a particular recipient and its legal basis.

A request to delete an account starts a 15-day recovery period. After that, account, identity, and media records are deleted or anonymized in stages. Some shared content, transaction and security records, backups, disputes, and legal retention duties may require data to be kept for as long as needed. The type of data, processing purpose, security needs, and legal duties determine retention; when the need ends, data is deleted, anonymized, or made inaccessible. Deleting your account cannot erase copies previously made by other users.

You can request a data archive in the app. A prepared archive is deleted after 14 days; its download link is valid for 10 minutes. The archive may omit some fields to protect others’ rights or security; additional access requests are considered separately. We respond to deletion and access requests within the legally required period, which may differ from the time needed to erase all data, including backups.

Under Article 11 of the KVKK, you may ask whether your data is processed, request information and access, ask for inaccurate or incomplete data to be corrected, request deletion or destruction where the conditions apply, request notice to third parties, object to an adverse outcome resulting solely from automated analysis, and seek compensation for harm caused by unlawful processing. Other applicable laws may grant additional rights. You may withdraw consent-based permissions; withdrawal does not retroactively affect earlier lawful processing.

Contact [email protected] or use the relevant settings in the app. We may verify your identity securely and respond according to applicable procedures and deadlines. You retain the right to complain to the competent data protection authority where you live.

We apply appropriate technical and organizational measures to restrict access and protect data, but cannot guarantee absolute security. Chax is not intended for people under 18; we take appropriate steps if we become aware of such an account. We may update this policy when the service or law changes. We will announce material changes through the app, email, or another suitable channel; the current text takes effect on its publication date.