Privacy Policy & KVKK Clarification Text

Last updated: September 29, 2026

This Privacy Policy (Clarification Text / Aydınlatma Metni) describes how Diwan Türkiye ("we," "us," or "our") collects, uses, and discloses your information when you use our mobile application (the "App"), web dashboard, and AI-backend.

1. Identity of the Data Controller

In accordance with the Personal Data Protection Law No. 6698 ("KVKK"), the Data Controller (Veri Sorumlusu) is Ahmed Nasser Ali Haidar, an individual developer operating Diwan Türkiye. You can contact the Data Controller at [email protected].

2. Information We Collect

A. Information You Provide to Us

We may collect information that you provide directly to us, such as:

Account Information: When you sign up using email or through third-party authentication services (like Google), we collect your name, email address, and profile information.
Phone Number (optional): You may add a phone number to your profile. This is entirely optional, the App works without it, and you can remove it at any time from your profile settings.
User-Generated Content (UGC): We collect the content you create, upload, or share on the App. This includes discussion posts, comments, votes, reviews, and images you upload to our servers.
Communications: Information you provide when you contact us for support or provide feedback.
Callback Requests (optional): If you ask a listed service office to call you and tick the separate box agreeing to it, we send your first name, what you need and your phone number to that office only. Requests are deleted after 90 days.
Camera and Photo Library: If you choose to upload a profile picture or attach an image to a review or post, the App asks permission to access your camera or photo library. We only receive the specific images you select. We never browse, scan, or upload your photo library.

B. Automatically Collected Information

When you access or use our App, we may automatically collect information about you, including:

Device Information: We collect information about the device you use to access the App, including the hardware model, operating system and version, and unique app-specific identifiers. We do not use the Google Advertising ID (AAID) for advertising or tracking across other apps.
Residence-Permit Date and Notification Preferences: Your residence-permit (ikamet) expiry date powers the countdown and reminders. If you are signed in, it is also saved to your account on our servers, together with the date you confirm a renewal (if you do) and your notification preferences. We use it so that reminders reach you, and so that your union's managers can be shown how many of their members' permits are due soon (as counts, never names or dates). Reminders sent from our servers carry the date and the days left to your phone through Firebase Cloud Messaging (Google). If you are not signed in, the date stays on your phone. If you allow analytics, the number of days left is also sent to Google as described in Section C.
Data Stored Only on Your Device: Unsent discussion drafts never leave your phone, and uninstalling the App erases them.
Usage Information: We collect information about your interactions with the App, such as the discussions you view, the features you use, and the time you spend on the App.
Service Offices: When you tap to call, message or open the website of a listed service office, we record the office, how you contacted it and a short reference number, linked to your account (or, if you are not signed in, to a random identifier for this installation). The office sees the reference only, never your name or number. If you later tell us whether you used the office, we keep that answer. After 24 months the record is kept without anything that identifies you. Page opens and taps are also counted per office, with no identifier at all.
Log Data: Our servers automatically record certain information when you use the App, including your IP address, browser type, operating system, referring URLs, device information, pages visited, and search terms.

C. Information from Third Parties

We use the following third-party services. Each receives only the data it needs to do its job for us.

Our servers (Contabo GmbH, Germany): Our database, sign-in system and file handling run on servers we operate, rented from Contabo GmbH in Germany. Your account, profile, settings and the content you post are stored there. Privacy Policy
Cloudflare: Stores the photos you upload (Cloudflare R2) and delivers our website. Privacy Policy
Backblaze (Netherlands): Keeps our encrypted database backups and encrypted copies of the photos you upload, in its European data center in Amsterdam. Everything is encrypted on our own servers before it is sent, so Backblaze cannot read it. Privacy Policy
Sign in with Google and Sign in with Apple: If you choose to sign in with Google or Apple, they share your name and email address with us. Apple may give us a private relay address instead of your real email. Google Privacy Policy · Apple Privacy Policy
Google Play Services: Privacy Policy
Firebase Cloud Messaging (Google): Delivers push notifications to your device. Only your device's notification token and the notification itself pass through it. Privacy Policy
Google Cloud Vision: Photos you upload are checked automatically for sexual, violent or otherwise unsafe content. The photo is sent to Google for this check only. Privacy Policy
Google Calendar and Google Maps: Union event calendars are loaded from Google Calendar, which receives your device's network address as with any website visit. Place maps are drawn by Google Maps from the place's location only; nothing about you is sent.
Zoho Mail (EU): Sends account emails, such as email verification and password reset. It processes your email address. Privacy Policy
Firebase Crashlytics (Google): Only if you allow crash reporting. When the App crashes or hits an error, a report (the error and where in the App it happened, device model, operating system and app version, and a random app identifier) is sent to Google so we can fix the problem. An error report can also include internal identifiers from the App, such as your account ID, and text you entered, such as an email address. Google receives it with your IP address. Privacy Policy
Firebase Analytics (Google): Only if you allow analytics. Records of how the App is used, such as which screens are opened and which features are used, with details such as the community (union) you ask to join or how many days are left on your residence permit, are sent to Google with a pseudonymous app identifier. Google receives them with your IP address, from which it estimates your approximate location. We do not sell this data or use it for advertising. Privacy Policy
Diwan Türkiye Management Dashboard: Union managers and administrators use a separate internal web tool to review member information for administrative purposes like approving new members. This dashboard runs on the same backend infrastructure as the App.
AI Assistant: The in-app AI assistant is currently unavailable, and none of your messages are sent to any AI service. If we bring it back, we will update this policy before it is switched on.

3. How We Use Your Information (Legal Bases for Processing)

In accordance with KVKK Article 5, we process your personal data based on the following legal grounds:

Performance of a Contract (KVKK Art. 5/2-c): To provide, maintain, and improve our App (including discussions and account security), authenticate users, and send technical notices and support messages.
Legal Obligation (KVKK Art. 5/2-ç): To retain traffic data (e.g., IP logs) as required by Turkish Law No. 5651 (Internet Broadcasting Law) and to respond to lawful requests from authorities.
Legitimate Interests (KVKK Art. 5/2-f): To monitor and analyze trends, detect and prevent fraud, spam, and abusive behavior, moderate UGC, and manage union memberships.
Explicit Consent (KVKK Art. 5/1): For optional analytics (Firebase Analytics) and crash reporting (Firebase Crashlytics). Both are off until you allow them, and you can turn them off at any time in the App's settings.
Service Offices: Contact references rest on our legitimate interest in knowing which listings help people and in keeping them honest (Art. 5/2-f). A callback request goes to an office only with your explicit consent (Art. 5/1).

4. Sharing and Cross-Border Transfer of Information

We may share your information as follows:

Service Providers (Cross-Border Transfer): With the service providers listed in Section 2C, who process your data only on our instructions and only to provide their service. Our main servers are in Germany (Contabo GmbH). Cloudflare and Zoho process data in the European Union or on their global infrastructure, and Google processes push notifications, crash reports, analytics, photo safety checks and calendar requests on its global infrastructure, which includes the United States. Backblaze keeps our encrypted backups in the Netherlands. Your personal data is therefore transferred abroad. We carry out these transfers in accordance with Article 9 of KVKK, on the basis of the standard contracts announced by the Personal Data Protection Board.
Other Users: User-Generated Content and your public profile name will be visible to other users of the App.
Listed Service Offices: Only when you send a callback request, and only the details you entered in it. Otherwise an office receives reference numbers and counts, never who you are.
Union Administrators: If you belong to a union, your name, email, and membership status are visible to that union's managers/administrators.
Legal Requirements: To law enforcement or authorities if required by any applicable law, regulation, or legal process.

5. Your Data Subject Rights (KVKK Article 11)

Under KVKK Article 11, you have the right to:

Learn whether your personal data is being processed.
Request information regarding the processing of your personal data.
Learn the purpose of the processing and whether the data is used in accordance with its purpose.
Know the third parties to whom your personal data is transferred domestically or abroad.
Request the correction of incomplete or inaccurate data.
Request the deletion or destruction of your personal data.
Request that third parties to whom data is transferred be notified of any corrections or deletions.
Object to any negative outcome resulting exclusively from automated decision-making systems.
Claim compensation for damages resulting from unlawful processing of your personal data.

To exercise these rights, or to delete your account and associated data directly, you can use the in-app settings or contact the Data Controller at [email protected].

6. Payments and Donations

The App may display a bank account number (IBAN) so users can make voluntary donations to support union operations. The App does not process, store, or transmit any payment or banking transaction data.

7. Security and Data Retention

We protect your information with encryption in transit (HTTPS) and with access controls that let each user see only what they are allowed to see. Photos and backups stored with Cloudflare and Backblaze are encrypted at rest, and backups are also encrypted on our own servers before they leave them. We retain your data while your account is active or as needed to provide the service. We back up our database every hour and delete each backup after 3 days. When you delete your account, your account and the personal data linked to it are deleted from our systems, and copies in our backups disappear within 4 days. We also retain traffic records (log data) for 1 to 2 years as required by Turkish Law No. 5651.

8. Children's Privacy

Our services are rated for users aged 13 and older (13+), and are not directed to children under 13. However, under Turkish Civil Law, minors (under the age of 18) generally require parental or guardian consent to enter into contracts or provide explicit consent for data processing. If you are under 18 (e.g., a 16 or 17-year-old university student), you must have your parent or guardian's permission to create an account and use the App. We do not knowingly collect personal information from children under 13. If we discover a child under 13 has provided us with personal information, we will delete it immediately.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

10. Contact Us

If you have any questions or wish to exercise your rights, contact the Data Controller at [email protected].