Hivroj Privacy Policy

Last updated: 9 November 2026

This policy explains how your personal data is processed when you use the Hivroj mobile app and hivroj.com ("Hivroj", "we"). It is the information notice required by Article 10 of Turkey's Personal Data Protection Law No. 6698 (KVKK) and by Articles 13 and 14 of the EU General Data Protection Regulation (GDPR). Hivroj decides why and how your data is processed and is therefore the data controller (contact: section 14).

1. Information we collect

• Account: name, username, email address, date of birth (only for the 18+ age limit) and password (only a hashed form is stored). With Google or Apple sign-in, the name, email address, profile photo (only as a suggested profile photo) and account ID that service shares; your Google / Apple password never reaches us.
• Profile and content: profile photo, bio, the languages you speak, posts, photos, comments, likes, follows. The photos and text of your posts (caption, location tag, hashtags) are stored on Cloudflare under an unguessable name and shown from there to people who see the post; when you edit a post its previous text is deleted shortly after, and when you delete a post it is deleted together with its photos and text.
• Messages: direct messages and the photos and files sent in messages are end-to-end encrypted. Our servers relay and store messages only in encrypted form and know who wrote to whom and when. Emoji reactions to messages and read, delivered and viewed receipts are not encrypted. If you report a message, that message and up to 5 messages before it (with the photo, if it is one) are sent from your device in readable form for review; once the report is resolved they are deleted after 180 days, except for child-safety reports, which are not deleted after a set time and are kept until the reporting or reported account is deleted. How password recovery works and its limits: section 8.
• Location (only if you allow it): approximate location for your city and Nearby People. Your precise location is not stored; other users never see your location, only an approximate distance. You can withdraw the permission at any time in your device settings.
• Technical: notification token, app crash reports, security issues detected on your device (e.g. a modified app, root / jailbreak, a debugger) and, for security, the IP address used at sign-up.
• Account security: a hash of a random identifier unique to your app installation (not the identifier itself) and your connection IP address. Used only to detect fake accounts and banned accounts coming back; kept for 90 days and never used for ads.
• Support: requests you send from Settings › Help & support, screenshots you attach (visible only to the support team), your app version and device type.
• Sign-up statistics: which app screens were reached before creating an account (launch, sign-in, sign-up), recorded only with the installation identifier hash; it does not identify you and is used only as aggregate counts.

We do not ask you for special categories of personal data (e.g. health, religion, political opinions, ethnic origin). If you reveal such information in your own posts, it is shown only to the audience you choose and is not processed for any purpose other than providing the service.

2. Purposes and legal bases

• Creating your account, providing the service and delivering your posts and messages: entering into and performing our contract with you (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Protecting accounts and the community; preventing spam, fake accounts, fraud and abuse; keeping the service secure and improving the app: our legitimate interests (KVKK Art. 5(2)(f); GDPR Art. 6(1)(f)). We make sure these interests do not override your rights and freedoms, and you can object to this processing (section 7).
• Optional features such as location, personalised ads and notifications: your consent (KVKK Art. 5(1); GDPR Art. 6(1)(a)). You can withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.
• Our legal obligations and lawful requests from competent authorities (e.g. reporting child sexual abuse material): legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
• Establishing, exercising or defending legal claims (e.g. evidence in a dispute): KVKK Art. 5(2)(e); GDPR Art. 6(1)(f).

Your personal data is not sold.

3. Automated content moderation

• Shared photos and profile photos are scanned for nudity by an AI model running on our own servers. Photos are not sent to another company for this.
• If enabled, photos are sent to Microsoft PhotoDNA to match known child sexual abuse imagery.
• Post, comment and profile text is compared against a list of prohibited terms.
• As a result, content may be hidden or removed; your account may receive a warning or, for a period, be restricted from posting, commenting, messaging or appearing in Discover. Human moderators review suspicious content. Every decision about you is notified with its reason; you can appeal it and ask for the decision to be reviewed by a person (Settings › Account status).
• Encrypted messages are not scanned.

4. Service providers

Supabase (database, authentication), Cloudflare (storing photos and post text; relaying encrypted messages and storing encrypted message backups), Google Firebase (notifications, crash reports), Google AdMob (ads), Talsec (freeRASP, app security: results of device and app security checks — e.g. root / jailbreak, a modified app, a debugger —, device model, operating system and app version, and a device identifier not linked to your account; used to detect abuse and for the app's security report), a map and address service (based on OpenStreetMap) and, if enabled, Microsoft PhotoDNA. These providers act as processors: they process data only on our instructions and only to provide the service, under contracts that protect your data.

Apart from them, we share your data only: where the law requires it or in response to lawful requests from competent authorities; where necessary to protect the life or safety of a user or another person; and in a merger, acquisition or sale of Hivroj, provided the protections in this policy are kept. Your public profile and posts can be seen by other users according to the visibility you choose.

5. Ads and sponsored content

• The app shows Google AdMob ads. Your advertising identifier is used only to the extent you allow; you can turn it off in your device settings.
• Ads from brands Hivroj partners with are always labelled "Ad · Brand name". Our server decides which ad to show based on profile information such as your country, city, the languages you speak, your app language, your age range and gender. Ads are never targeted on the basis of sensitive information.
• Brands receive only aggregate numbers (impressions, clicks, breakdowns by country and language; groups smaller than 50 are merged). Your personal data is not shared with brands.
• To measure ads and avoid showing you the same ad too often, which ads you saw and tapped is kept for 35 days.

6. Retention

We keep your data only for as long as the purpose requires; after that we delete it, destroy it or make it anonymous.

• If you delete your account it is hidden immediately; unless you sign in again within 90 days, it is permanently deleted together with all your data.
• Disappearing messages and view-once photos are deleted when they expire.
• Photos and files sent in messages are deleted from our servers 90 days after upload; the message text is not deleted.
• Account security records (installation identifier hash, IP) are deleted after 90 days, ad impression records after 35 days.
• Support conversations are deleted 2 years, screenshots 180 days after the request is closed. Sign-up statistics are deleted after 180 days.
• Records subject to mandatory legal reporting (e.g. detected child sexual abuse material) and records we are legally required to keep are kept for as long as the law requires.

7. Your rights

Under Article 11 of the KVKK and the GDPR you have the right to: know whether and why your personal data is processed; access your data and get a copy; have incomplete or inaccurate data corrected; have your data erased or destroyed; restrict processing; object to processing based on legitimate interests; receive your data in a commonly used format and move it to another service; know the recipients your data has been transferred to; object to an outcome against you that results solely from automated analysis; and claim compensation if you suffer damage from unlawful processing.

• A copy of your data: Settings › Download my data.
• Correction: you can edit your profile at any time.
• Deletion: Settings › Delete account, or hivroj.com/delete-account.
• Appealing a moderation decision: Settings › Account status.
• Any other request: Settings › Help & support. We handle your request free of charge within 30 days at the latest. We may ask for additional information to verify your identity.

If you are not satisfied with our answer, you can complain to the Personal Data Protection Board in Turkey or, if you live in the European Union, to the data protection authority of your country.

8. Security

Data travels over encrypted connections and access is restricted; we take reasonable technical and organisational measures to protect your data. No system is completely secure; if a data breach affects you, we will inform you and the competent authorities within the time the law requires.

• Your messages are end-to-end encrypted; if you forget your password, you can recover them with your email.
• For this recovery, your account's message key is stored on our servers, encrypted with a separate secret key (the account vault). Anyone with access to both the database and that secret key — including Hivroj — can therefore open your messages and message backups. Someone who obtains only a copy of the database or only of the backup storage cannot; someone who can change the live database can, by taking over your account.
• Someone who takes over your Hivroj password, your email account or the Google / Apple account you sign in with can also open your messages on a new device. Keep them safe.
• The message key belongs to your account and is not renewed automatically over time: anyone who obtains it can also open your earlier messages.

9. Google sign-in and Google user data

• With Google sign-in we receive only your name, email address, profile photo and Google account ID from Google. They are used only to create your account, sign you in and set up your profile.
• Hivroj's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This information is not used for advertising, is not sold, and is not transferred to third parties except as needed to provide the service.
• You can remove Hivroj's access at any time in your Google Account settings (Security › Third-party apps).

10. International transfers

Your data is stored on servers in the European Union (Ireland). Our service providers (section 4) may also process data in other countries. Transfers out of Turkey are made in line with Article 9 of the KVKK and, where there is no adequacy decision, with appropriate safeguards such as the standard contracts set by the Personal Data Protection Board. Transfers outside the European Economic Area rely on European Commission adequacy decisions or standard contractual clauses.

11. Age limit

Hivroj is for people aged 18 and over. If we learn that an account belongs to someone under 18, we close it and delete its data. You can report such an account to us from Settings › Help & support.

12. Changes

We may update this policy when the service or the law changes. The current version is always published in the app and at hivroj.com/privacy, with the date of the last update at the top. We announce significant changes in the app before they take effect, and where a new kind of processing needs your consent we ask for it separately.

13. Scope of this policy

This policy applies only to Hivroj. Other sites and services you open from Hivroj (e.g. Google sign-in, advertisers' pages) have their own privacy policies.

14. Data controller and contact

Data controller: Hivroj.

For privacy questions, requests under the KVKK and GDPR and anything else: in the app under Settings › Help & support. We respond to your requests within 30 days at the latest.