Privacy Policy

Data Controller

FLASHER TEKNOLOJİ ANONİM ŞİRKETİ

Address

Gülbahçe Mah. İçmeler Cad. No: 14/1, Inner Door No: B05, 35433 Urla / İzmir, Türkiye

Contact

contact@flasher.com.tr

1. Summary — Flasher privacy in 30 seconds

• Messages are auto-deleted after 1 hour (Firestore TTL). Even if you leave a pool, your prior messages still expire on the same schedule.
• Every message you send is anonymous (e.g. "Anonymous A1B2"). A different anonymous ID is generated per pool — you cannot be tracked across pools. There is no feature that reveals your identity to other users.
• There are no in-app purchases. Your first message in each pool is free; every message after that spends a message credit you earn by completing surveys (Section 7).
• Your location is processed only while the app is open, for two distinct purposes. For pool matching the raw coordinate never leaves your device: it is rounded on-device into a map cell roughly the size of a city block, and only that cell identifier is sent to the backend. For determining your neighbourhood the raw coordinate is sent to our server and forwarded to Google's address resolution service; the coordinate itself is never stored (Sections 6 and 9).
• When you connect to the app, a traffic record (your user identifier, IP address, current map cell, and timestamp) is kept for 1 year as required by Turkish Law No. 5651 (Sections 6 and 8).
• We do not sell to ad networks. We do not use third-party advertising tracking SDKs.
• You can delete your data at any time — Profile → Delete account.

2. Who we are

This app is operated by FLASHER TEKNOLOJİ ANONİM ŞİRKETİ, a joint-stock company registered in Türkiye.

• Contact: contact@flasher.com.tr
• Registered service address: Gülbahçe Mah. İçmeler Cad. No: 14/1, İç Kapı No: B05, 35433 Urla / İzmir
• VERBİS (Turkish Data Controllers' Registry) registration status: Exempt from registration (below the employee-count and annual balance-sheet thresholds set by the Personal Data Protection Board)

Throughout this policy, "Flasher", "we", "our" refers to the data controller above.

3. Applicable laws

• Personal Data Protection Law (KVKK) — Turkey
• General Data Protection Regulation (GDPR) — for users in the European Union
• Apple App Store Privacy Guidelines

All Firebase services (Authentication, Firestore, Cloud Functions, Cloud Messaging) run in Frankfurt (europe-west3). Data is processed within the European Union.

4. What data we collect

A. At account creation

• Display name — stored in your profile and shown only to you; it is never shown to other users in pools
• Birth year — for age verification, NOT full date of birth
• Gender — optional; used only for the colour coding in the pool radar view, never displayed as text
• Phone number — only when registering via phone OTP; stored by Firebase Authentication
• Apple or Google account identifier — only when using social sign-in

B. While using the app

• Location — map cell — only while the app is open; the cell identifier computed on your device, used for pool matching (Section 6)
• Location — raw coordinate — only when your neighbourhood is determined; sent to our server, forwarded to Google's address resolution service, then discarded without being stored (Sections 6 and 9)
• Neighbourhood identifier — determined on the server from your location, so you can receive municipal announcements and emergency alerts (Section 4.C)
• APNs / FCM push token — to deliver notifications; one document per device
• Messages — text you write into pools, with a 1-hour TTL
• Survey answers — which survey, which option index you picked for each question (the index, not the option text), the time you answered, and the credits granted. The version linked to your account is readable only by you (Section 7)
• Message credit balance and daily earning counter — to enforce the daily earning cap
• Connection (traffic) records — your user identifier, IP address (and proxy chain), current map cell and timestamp, kept under Turkish Law No. 5651 (Sections 6 and 8)
• Block, report and moderation records — for safety (Section 8)

C. Neighbourhood and municipal notifications

The app includes a notification channel that delivers local government announcements and emergency alerts to the correct neighbourhood.

• Your neighbourhood is determined solely from your location, on the server. There is no neighbourhood picker in the app, and the server does not accept a neighbourhood identifier sent by the client. Your neighbourhood changes only when you physically move; a 1-hour cooldown applies between changes. The result is stored on your account.
• The notification subscription is set up at neighbourhood level (FCM topic subscription). The municipality cannot see individual subscribers; it only broadcasts to a neighbourhood.
• Your identity, location and contact details are never transferred to the municipality. On the municipality's side only the target neighbourhood and an aggregate count are visible.
• If the number of subscribers in a neighbourhood is below the privacy threshold, no count is shown; the notification is still delivered.
• You can unsubscribe from the neighbourhood if you do not want announcement and emergency alert notifications.

D. What we DO NOT collect

• ❌ Profile photo (not a feature of the app)
• ❌ Background location tracking (the permission is "While Using the App"; no location is read while the app is closed)
• ❌ Raw coordinate history — latitude/longitude is never written to any record. A history does accumulate at map-cell level in the connection records; we describe that openly in Sections 6 and 8.
• ❌ Payment or card details — there are no in-app purchases, so we process no payment data at all
• ❌ Third-party advertising identifiers (IDFA; ATT prompt is never shown)
• ❌ Cross-app analytics (no Facebook Pixel, Mixpanel, etc.)
• ❌ Contacts, camera, microphone, health data

E. Which processing rests on which legal basis? (KVKK Arts. 5-6)

We process no special categories of personal data. The gender field is used in the app only for colour coding in the pool view and is optional.

5. How are messages stored?

Message content is never written to backups or log files. Cloud Functions logs include only short UID hashes and message identifiers — never message body.

Push notification payloads do not contain message content — only a generic "New message in nearby pool" notice. Your lock screen does not display message contents.

6. How we process location

Location is captured only while the app is open ("While Using App" permission is sufficient — we never request "Always"). Your location is processed for two different purposes in two different forms, and the distinction matters:

6.1 Pool matching — the raw coordinate never leaves your device

• The device computes a map cell identifier (H3, resolution 10) from the raw fix. That cell is roughly the size of a city block: about 70 metres along one edge, with a widest corner-to-corner span of about 164 metres.
• Only the cell identifier is sent to the backend; in this flow the actual latitude/longitude is not sent to our servers.
• Users in the same cell are placed in the same pool.
• If the number of people in a cell is below the privacy threshold, no pool opens; the search radius widens step by step until the threshold is met.

6.2 Neighbourhood determination — the raw coordinate does go to our server and to Google

• Determining your neighbourhood is a separate operation, and here full-precision latitude/longitude is sent to our server.
• The server forwards that coordinate to the Google Geocoding (address resolution) service and matches the returned address components against a neighbourhood catalogue. This constitutes a transfer of personal data abroad (Section 9).
• Only the resulting neighbourhood and district identifiers plus a confirmation timestamp are written to your account. The raw coordinate is stored neither by us nor in any log — it is discarded once the lookup completes.
• You cannot pick your neighbourhood in the app; the server determines it (Section 4.C).

6.3 Connection (traffic) records — a history does accumulate at cell level

• When you connect and whenever your map cell changes (at most once every 10 minutes), a connection record is written: your user identifier, IP address, proxy chain, map cell identifier and timestamp.
• These records are kept because of the traffic-record obligation under Turkish Law No. 5651 on the Regulation of Publications on the Internet, and are deleted automatically after 1 year.
• The record contains no raw coordinate — it contains a cell identifier. Even so, read together these records form a movement history at map-cell resolution. We do not claim that "no location history is kept" — this is the history we keep.
• These records are not linked to your messages and are closed to the client; they are used only upon a lawful request from a competent authority and for the period stated in Section 8.
• Because they are kept under a legal obligation, they survive account deletion until their retention period expires (Section 14).

7. Anonymous messaging, surveys and message credits

7.1 Anonymity

• Each pool assigns you a pool-specific random anonymous ID (derived via SHA-256)
• The same user receives a different anonymous ID in different pools — observers cannot track you across pools
• Your dot position on the radar is mixed with a per-session random salt; the position changes when you relaunch the app
• There is no identity reveal feature. Your display name, initial and birth year are never shown to other users in any message or on the radar; every message is sent under an anonymous alias. (Earlier versions had a paid "reveal" feature; it has been removed.)
• Timed photos. If you take a screenshot of a timed photo, your name is shown to the person who sent it.

7.2 Message credits — no in-app purchases

• Your first message in each pool is free. Every second and subsequent message in the same pool spends one message credit.
• The only source of credits is completing surveys. There is no in-app purchase, subscription or any other payment path.
• A single survey grants at most 5 credits; a user can earn at most 10 credits per day.
• Your credit balance is held on your account. It is not money, cannot be redeemed for cash, cannot be transferred, and is destroyed when your account is deleted.

7.3 Survey answers and transfer to the publishing organisation

• Your survey answers (which option you picked for each question) are personal data and are stored against your account. That version is readable only by you; the organisation that published the survey has no access to it.
• The publishing organisation receives only aggregate counters: the number of respondents and how many times each option was selected per question. Who answered what is never recorded anywhere.
• The aggregate result is not disclosed to the organisation at all until at least 20 people have taken the survey, and thereafter it is only updated in steps of 20 respondents. This prevents the difference between two readings from being reduced to one person's answers.
• This is a third-party transfer and is also listed in Section 9.

8. Data retention periods

Because the app has no in-app purchases, we hold no payment or purchase records. Any records left over from the earlier paid period are covered by the account deletion flow (Section 14).

9. With whom do we share data?

• Google (Firebase) — Infrastructure / data processing (europe-west3, EU). Acts as Data Processor under the Google Cloud Data Processing Addendum.
• Google Maps Platform — Geocoding API — full-precision latitude/longitude is transferred in order to determine your neighbourhood (Section 6.2). Because the service may process it outside Türkiye and the EU, this is a transfer abroad.
• Apple — Apple account identifier for Sign in with Apple, plus a device token for device attestation (App Attest / DeviceCheck). No payment data is transferred — there are no in-app purchases.
• Apple Push Notification Service (APNs) — Delivery infrastructure for push notifications; your notification token and the notification body are transmitted to Apple. This is also a transfer abroad.
• The organisation publishing a survey — only identity-free aggregate survey results, in buckets of at least 20 respondents (Section 7.3). Who answered what is never transferred.
• Municipality / local government — no personal data is transferred; only a broadcast to a neighbourhood, with an aggregate count visible above the threshold (Section 4.C).

Transfers abroad (KVKK Art. 9)

Of the transfers above, Google Maps Platform, Apple and APNs involve data leaving Türkiye. Under KVKK Art. 9, these transfers are made because they are necessary for the service to function, relying on the providers' standard data protection commitments (Google Cloud Data Processing Addendum, Apple's data processing terms). The Firebase services themselves run in Frankfurt (europe-west3) and remain within the EU.

We do not use:

• ❌ Advertising networks (Google AdMob, Meta Audience Network, etc.)
• ❌ Data brokers
• ❌ Marketing automation platforms
• ❌ Facebook Pixel, Mixpanel, Amplitude, Segment or similar analytics SDKs

We do not sell your data.

10. Your KVKK rights (Turkey)

Under KVKK Article 11:

• Learn whether your personal data is processed
• Learn the purpose if processed
• Know third parties to whom data is transferred (domestically or abroad)
• Request correction of incomplete/inaccurate data
• Request deletion within the scope of the law
• Request that corrections/deletions be communicated to recipients
• Object to outcomes derived solely from automated analysis
• Claim compensation for damages caused by unlawful processing

Send requests to contact@flasher.com.tr. We respond within 30 days.

11. Your GDPR rights (EU)

Under GDPR Articles 15-22:

• Access — Request the data we hold about you (in-app: Profile → Export my data)
• Rectification — Correct inaccurate data (in-app: Profile → Edit name)
• Erasure (right to be forgotten) — Delete your account (in-app: Profile → Delete account)
• Portability — Export your data as JSON
• Objection — Ask us to stop certain processing
• Complaint — Lodge a complaint with the competent data protection authority

12. Children's privacy

Flasher is intended for users 18 and older. We verify birth year at registration (accepted range: 1925-2008; 2008 and earlier means 18+ in 2026). Accounts identified as under 18 are deleted immediately.

13. Cookies and tracking technologies

The mobile app does not use cookies. The app does not request IDFA; the App Tracking Transparency prompt is never shown.

There are no tracking SDKs (Facebook Pixel, the tracking mode of Google Analytics for Firebase, etc.).

14. Account deletion — KVKK Art. 7 / GDPR Art. 17

Deletion initiated via Profile → Delete account:

1. All pool memberships and your radar presence are deleted

2. All messages you sent (paginated) are deleted

3. Your blocked-user list and its server-side derivative are deleted

4. Your survey answers are deleted

5. Your neighbourhood posts and neighbourhood notification records are deleted

6. Your reports are deleted; reports and moderation records about you are anonymised

7. Your push token records are deleted

8. Your profile document (display name, birth year, gender, neighbourhood, credit balance) is deleted

9. An audit log entry is written (KVKK Article 12 — proof of deletion); that entry is kept for 365 days

10. Finally, your Firebase Authentication record is deleted

The one category that is not deleted: the connection (traffic) records kept under Law No. 5651. Because they exist to satisfy a legal obligation, account deletion does not remove them; they are deleted automatically once their own 365-day retention period expires (Sections 6.3 and 8).

Apart from that, the operation is a hard delete — it is not reversible. A 30-day cooldown for accidental deletions is not currently implemented; it is on the v1.1 roadmap.

15. Security

• All connections encrypted with TLS 1.3
• We do not store passwords — sign-in is via Firebase Authentication using phone OTP, Sign in with Apple, or Sign in with Google
• The Apple user ID is stored in the device Keychain (so it does not appear in plaintext in iCloud backups)
• Cloud Functions logs store UIDs as short hashes (SHA-256 + salt); plain UIDs, emails, or phone numbers are never logged
• Crashlytics receives only a hashed user identifier, never raw UID
• In case of a data breach, we notify the competent authority and affected users within 72 hours (KVKK Art. 12 / GDPR Art. 33)

16. Policy changes

If this policy changes:

• We notify in-app
• We give at least 30 days advance notice
• We request renewed consent for material changes

17. Contact

• Data controller: FLASHER TEKNOLOJİ ANONİM ŞİRKETİ
• Email: contact@flasher.com.tr
• Support: contact@flasher.com.tr
• KVKK Authority (Turkey): kvkk.gov.tr
• Apple App Store: apple.com

This policy is published in Turkish and English. In case of interpretive differences the Turkish version prevails (we operate under Turkish law).