Privacy Policy
Gizlilik Politikası
Last updated: 10 September 2026
A summary policy prepared for store (App Store / TestFlight) requirements. For detailed and binding information, the Personal Data Processing Notice governs.
This English text is provided so that the document can be read by people who do not read Turkish, including App Store reviewers. The Turkish original is the version that governs; in the event of any discrepancy, the Turkish text prevails.
In short: 28 does not use or sell your message content or your location for advertising. Location is processed only at the moment a recommendation or a match is produced; no location history is kept. If you do not grant location permission, every feature of the app that does not depend on location — persona, matching, chat, events — keeps working. All of the app's server infrastructure is located outside Türkiye; this is explained openly in Section 5.
1. Overview and data controller
This Privacy Policy explains how your personal data is collected, used, shared, how long it is stored and how you can delete it when you use the 28 Social mobile application (the "App" or "28").
| Data controller | (natural person — sole proprietorship) |
| Address | |
| Contact | hello@28istanbul.com |
| Data protection requests | kvkk@28istanbul.com |
The App is currently in a closed test run through Apple TestFlight; participation is voluntary.
2. What data we process
| Data | Where it comes from | What for | Legal basis |
|---|---|---|---|
| First name, surname, username, profile photo | Information you enter | Creating your profile and showing it to other users | Performance of a contract |
| Date of birth | Information you enter | Verifying the age of 18. Only your age (a number) is shown on your profile, never the date | Performance of a contract + legal obligation |
| Email address, phone number | Information you enter | Account management, contact, account security | Performance of a contract |
| Interest selections → persona | Your selections during sign-up | Calculating a "persona" and using it in matching | Explicit consent |
| Approximate or current location | Device location services (if you permit it) | Nearby event and user recommendations | Explicit consent |
| Match and chat data | Your in-app interactions | Opening the chat room after a match and delivering and storing messages | Performance of a contract |
| Event participation data | Your actions in the For You, Dice, Planned and Presents sections | Managing the event list and attendance status | Performance of a contract |
| Notification preferences | Your app settings | Functional notifications; marketing notifications where consent is given | Performance of a contract / explicit consent |
| Device and log data (IP, device identifier, session records) | Automatically, from the traffic between your device and our servers | Security, detection of fake accounts, troubleshooting, statutory record keeping | Legitimate interest + legal obligation |
| Analytics and usage data | Firebase Analytics SDK (if you consent) | Usage statistics and service improvement | Explicit consent |
| Report and moderation records | Reports made by you or by other users | Reviewing bullying and harassment reports, user safety | Establishment or protection of a right + legitimate interest |
3. What we do not process
- Your complete, continuous location history. Location is used only at the moment of the relevant recommendation or match; no retrospective route or trace is kept.
- Your contacts, your SMS messages or the content of your other messaging apps. The App does not request access to them.
- Your browsing history.
- We do not analyse the content of your chats for advertising or marketing. Chat content can only be viewed within the scope of a report review, by a limited number of authorised staff.
- We do not share your location data with any advertising network.
- We do not systematically collect special categories of personal data (such as health, religion, political opinion, ethnic origin). We recommend that you do not publish such information in your profile or in the content you share.
- Your payment and card details. The App has no paid features and no in-app purchases.
4. Who your data is shared with
With other users: only the information you choose to show on your profile (username, photo, age, persona, shared interests). Before a match occurs, no user can reach your contact details, your date of birth or your precise location.
With service providers: no data is transferred to any third party other than those listed in the table below. These providers work only for the stated purpose and with limited data. Your data is not sold, rented or traded to advertising networks or data brokers.
| Provider | Purpose | Data transferred | Location |
|---|---|---|---|
| Google Cloud [full legal name to be confirmed from the agreement] | Server, database, authentication and file storage infrastructure | All data listed in Section 2 | Ireland (EU) |
| Apple Push Notification service / Firebase Cloud Messaging [integration to be confirmed] | Delivering notifications to your device | Device notification identifier (push token) | United States / Ireland |
| Firebase Analytics (Google) | Usage statistics and service improvement — only if explicit consent is given | Screen view and event data, device identifiers | Google infrastructure, including the United States |
| Lawyer, financial adviser | Legal and financial advice | Only data limited to the relevant dispute or transaction | Türkiye |
| Competent public authorities, courts, law enforcement | Meeting statutory obligations | Data limited to the scope of a lawful request | Türkiye |
5. Is your data transferred abroad?
Yes. All of the App's server and database infrastructure runs outside Türkiye (Google Cloud — Ireland), so the data listed in Section 2 is necessarily transferred abroad.
As at the date this text was prepared, there is no adequacy decision issued by the Turkish Personal Data Protection Board for the country the data is transferred to, and the standard contract published by the Board has not yet been signed. For that reason, for the duration of the closed test, the transfer rests solely on your explicit consent, given after you have been informed of the possible risks. The risks are listed in full in Section 5.3 of the Explicit Consent text; please read that section before ticking the box.
Before the App is released publicly, the data controller undertakes to sign the Board's standard contract with the cloud service provider and to notify the Authority within five business days of signature.
6. How we use your information
The information collected is used to manage your account, match you with other users, show you suitable events, send functional notifications, keep users safe and improve the App. Your information is not shared commercially with third parties or sold, other than as stated in this policy.
7. How long your data is kept
| Data | Retention period |
|---|---|
| Account, identity and contact details | For as long as the account is active; 6 months after the account is deleted |
| Interest selections and persona | For as long as the account is active; deleted immediately if consent is withdrawn |
| Match and chat data | For as long as the account is active; 30 days after the account is deleted or the chat is ended |
| Location data | Not stored — processed only for the duration of the relevant operation |
| Log and device security records | 1 year (the minimum period under Law No. 5651) |
| Report and abuse records | 2 years — may be kept even if the profile concerned has been deleted |
| Marketing consent and opt-out records | 3 years from the date the consent ceases to be valid |
| Analytics data | 14 months |
When you delete your account, your data is deleted or anonymised without delay, except for the records in the table above for which a statutory or evidential retention period applies. For the detailed reasoning, see Section 9 of the Personal Data Processing Notice.
8. Your rights and how to exercise them
Under the Turkish Personal Data Protection Law and related legislation you have the right to access your data, to have it corrected, to have it deleted, to learn the third parties it has been transferred to, to object to the outcome of automated analysis and to claim compensation for damage. You can exercise most of these rights directly inside the app:
| Request | In-app path |
|---|---|
| Access and information request | Settings → Privacy → My Data |
| Deleting the account and all data | Settings → Delete My Account |
| Withdrawing persona consent | Settings → Privacy → Persona Preference |
| Withdrawing location permission | Settings → Privacy → Location · Device Settings → 28 → Location |
| Withdrawing marketing notification consent | Settings → Notifications → Marketing Messages · iys.org.tr |
| Withdrawing analytics SDK consent | Settings → Privacy → Data and Analytics Preferences · on iOS also: Settings → Privacy & Security → Tracking |
| Withdrawing consent to transfer abroad | Settings → Privacy → Transfer Abroad (this results in the account being closed) |
You can write to kvkk@28istanbul.com for any other request; we respond within 30 days at the latest. If you find our response inadequate, you retain the right to complain to the Personal Data Protection Board.
9. Data security
All communication takes place over an encrypted connection (TLS). Passwords are not stored in plain text. Access restrictions are applied at database level: a user can only reach their own records and the chat and event data for which a mutual match has been confirmed. Access within a moderation review is limited to a small number of authorised staff and is logged. In the event of a data breach, the Personal Data Protection Board is notified within 72 hours at the latest and the affected users as soon as reasonably possible.
Despite all the measures taken, please remember that no transmission over the internet and no electronic storage is 100% secure.
10. Children's privacy
28 is not directed at people under 18 and does not knowingly collect data from anyone under 18. The declared age is checked both in the app and on the server; if a date of birth under 18 is entered, no profile is created. You can report a profile you believe belongs to someone under 18 from inside the app; such reports are reviewed as a priority.
11. Changes
When this policy changes, the update date on the document changes with it. For material changes that widen the scope of processing, a separate notice is given inside the App before the change takes effect and fresh consent is obtained where required.
12. Contact
For questions about privacy and for requests under the data protection legislation, you can reach us at kvkk@28istanbul.com.
For binding and detailed information, the Personal Data Processing Notice governs.
Last updated: 10 September 2026