Privacy policy.

1. Data Controller

Berk Sönmez on behalf of Yirmi. Contact: info@yirmi.social

2. Data Collected

Identity, contact (student e-mail), profile, usage and technical data.

3. Purposes of Processing

Membership and student verification, providing the service, security, enforcing the rules of the User Agreement and preventing fake profiles (automated photo checks, see 11), legal obligations and consent-based marketing communications.

4. Transfer

To the server, storage and infrastructure providers we use to provide the service (e.g. database hosting: Supabase; photo storage and automated photo checks: Cloudflare; error logging, subscription and analytics services) and to authorised public institutions. These providers' servers may be located abroad; transfers abroad are made under Article 9 of the KVKK (Turkish Personal Data Protection Law No. 6698) by signing standard contracts and notifying the Personal Data Protection Authority. In the event of a data breach, notification is made within 72 hours.

5. Retention Periods

Profile: membership + 1 year · Photos found to violate our rules: 30 days after the decision · When you delete your account, your photos and their copies are deleted immediately · Logs: 2 years · Marketing: until consent is withdrawn · Payments: 10 years.

6. Your Rights

You may exercise your rights under Article 11 of the KVKK via info@yirmi.social; applications are answered within 30 days at the latest.

7. Security

Your data is protected by technical and administrative measures including access control, encryption and authorisation.

8. Children's Data

Yirmi is closed to persons under the age of 18; data belonging to persons under 18 is not knowingly processed.

9. Changes and Contact

The policy may be updated; the current version is published on this page. Address: Rumelihisarı Mah. Aslıhan Çıkmazı Sok. No 22/1 Sarıyer/İstanbul.

10. Rota Feature (optional)

Rota is an optional feature that works only with your explicit consent and only if you choose to join. When you join, the app reads only the location and time information of the photos on your device, on the device itself. The photos themselves, exact coordinates, venue names or addresses are never collected or sent to our servers.

Data collected: an approximate area identifier of about 5 km², the day and hour range, the number of photos taken in that area on that day, and the district name of the area. Purpose: calculating and showing you where your route crossed with other Rota users. Who sees it: only people whose routes crossed yours see only the number of shared routes; the shared areas themselves are revealed only after a mutual match or a Rota friendship you approved, and only for the areas you have in common. Your full route is never shown to anyone.

Retention and deletion: when you leave Rota or delete your account, all of your Rota data (area records, crossings, Rota friendships, reports) is deleted immediately and permanently. You can hide any area with a single tap; a hidden area is excluded from all calculations. Third parties: map images are served by Mapbox; your identity and route data are not transmitted to Mapbox in those requests.

11. Profile Photos

Photos you add to your profile are checked automatically. The check is performed by an AI model running on the servers of our infrastructure provider, Cloudflare, and looks at only two things: whether a real person appears in the photo, and whether it contains nudity or sexual content. No facial recognition or identification is performed.

If none of your photos shows a real person, your profile is not shown in Discover until you add a real photo. A photo assessed as containing nudity or sexual content is removed from your profile and reviewed by our team; if it is found acceptable it is restored, and if it violates our rules it is deleted 30 days after the decision. If you delete your account, photos under review are deleted immediately. To object to these decisions, write to info@yirmi.social.

Because of network speed and server load, the app shows a lower-resolution version of your photos. A higher-resolution copy of the same photo (up to 2048 pixels, with location and device information removed) is also stored; this copy is not shown to other users and is deleted together with the photo or your account.

Group cover photos and event suggestion images are checked for nudity and sexual content in the same way. This processing is based on the performance of a contract (Article 5(2)(c) of the KVKK), to enforce the rules of the User Agreement.