Melyuna Privacy Policy

Note: This is a translation. The Turkish version prevails in case of any discrepancy.

Data controller: Ramazan Karayıldız ("Melyuna", "we")

Contact e-mail: support@melyuna.com

Version: 2.0

1. About This Policy

Melyuna is a global dating, friendship and language-exchange social app for everyone aged 18 and over worldwide (iOS, Android and web). This Privacy Policy summarizes, in clear and plain language, which personal data we collect, why and on which legal basis we process it, whom we share it with, how long we keep it, how we protect it, and the rights you have.

Because Melyuna is a global service, this policy is prepared with regard to the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU General Data Protection Regulation ("GDPR"), and general global privacy principles. This policy should be read together with our more detailed Privacy Notice and Explicit Consent Text published under the KVKK. The documents are consistent; in case of any conflict, the Privacy Notice prevails as to legal basis and details.

Melyuna is intended only for persons aged 18 and over. Date of birth is collected at sign-up, and no one under 18 is allowed to register (see Section 9).

2. In Short: What Melyuna Does and Does Not Do

We highlight the points that matter most to you up front:

We offer flexible, multi-provider sign-in. You can sign in with e-mail (one-time code), Google, Apple, phone (SMS), Telegram or Facebook (e-mail sign-in is currently active; the others will be rolled out in phases). A university/school e-mail is not required; we do not use e-Devlet, we do not request a national ID number (TCKN), we do not require you to upload an identity document, and we do not perform periodic re-verification.
No mandatory biometrics; selfie verification is optional. If you wish, you can submit a selfie; our team (AI-assisted + manual) may review it and grant a "Verified" badge on your profile. This is entirely optional.
We never expose your raw GPS location to others. Coarse location is collected only with your permission; the server snaps it to a grid (snap-to-grid ~2 km) and adds a per-user fixed offset. Your raw GPS coordinate is never returned to other users; only a banded distance ("~5 km") is shown (see Section 4).
Your messages are NOT end-to-end encrypted (E2EE). For security, complaint review and moderation, our authorized technical team may access messages, and every access is logged (see Section 6).
AI does not ban you on its own. Automated moderation may flag content; however, ban decisions are made by humans, manually (except for CSAM/underage content, where automated action may be taken).
Some of our service providers are located abroad (EU/US). As a result, some of your data may be transferred abroad (see Section 7).
You can delete your account from within the app. Deletion begins as a soft delete; you can undo it within 14 days, after which it is permanently cleared (see Section 8).

3. What Data We Collect

We collect the following personal data only for the purposes stated below:

3.1. Account and Authentication Data

Your sign-in identifier — depending on the method you choose, an e-mail address, phone number, or social sign-in provider identifier (Google, Apple, Telegram, Facebook). For e-mail sign-in, a one-time code (OTP) sent by the app's authentication provider (Supabase Auth) is used.
Date of birth — only for the 18+ age check and age display.
Push notification token (FCM / Web Push VAPID) — to be able to send notifications.
IP address and rate-limit records — to prevent abuse, bots and attacks.

3.2. Profile Data

Display name, date of birth/age, gender, photos, biography (bio).
Spoken and learned languages (with CEFR levels, if provided) — for language-exchange matching.
Interests / hobbies, prompt answers, meeting intent, and an optional voice prompt (short audio recording).
Optional selfie verification — only if you submit it; for the "Verified" badge assessment.

3.3. Location Data

Coarse location — only with your permission. Snap-to-grid (~2 km) and a per-user fixed offset are applied server-side; only a banded distance is shown to others. Country is derived from location for the "foreigners only" / worldwide filters (see Section 4).
City / locality name — derived from your location and stored on your profile. It is never shown to other users; it is visible only to the moderation team in the admin panel, for fake-account and abuse review. This name is less precise than the coarse location we already store (district/city level) and may be approximate.

3.4. Content Data

Profile and chat photos, voice prompts, and feed posts (media storage: Supabase Storage).
Messages — your conversations with other users.
Feed ("World/Today") posts — text/photo/audio "moment" posts, likes and comments, "Question of the Day" answers.

3.5. Security and Moderation Data

Moderation flags — signals produced by automated systems (text, NSFW image, Turkish scam detection) or user reports.
Report, block and unmatch records.
Message access logs — every access to messages by the authorized team is recorded.

Special-category personal data notice: A dating profile may, by its nature, carry hints about sexual orientation/preference. Under the KVKK/GDPR, such data may be considered special-category personal data, and we obtain your explicit consent to process it.

4. How Location Data Works (Privacy Design)

Melyuna collects coarse GPS location only with your permission. Your raw GPS coordinate is never returned to other users. The server snaps your location to a grid (snap-to-grid ~2 km) and applies a per-user fixed offset; other users are only shown a banded distance (e.g. "~5 km"). Country is derived from location for the "foreigners only" and worldwide filters. Location is not derived from a school/university e-mail. With the "Travel / Passport" feature you can virtually browse another city; this does not change your stored real location. This design is deliberately chosen to prevent third parties from computing your exact location (tracking/trilateration risk).

5. Purposes and Legal Bases for Processing Your Data

Purpose	Example operations	Main legal basis (KVKK Art. 5/6; GDPR Art. 6/9)
Account creation and sign-in	E-mail OTP / social / phone sign-in, account creation	Establishment/performance of a contract
Matching / discovery service	Profile display, swiping, conversation requests, language & friends matching	Establishment/performance of a contract
Messaging and feed	User-to-user chat, "moment" posts, likes/comments	Establishment/performance of a contract
Special-category profile data	Profile fields that may hint at sexual orientation/preference; optional selfie	Explicit consent
Location-based discovery	Distance/discovery via coarse location, country filters	Explicit consent (location permission)
Security, moderation, fraud/bot/fake-account prevention	rate-limit, moderation, report/block	Legitimate interest
Complaint review	Message/content review	Legitimate interest / performance of a contract
Transfer of data abroad	Transfer to the providers in Section 7	Explicit consent or safeguards compliant with applicable law
Legal obligation (detection and reporting of CSAM/child-abuse content)	Detection of prohibited content and reporting to authorities	Compliance with a legal obligation

For processing based on explicit consent, you may withdraw your consent at any time; this does not affect the lawfulness of processing prior to withdrawal. In some cases (e.g. distance-based discovery cannot be offered without location permission), withdrawing consent may limit the functionality of your account. Consents are recorded with version and date information.

6. Message Access and Moderation (Important)

On Melyuna, messages are not end-to-end encrypted (E2EE). Your messages are protected with TLS in transit and encrypted at rest on the server; however:

Our authorized technical team may access messages for security and moderation purposes.
Such access is performed only upon a report/block, when required by a security review, or in case of a legal obligation.
Every access is logged and auditable.
Ban decisions are made manually, by humans; no automatic ban is applied except for the CSAM/underage-content exception.

As a user, you can block, report and unmatch anyone. You can also filter unwanted expressions using "Hidden Words." Push/web-push notifications may show the sender's name and a short message preview; a translation feature is offered in messages, profiles and World posts. Translation is performed by Google: when you tap "Translate", the relevant text is sent to Google for translation (see Section 7 and Explicit Consent Text §3.6). Translation is not automatic; it runs only when you request it.

7. Whom We Share Data With (Processors and Transfers Abroad)

Melyuna does not sell your personal data. Your data is shared with the following processor service providers to the extent necessary to provide the service and under technical safeguards (work is under way to conclude data-processing/transfer agreements). Some are located abroad (EU/US):

Service provider	Function	Data location
Supabase	Database (Postgres), authentication (Auth), storage (Storage), Edge Functions	EU (Ireland, `eu-west-1`)
Cloudflare Pages	Web hosting and CDN	Abroad (EU/US, global CDN)
Firebase Cloud Messaging (FCM) + Web Push (VAPID)	Push notification delivery	Abroad (US)
OpenAI	Text/image content moderation	Abroad (US)
Twilio / Google / Apple / Telegram / Meta	Phone (SMS) and social sign-in (only if the relevant sign-in is enabled)	Abroad (EU/US)
Google (Translate)	Translating the relevant text (message, profile text, post, comment) when the user taps "Translate"	Abroad (US)
Anthropic	Visual content moderation of uploaded photos	Abroad (US)
Sentry	Application error/crash reports (diagnostics)	EU (Germany)
Google / Apple (device location service)	Resolving the device coordinate into a country/city name	Abroad (EU/US)
BigDataCloud	Determining the country from an approximate coordinate (rounded to ~11 km)	Abroad (EU/US)
CARTO	Serving the map tiles on the discovery screen	Abroad (EU/US)
Resend	Sending verification/sign-in code e-mails	EU (Ireland)
Google Fonts	Serving font files in the web version	Abroad (US)

Media files (photos, voice prompts, etc.) are stored in Supabase Storage.

Transfer abroad (KVKK Art. 9 / GDPR Chapter V): These transfers are based on your explicit consent or on appropriate safeguards (e.g. standard contractual clauses / standard data protection clauses) required by applicable law. For transfers based on standard contracts, notification is made to the Board within the period prescribed by applicable law. The scope and basis of transfers are detailed in the Privacy Notice.

In addition, in case of a legal obligation (e.g. a court/prosecutor order, CSAM reporting), your data may be shared with competent public authorities.

8. How Long We Keep Data (Retention and Disposal)

Your personal data is processed as long as your account is active and for as long as the processing purposes continue.
Account deletion: You can delete your account from within the app. Deletion begins as a soft delete; you can undo it within 14 days. At the end of this period, your profile, messages, photos, feed posts and notification token are permanently cleared. You can also suspend your account and maintain a block list.
Exception — security: To prevent abuse, minimal security/moderation logs may be kept for a limited and reasonable additional period.
A periodic disposal policy is applied to data whose retention periods have expired; the data is deleted, destroyed or anonymized.

A detailed table of retention periods is provided in the Privacy Notice and the Data Retention and Disposal Policy.

9. Protection of Children (CSAE/CSAM Zero Tolerance)

Melyuna is intended only for persons aged 18 and over; an 18+ check is performed at sign-up using date of birth.
Any content or behavior connected to child abuse (CSAE/CSAM) is strictly prohibited. This is a requirement of both our community guidelines and app store policies (Apple and Google Play child-safety obligations).
When such content is detected, the content is removed, the relevant account may be closed automatically, and a report is made to the competent authorities within the scope of our legal obligations.
All users have content reporting, user blocking, unmatch and in-app account deletion features.

10. How We Protect Your Data (Security Measures)

To protect personal data, we apply administrative and technical measures compliant with the KVK Board's guidelines (in particular the "Personal Data Security Guide" and Board Decision No. 2018/10 on "Measures to be Taken in the Processing of Special-Category Personal Data") and GDPR principles:

Technical measures

Encryption of data in transit with TLS and encryption at rest.
Keeping sensitive identifiers as a hash rather than plaintext.
Access logging and audit trails (in particular, message accesses are logged).
Rate-limiting, bot/fraud prevention and abuse detection.
Least-privilege principle, role-based access control, and access limited to the authorized team.
Automated (text, NSFW image, Turkish scam) and human-reviewed content moderation.

Administrative measures

Confidentiality obligations and authorization for staff who access data.
Data processing/confidentiality agreements with processors and appropriate safeguards for transfers abroad.
Periodic disposal and data minimization (e.g. using date of birth only for age/18+, not exposing raw GPS coordinates to others).

While no system is 100% secure, we continuously review our measures to minimize risk, and in the event of a data breach we fulfill the notification obligations prescribed by applicable law.

11. Notifications and Preview

When a push/web-push notification is sent to you, the sender's name and a short message preview may appear on your device's lock screen. You can restrict or turn this off from your device's notification settings.

12. Your Rights (KVKK Art. 11 / GDPR Art. 15-22)

Under applicable law, by applying to us as the data controller, you have the right to:

Learn whether your personal data is processed and, if so, request information about it,
Learn the purpose of processing and whether it is used in accordance with that purpose,
Know the third parties to whom it is transferred domestically/abroad,
Request rectification if processed incompletely/incorrectly,
Request erasure/destruction where the conditions are met,
Request that rectification/erasure operations be notified to the third parties to whom the data was transferred,
Data portability (obtaining your data in a structured format under the GDPR),
Object to a result against you produced solely by automated analysis,
Claim compensation for damage arising from unlawful processing.

Your rights to restriction of processing (GDPR Art. 18) and to object to processing (GDPR Art. 21) are also reserved.

Do you have to provide the data? An e-mail address/phone number, date of birth, gender and at least one photo are necessary for the conclusion of the contract; without them an account cannot be created. Location, voice prompt and selfie verification are optional; without them only the related feature will not work.

Automated decision-making: Match/discovery ranking is automated but produces no legal effect concerning you. Automated moderation may reject content; account sanctions are decided by a human. The sole exception is child safety: the account is automatically frozen, the permanent decision is taken after human review, and you may contest that decision.

Application: You can submit your requests to us via support@melyuna.com. We conclude your applications within the period prescribed by applicable law. If you are not satisfied with the outcome, you retain the right to file a complaint with the Personal Data Protection Board (or, in the EU, with your local data protection authority).

13. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will inform you via in-app notification or e-mail. The current version is always published in the app and on our website.

14. Contact

Ramazan Karayıldız

E-mail: support@melyuna.com

For detailed legal information, you may review the Privacy Notice, Explicit Consent Text, Terms of Use, Community Guidelines and Data Retention and Disposal Policy.

The Turkish version prevails in case of any discrepancy.