Privacy Policy

This Privacy Policy ("Policy") explains how your personal data is processed in connection with the Meydan mobile application, the https://app.meydanly.com web interface and the meydanly.com website (together, the "Service"), under Turkish Personal Data Protection Law No. 6698 ("KVKK"), related legislation and the EU General Data Protection Regulation ("GDPR"). In this Policy, "Meydan" or "we" refers to the data controller and "you" refers to the person using the Service.

1. Data controller

Your personal data is processed by the company whose details are set out below, acting as data controller:

• E-mail: support@meydanly.com

2. In short

• We do not sell your personal data and we do not give your identity to advertisers.
• Your exact location is never shown to any user; only an approximate distance (for instance 1–3 km) or your city is visible. When you turn off location sharing, your stored location is deleted.
• Live audio and video rooms and calls are not recorded.
• Fitness data from health apps is accessed only with your explicit permission and with read-only access.
• You can download a copy of your data from Settings and delete your account at any time.
• Our servers are located in Germany (Frankfurt); some of our service providers are abroad (see sections 5 and 6).

3. The personal data we process and why

Below we explain which data we process in each part of the Service and for what purpose. The legal bases are set out in section 4 and retention periods in section 7.

3.1 Account, identity and sign-in

• Registration details: first and last name, username, e-mail address, phone number (optional, or when signing in by phone), date of birth, country, and the identifier and platform of the device used to open the account.
• Sign-in methods: password with e-mail or phone; a one-time code sent to your phone number via WhatsApp or SMS; sign-in with Google or Apple (in which case the name, e-mail address and account identifier provided by that provider).
• Security information: Your password is stored only as a one-way (bcrypt) hash; it is never stored in plain text. For two-step verification, the authenticator key is stored encrypted and backup codes as hashes; the "remember this device" option is valid for 30 days. Verification codes are valid for 10 minutes and only their hashes are stored.
• Purpose: creating and managing your account, verifying your identity, enforcing the minimum age of 18 and protecting your account against unauthorised access.

3.2 Profile, photos and verification

• Profile details: profile and cover photos, other photos, bio, city, gender (and whether it is shown on your profile), intents (friendship, language practice, activities, etc.), the languages you speak and learn and your level, interests, and your preferences for the people you want to see in discovery.
• Your profile details are shown to other users in line with your privacy settings. Your preference regarding the genders you want to see in discovery is used only to rank suggestions for you and is not shown to others.
• Image checks: Photos are scanned on your device for inappropriate content before upload. For profile photos, the scan result (a probability score) is sent to the server and, where necessary, the photo is held for moderation review before it is published.
• Profile verification (selfie): For the blue tick you are asked to take a selfie in a randomly chosen pose. Your selfie is kept in restricted storage accessible only to you and authorised moderation staff, and is reviewed visually by staff; no automated facial recognition or biometric matching is performed. The selfie is deleted 30 days after the review is completed; the verification result and review record are retained.
• Professional verification: Documents you upload for professional and coaching features are kept in restricted storage accessible only to you and authorised staff, and are never shown on your profile, cards or in search. When you replace or remove a document, the old one is deleted.

3.3 Location

• What we collect: If you grant location permission and keep location sharing on, your device's latitude and longitude, location accuracy, city and country are sent to the server while the app is open. They are sent at most every 5 minutes and only after a meaningful change of position (about 100 metres); only the latest location is kept for each user. The app does not collect location in the background.
• What others see: Your exact location or coordinates are never shown to any user. In the people nearby list, only a distance band (less than 1 km, 1–3 km, 3–5 km, 5–10 km, more than 10 km) or, if you prefer, only your city is shown. You can also choose not to appear in the nearby list at all.
• Turning off location sharing: When you turn off location sharing in Settings → Privacy, your stored location is deleted and no new location is sent.
• Plans: The meeting place chosen for a plan is shown to its participants. When you "check in" at the meeting point, only your proximity to the meeting point is checked; your coordinates are not stored, only the check-in time is recorded.
• Web interface: The same rules apply when you grant your browser's location permission; some screens (such as nearby community and place suggestions) use the coordinates only for that request and do not store them.
• Purpose: showing people, plans, communities and places near you and calculating distance bands.

3.4 Discovery, matching and profile visits

• Your likes, super likes, passes, matches and use of boosts are processed.
• When ranking suggestions for you, we use shared interests, languages, intents, closeness in age, online status and distance band. This ranking is for suggestion purposes only and is not an automated decision producing legal or similarly significant effects for you.
• Profile visits: When you view a profile, the visit is recorded. Only users on the Gold tier can see the list of visitors; other users only see the number of visits. Visits by people you have blocked are not recorded. Visit records are deleted after 90 days.
• The "Likes you" list can be viewed only on the Premium and Gold tiers.

3.5 Messages

• Text, photos, voice messages, videos and files you send in one-to-one, plan, room and community chats, together with sending and read times, are processed. Other people in a chat can see how far you have read (read receipts).
• Messages you delete are removed from the chat.
• Message translation: When you tap "Translate" on a message, only the text of that message is sent to OpenAI's service for translation; the translation is kept for reuse until the message is deleted.
• Purpose: providing messaging, preventing abuse and reviewing reports. Moderation staff can view private messages only as part of a report or safety review and limited to the relevant context.

3.6 Live rooms and calls

• Live audio and video rooms and one-to-one audio and video calls are transmitted in real time through an audio and video server operated for Meydan (Frankfurt, Germany). Audio and video are not recorded.
• The room title, description and settings; messages you write in the room chat; the times you join and leave a room, your role (listener, speaker, moderator) and how long you participate; and hand-raise requests are stored. Live reactions in rooms are not stored.
• For calls, the caller and recipient, call type (audio or video), start, answer and end times and duration are recorded. On iOS, your device's call notification (VoIP) token is used for incoming call notifications.
• Purpose: providing rooms and calls, room moderation, safety and reviewing reports.

3.7 Posts, stories, communities and plans

• Your posts, captions, comments and likes are shown to other users according to the visibility you choose (public, followers, friends, only me).
• Stories are permanently deleted, together with their media and record, 24 hours after they are published. A story subject to a report under review is kept until the review is completed, for at most 30 more days.
• Your community memberships, roles and what you share in communities, as well as plans you create or join, your join requests and plan chats, are processed.
• Your friendships and follows are processed. When adding friends by username or with "My QR code", only your username is shared.

3.8 Meetup safety ("Are you safe?")

• If you turn on the safety check for a plan, the details of the trusted contact you choose and the check time are processed. If you do not answer "I'm safe" within the set time, your trusted contact receives an alert.
• If you turned on location sharing for the check, your last known location at the time of the alert is shared with your trusted contact. This location is deleted when the check closes or 24 hours after the alert. Your trusted contact's viewing of the alert is logged.
• Purpose: supporting your personal safety at meetups.

3.9 Games and Meydan points

The games you play, move history, in-game chat, results, your points, Meydan points (XP), level and badges are processed. Your username and score may be shown to other users in rankings.

3.10 Businesses, coaching and professional pages

The page, programme, product and contact details you create as a business or coach are shown publicly. Your memberships and follows of these pages are recorded. Meydan does not take payment or process card details in these relationships.

3.11 Places and maps

• When you search for places nearby, your location is rounded on our server to an area of about 500 metres and the search is sent to the OpenStreetMap data service (Overpass API) from our server; your IP address and identity are not passed to that service.
• Map images (tiles) are loaded by your device directly from OpenStreetMap servers; in doing so, your IP address and the map area viewed may be processed by the OpenStreetMap Foundation.

3.12 Fitness and health data

• If you turn on the fitness feature and grant access to your device's health app (Apple Health on iOS, Health Connect on Android), only read access is used to obtain step count, walking and running distance, active calories and exercise time or sessions. Meydan does not write to your health app and does not read your routes or location history.
• Only daily totals (steps, distance, active minutes, calories) for the last 7 days are sent to the server. On Android, if you enable it, these totals are synchronised in the background every 6 hours.
• This data is shown in friend rankings (which you can turn off in Settings) and to other participants in challenges you join.
• Because this data may qualify as health data, it is processed as special category personal data under Article 6 of the KVKK and only on the basis of your explicit consent. You can withdraw your permission at any time in your health app settings or in the app; after you withdraw it, no new data is collected. Data obtained from health apps is not used for advertising and is not sold to third parties.

3.13 Subscriptions and payments

• Premium and Gold subscriptions are purchased through the Apple App Store or Google Play. Your payment and card details are processed by the store; Meydan does not receive card details.
• To verify your subscription, the purchase receipt or token provided by the store is checked with Apple's or Google's verification services; your subscription tier, start and end dates, and renewal, cancellation and refund statuses are recorded.

3.14 Advertising

• Ads may be shown through Google AdMob on the free (Standard) tier. No ads are shown on the Premium and Gold tiers or during the first 24 hours after an account is created. Ads never appear in live rooms, calls, chats, or payment, safety, game and sign-in screens.
• To show ads, Google may process your device's advertising identifier, IP address and device information. In the European Economic Area and the United Kingdom, advertising consent is obtained through Google's consent form, and on iOS through the App Tracking Transparency (ATT) permission. Personalised ads are shown only on the basis of your consent; if you do not consent, non-personalised ads are shown.
• You can reset your advertising identifier or turn off personalised ads in your device settings; in regions where the consent form is offered, you can change your choices in Settings → Ad privacy.

3.15 Notifications and e-mail

• For push notifications, your device's notification token (Firebase Cloud Messaging; on iOS also Apple Push Notification service) is stored. You can manage notification types in Settings → Notifications; notifications about account security cannot be turned off.
• Only verification and password reset codes and account security notices are sent to your e-mail address; we do not send marketing e-mails.
• When signing in by phone, the verification code is sent via WhatsApp or, for numbers starting with +90, by SMS.

3.16 Safety, moderation and automated tools

• Your reports (category, description and related content), your block list, and moderation actions taken on your account and their reasons are processed. The identity of people who report you is not shown to you.
• Banned word and spam rules are applied for community safety. In addition, text content (messages, room chat and titles, bios, post captions, comments, story text, plan, community, business and coaching texts, and in-game text) may be sent to OpenAI's moderation service for automated moderation. Only the text is sent; your identity is not. As a result of the automated assessment, content may be blocked or held for review; decisions to suspend or close your account are made or reviewed by moderation staff.
• Accounts reported by 5 different users within the last 7 days are automatically suspended for 3 days until the review is completed.
• The volume of use of AI-assisted features (feature type, estimated processing size, duration) is logged without content, for cost and abuse monitoring.

3.17 Device, session and traffic records

• Device identifier, platform, operating system and app version, notification tokens, last activity time and your open sessions are processed. You can see and end your sessions in Settings → Sessions.
• Under Turkish Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications and related regulations, traffic and access records relating to your access to the Service are kept. These records contain the IP address and the source port of the connection, date and time, device identifier, platform, app version, browser or device description (User-Agent), the type of action (sign-up, sign-in, sign-out, session refresh, password change, account deletion; posts, comments, stories, messages, creating and joining rooms, starting calls, submitting reports and similar) and the identifier of the related content. The content itself (message text, post text, media) is not written to these records.
• Traffic and access records are retained for 2 (two) years and deleted automatically afterwards; deleting your account does not shorten this period, because retention is a legal obligation (Turkish Personal Data Protection Law, Art. 5/2-ç). Only authorised administrators can access these records, and every search and export is written to an audit log; the records are shared only upon a lawful request of the competent authorities or a court order. Your own access records are included in the copy of your data you can download from Settings.
• Application logs kept to monitor the operation of the Service and fix errors are deleted after 14 days.
• For security, administrative actions, staff sign-ins, failed two-step verification attempts and data download requests are written to an audit log together with the IP address.

3.18 Web interface and cookies

The app.meydanly.com web interface uses only cookies that are strictly necessary for the Service to work; it does not use advertising or analytics cookies.

4. Legal bases for processing

5. Recipients of personal data

We do not sell your personal data. We share your data only to the extent necessary to provide the Service, with the following groups of recipients:

• Other users: your profile, posts, messages and room participation, in line with your privacy settings and the visibility you choose.
• Your trusted contact: the person you choose, in a meetup safety alert.
• Our service providers (data processors): the organisations listed in the table below, which process data only on our instructions.
• Competent authorities: judicial authorities and competent public bodies, upon their lawful request, in accordance with our legal obligations.
• Corporate transactions: in the event of a merger, acquisition or transfer of assets, to the acquiring party, limited by the safeguards in this Policy.

6. International transfers

The Service's servers are hosted in data centres in Germany (Frankfurt). Using the Service therefore results in your personal data being transferred outside Türkiye. In addition, some of the service providers listed in section 5 process data abroad, particularly in the United States.

Transfers abroad are carried out in accordance with Article 9 of the KVKK: they rely on an adequacy decision for the destination country where one exists, and otherwise on one of the appropriate safeguards provided for by law, in particular standard contracts notified to the Turkish Personal Data Protection Board. In exceptional and incidental cases where appropriate safeguards cannot be provided, transfers are made only with your explicit consent or on the basis of the other exceptions listed in the law. For users in the European Economic Area, transfers outside the EU rely on adequacy decisions or the standard contractual clauses of the European Commission.

7. Retention periods

We keep your personal data for as long as required for the purpose of processing and for the periods required by law. At the end of that period, we delete, destroy or anonymise the data.

8. A copy of your data and account deletion

• Download my data: Under Settings → Download my data, you can download a copy of your account data (such as account and profile details, photos, location, devices, social connections, messages you sent, rooms, plans, notifications, subscription, game and fitness data) in a machine-readable (JSON) format. For security, this can be done at most 3 times an hour and is logged.
• Delete account: Under Settings → Delete account, you can delete your account; deletion happens immediately. Your profile, photos, posts, comments and stories, location, device and session records, friendship and profile visit records and verification documents are deleted, and your account is anonymised as "Deleted user". Your open live rooms are closed, your plans are cancelled and communities you own are handed over to other admins. Messages you sent to other users may remain visible in the recipients' chat history under the name "Deleted user". Records that must be kept for legal obligations, disputes and security are deleted at the end of the periods in section 7.
• Deleting your account does not automatically cancel an App Store or Google Play subscription; you must turn off renewal in your store account.

9. Data security

We take appropriate technical and organisational measures under Article 12 of the KVKK to protect your personal data. Connections between the app and our servers are encrypted (HTTPS/TLS). Passwords and verification codes are hashed one-way, and two-step verification keys are stored encrypted. Verification documents and selfies are kept in restricted storage and opened only through time-limited signed links. Staff access is limited by role and permission; two-step verification is mandatory for signing in to the admin panel and staff actions are written to an audit log. The database and media are backed up regularly.

10. Minimum age of 18

The Service is not intended for anyone under 18 and we do not knowingly process personal data of people under 18. If we find, or are told, that a person under 18 is using the Service, we close the account concerned and delete the data. You can report such cases to support@meydanly.com.

11. Your rights under the KVKK and how to apply

Under Article 11 of the KVKK, you can apply to the data controller to:

• learn whether your personal data is processed and, if so, request information about it,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom the data is transferred,
• request correction of incomplete or inaccurate data,
• request deletion or destruction of the data under the conditions in Article 7 of the KVKK,
• request that correction, deletion and destruction be notified to the third parties to whom the data was transferred,
• object to an outcome against you arising from analysis of the data exclusively by automated systems,
• claim compensation if you suffer damage because of unlawful processing.

You can send your application, with information allowing us to identify you and preferably using the contact details registered to your account, through the following channels:

• E-mail: support@meydanly.com

We will respond to your application free of charge as soon as possible according to its nature and within 30 days at the latest; if the process involves an additional cost, a fee in accordance with the tariff set by the Turkish Personal Data Protection Board may be charged. If your application is rejected, you find the response insufficient or no response is given in time, you can lodge a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the response and, in any case, within 60 days of the application date.

You can also exercise some of your rights directly in the app: you can edit your profile, turn off location sharing, download your data and delete your account.

12. Users in the European Economic Area and the United Kingdom (GDPR)

If you are in the European Economic Area or the United Kingdom, your personal data is also protected under the GDPR and the UK GDPR:

• Legal bases: performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)) and consent (Art. 6(1)(a); for health data Art. 9(2)(a)).
• Your rights: access, rectification, erasure, restriction of processing, data portability, objection and withdrawing your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
• Complaints: you can lodge a complaint with the data protection supervisory authority in the country where you live or work or where the alleged infringement took place.
• You can send your requests through the channels in section 11; we will respond within one month at the latest.

13. Changes to this Policy

We may update this Policy to reflect changes to the Service or the law. The current version is published on this page with its effective date and version number. We announce significant changes by in-app notification or e-mail before they take effect; where processing is based on your explicit consent and a new purpose arises, we will ask for your consent again.

14. Contact

For any questions about this Policy or your personal data, contact us at support@meydanly.com.