01Scope

This Privacy Policy explains, for your use of the WLogy mobile app (the “App”) and the server services the App relies on (the sign-in, notification and ad reward services and this web page), for what purposes and on what legal grounds your personal data is processed, how and with whom it is processed, how long it is kept and what rights you have.

This Policy is based on the Turkish Personal Data Protection Law No. 6698 (“KVKK”) and its secondary legislation and, for users in the European Economic Area (“EEA”), the United Kingdom and Switzerland, on the EU General Data Protection Regulation (“GDPR”) and similar laws. Users in Türkiye are also provided with a KVKK Notice; the two documents should be read together.

This Policy is not a contract and is not used to obtain your consent. The legal ground for each processing activity is set out below; processing that requires your explicit consent only takes place with consent you give separately.

02Data controller and contact

The controller of your personal data is Talha Berat Turgut, operating under the GemitryLabs brand (“GemitryLabs” or “we”). GemitryLabs has not yet been incorporated as a company; once it is, the controller details will be updated and the change will be announced in the App.

For any question or request about privacy and your personal data, contact us at: wlogyapp@gmail.com

03Personal data we collect

• Account and identity data: your email address, username, display name, bio, profile photo, user ID (UID) and account creation date. We never see or store your password; it is kept by Firebase Authentication in an irreversibly hashed form.
• Preferences and declarations: your language, region (Türkiye or Europe), theme, notification mode, read receipt and watchlist sharing settings; your declaration of whether you are over 18 (we do not ask for your date of birth and only store “over 18: yes/no”); your answers to the welcome survey, the genre interest scores calculated from them and your “cinema soul” label.
• In-app activity and content: your swipe reactions (like, dislike, neutral), logs, ratings, reviews, “favourite moment” notes, ticket and ticket design choices, folders and watchlist, showcase, followed studios, achievements, achievement points and leaderboard rank, daily streak, night owl and similar ritual records, cinema fortune, film passport and year-end summaries.
• Social interactions: friend requests, friends, people you block, likes, comments, chat rooms and messages, read and seen times, watch-together sessions, list games and their results, reports you submit.
• Match (Box Office) data (only for users who declare they are over 18 and choose to be visible in the Box Office): your match profile (genre interests, liked titles, cinema soul, region), invites and super invites you send and receive, people you “pass” on and your free Match usage.
• Technical and security data: session tokens, app integrity verification results (Firebase App Check / Google Play Integrity), timestamps used to prevent abuse (rate limits), counter and points verification records and your notification address (push token).
• Advertising data (for users without W+): your device’s advertising ID, IP address, device and app information, your interactions with ads and your ad consent choices; this data is processed by Google AdMob. We keep your rewarded ad records (day, count and transaction numbers).
• Searches and content requests: the words you type when searching for films, series, people and studios are sent to TMDB; these searches are not saved to your account.
• Your communications with us: when you email us, your email address, name and the content of your message.

04How we obtain data

• Directly from you: through sign-up, the welcome survey, profile editing, the content you create, your settings and the messages you send us.
• Automatically while you use the App: activity records, timestamps, session and app integrity information.
• From other users: friend requests, invites, messages and comments sent to you, and reports made about you.
• From service providers: the app integrity result from Google and Google’s confirmation that you watched a rewarded ad to the end.

05Data we do not collect

WLogy does not collect your location (by GPS or similar means; your region is only what you choose), your contacts, microphone recordings, your date of birth, identity number or payment card details. It does not aim to process special categories of personal data such as health, religion, political opinions, sex life, biometric or genetic data.

The camera is only used when you open it, and only to scan a friend’s QR code; the image is processed on your device, is not saved and is not sent to us. Your photos are only accessed when you pick a profile photo, and only the single image you choose; the image is saved in a reduced size.

We recommend that you do not write special category information in your reviews, messages or bio. If you do, it is processed as content you have made public in public areas, or shared with the other person in chats.

06Data that stays on your device

Some information is kept only on your device and is never sent to us: your language, theme, reduce motion, read receipt, personalized ads and discovery filter preferences; unread message and unseen activity markers; session reminders and the automatic reminder plan (local notifications); tours you have seen; fortune and anniversary display records; and the list of accounts opened on this device (username and display name) and their sessions.

This data is deleted when you uninstall the App or clear the App’s data in your device settings.

07Purposes and legal grounds

We process your personal data only for the following purposes and on the legal grounds stated for each (KVKK Article 5 and GDPR Article 6):

• Creating your account, letting you sign in and managing your account: entering into and performing a contract (KVKK Art. 5/2-c; GDPR Art. 6/1-b).
• Providing the App’s features (cards, logs, social feed, friends, chat, Match, games, achievements, leaderboard, notifications): performance of a contract (Art. 5/2-c; Art. 6/1-b).
• Showing your public profile information and the content you share to other users: performance of a contract and data made public by you (Art. 5/2-c, d; Art. 6/1-b).
• Calculating recommendations and compatibility scores that suit your taste: performance of a contract and legitimate interests (Art. 5/2-c, f; Art. 6/1-b, f).
• Keeping the service secure and preventing cheating and abuse (rate limits, counter verification, app integrity): legitimate interests (Art. 5/2-f; Art. 6/1-f).
• Reviewing reports, acting on content and accounts that break the rules and protecting our rights in legal disputes: establishment, exercise or defence of a right and legitimate interests (Art. 5/2-e, f; Art. 6/1-f).
• Showing non-personalized ads to users without W+ and granting rewarded ad bonuses: performance of a contract (in return for the free service) and legitimate interests (Art. 5/2-c, f; Art. 6/1-b, f).
• Showing personalized ads: only with your explicit consent (KVKK Art. 5/1; GDPR Art. 6/1-a).
• Answering your requests, complying with our legal obligations and responding to requests from competent authorities: legal obligation (Art. 5/2-ç; Art. 6/1-c).

You have the right to object to processing based on legitimate interests (see Your rights). We do not sell or rent your data or give it to third parties for marketing. Apart from advertising, we do not use any third-party analytics or tracking tools.

08Recommendations, compatibility scores and automated processing

The card deck recommends titles to you by calculating genre interest scores from your survey answers and swipe reactions. In the Box Office, your taste compatibility percentage with other users is calculated by comparing both sides’ genre interests and liked titles. These calculations are mostly performed on your device.

This processing only decides which titles and people are shown to you first; no solely automated decision is taken that produces legal effects concerning you or similarly significantly affects you. You can object to this processing and switch off your Box Office visibility at any time.

09Who sees what

• All users signed in to WLogy: your username, display name, profile photo, bio, cinema soul, counters, achievement points and badges, W+ mark, showcase, logs, ratings, reviews, favourite moment notes, comments and likes, and your leaderboard rank.
• Only your friends: your default watchlist (if sharing is on; you can turn it off in Settings > Privacy).
• Only members of a chat room: messages, watch-together and game cards, read receipts (if your read receipt setting is on).
• Only users over 18 who are visible in the Box Office: your match profile (only if you are also over 18 and have turned visibility on).
• Only W+ members who send you an invite: the moment you saw their invite (if your read receipt setting is on).
• Only you: your email address, preferences, folders, the people you block, your rewarded ad records and your notification address.

Your email address is never shown to other users. People you block cannot chat with you or send you invites.

10Chats and messages

Your messages and chat cards are stored on Google Firebase servers and encrypted in transit (TLS), but they are not end-to-end encrypted. We do not read your messages for advertising or profiling; we may only review the necessary part of a message when it is reported or when a legal obligation arises.

If your notification mode allows it, a new message notification carries the sender’s name and the beginning of the message to your phone through notification services (Expo and Google Firebase Cloud Messaging).

When you delete your account, the messages you sent may remain in the other person’s room under the name “Deleted user”, because they are also part of that person’s conversation record. If you would like these messages deleted too, write to wlogyapp@gmail.com; we will consider your request together with the other person’s rights.

11Ads

If you are not a W+ member, you may see ads in the Feed, Cards and Explore; you can also choose to watch an ad to the end in the Box Office to earn an extra Match. No ads are shown in chats, profiles, the welcome flow or tours. Ads are served by Google AdMob, a service provided by Google Ireland Limited and Google LLC.

• To show and measure ads, prevent fraud and, if you have agreed, personalize them, Google processes data such as your device’s advertising ID, IP address, device model, operating system, app information and your interactions with ads. Google’s use of this data for its own services is governed by Google’s policies: policies.google.com/technologies/partner-sites
• Personalized ads are only shown with your explicit consent. If you are in the EEA, the United Kingdom or Switzerland, your consent is collected through Google’s consent message and can be changed in Settings > Privacy > Ad consent. In other regions, the Settings > Privacy > Personalized ads switch is off by default; ads are not personalized unless you turn it on.
• Users under 18 only see non-personalized ads subject to an age-appropriate content rating.
• You can reset or delete your advertising ID in your phone’s settings (on Android: Settings > Google > Ads).
• When you watch a rewarded ad to the end, Google notifies our server together with your user ID (UID) and a transaction number. This information is only used to grant your reward, to prevent the same ad being counted twice and to enforce the daily limit (at most 3 per day).
• Your email address, username, logs and messages are not shared with the ad network.

12Notifications

• Local notifications (fortune, streak and nudge reminders, session reminders) are scheduled entirely on your device; no data is sent for them.
• For remote notifications (friend requests, invites, messages, likes, replies, friends’ logs and studio news), your device’s notification address (Expo push token) is saved in the part of your account only you can access. When an event happens, our server service checks that the event is genuine, your notification mode and any blocks, and delivers the notification through the Expo Push Service and Google Firebase Cloud Messaging. The notification text may include the sender’s display name, a title or the beginning of a message.

You can change your notification mode in Settings > Sound desk; in Silent Screening mode no notifications reach your phone. You can also turn off notification permission in your phone’s settings. Your notification address is deleted when you sign out, switch accounts or delete your account. Remote notifications are currently only available on Android.

13Service providers

Your personal data is shared with the following service providers only so that they can provide services to us, and only as far as necessary:

• Google Ireland Limited / Google LLC: Firebase Authentication (accounts and sign-in; email, password hash and sign-in records; global servers including the US), Cloud Firestore (the database where App data is stored; European Union multi-region “eur3”, Belgium and the Netherlands), Firebase App Check and Google Play Integrity (verifying that the app and device are genuine), Firebase Cloud Messaging (Android notification delivery), Google AdMob and Google User Messaging Platform (ads and ad consent).
• Cloudflare, Inc.: our server services running on Cloudflare Workers. The sign-in service matches the email and checks the password when you sign in with a username; it does not store your password or email. The notification service verifies and sends remote notifications. The ad service verifies rewarded ads. This web page is also hosted on Cloudflare Pages. Cloudflare may briefly process technical connection data such as IP addresses to keep the service secure.
• 650 Industries, Inc. (Expo): delivering your notification address and notification content to your phone through the Expo Push Service (US).
• TMDB (The Movie Database): information and images for films, series, people and studios. The App requests this information directly from your device; your IP address, language and region preference and, when you search, your search words reach TMDB. Your account details are not shared with TMDB. Streaming availability information comes from JustWatch through TMDB.

For Google AdMob and Google Play Integrity, Google may also act as an independent controller under its own policies. When the App is distributed through Google Play, downloads and store transactions are governed by Google Play’s own privacy policy.

Otherwise, your personal data may only be disclosed to competent public authorities and courts, as required by our legal obligations and to the extent requested.

14International transfers

Because our service providers’ servers are located outside Türkiye, mainly in the European Union and the United States, your personal data is transferred abroad. The App database is hosted in the European Union (Belgium and the Netherlands); for authentication, notification and advertising services, data may also be processed in the US.

For users in Türkiye, these transfers are made in accordance with KVKK Article 9 by providing one of the appropriate safeguards set out in the law for countries without an adequacy decision, primarily the standard contracts published by the Turkish Personal Data Protection Board. For users in the EEA, the United Kingdom and Switzerland, transfers to the US rely on the adequacy decision under the EU–US Data Privacy Framework for certified providers and otherwise on the European Commission’s standard contractual clauses.

You can request information about these safeguards, or a copy of them, at wlogyapp@gmail.com.

15Retention periods

• Account, profile, preferences and in-app content: for as long as your account is open; deleted immediately when you delete your account.
• Deleted data: removed from the live database immediately; the database’s technical version history is fully cleared within one hour at the latest. No regular database backups are taken.
• Your notification address: until you sign out, switch accounts or delete your account.
• Rate limit and verification records: updated with each action while your account exists; deleted with your account.
• Rewarded ad records: only the current day’s record is kept and it is overwritten by the next day’s first reward; deleted with your account.
• People you “pass” on in the Box Office: one week.
• Reports: for at most two years after the review is concluded; deleting the reporting or reported account does not in itself delete the report.
• Chat messages you sent: may remain in the other person’s room even if your account is deleted (see Chats and messages).
• Rating averages of titles: become anonymous when your account is deleted, so they can no longer be linked to you, and may be kept indefinitely.
• Email correspondence with us: for at most two years after your request is concluded.
• Technical logs kept by Google, Cloudflare and Expo themselves: according to each provider’s retention policies.

If a legal obligation or an ongoing dispute requires us to keep certain data longer, we keep only the data that is needed, only for as long as needed, and with restricted access. Data whose period has ended is deleted or anonymised.

16Deleting your account

You can delete your account at any time from the “Danger zone” at the bottom of Settings by confirming your password. Deletion covers: your profile, private account information, username and email records, profile photo, your logs and the likes and comments on them, the likes and comments you left on others’ logs, your swipe reactions, folders and watchlist, followed studios, achievements, friendships, requests and blocks, invites, match profile, fortune and showcase records, game and room statistics, rewarded ad records, verification records and your Firebase Authentication account.

The following are not deleted: your messages in other people’s rooms (under the name “Deleted user”), anonymous rating averages of titles and reports (for the period stated in Retention periods). To remove the local data on your device, uninstall the App.

If you cannot access the App, you can also request the deletion of your account and data by writing to wlogyapp@gmail.com from the email address registered to your account. Your request will be fulfilled within 30 days at the latest after your identity is verified.

17Your rights

Under KVKK Article 11, you have the right to learn whether your personal data is processed; to request information if it has been processed; to learn the purpose of processing and whether the data is used in line with that purpose; to know the third parties in Türkiye or abroad to whom your data is transferred; to request correction if your data is incomplete or inaccurate; to request deletion or destruction under the conditions in KVKK Article 7; to request that these actions be notified to the third parties to whom your data was transferred; to object to a result against you arising from the analysis of your data exclusively by automated systems; and to claim compensation for damage arising from unlawful processing.

If you are in the EEA, the United Kingdom or Switzerland, under the GDPR you also have the right to access your data, to have it corrected, to have it erased (“right to be forgotten”), to restrict processing, to receive your data in a structured, commonly used and machine-readable format and to transfer it to another service (data portability), to object to processing based on legitimate interests, to withdraw your consent at any time (withdrawal does not affect the lawfulness of earlier processing) and to lodge a complaint with the data protection authority of your country.

You can exercise most of these rights directly in the App: profile editing, privacy settings, Box Office visibility, ad consent and account deletion. For other requests, write to wlogyapp@gmail.com. So that we can verify your identity, we ask you to send your request from the email address registered to your account. Requests are handled free of charge within 30 days at the latest. Details of the application procedure are in the KVKK Notice.

18Children and teenagers

WLogy is not designed for children under 13; under the Terms of Use, children under 13 may not use the App. If we learn that we are processing data belonging to a child under 13, we will delete the account and data without delay. Parents or guardians who notice such a case can contact us at wlogyapp@gmail.com.

Users under 18 cannot use Match or the Box Office, no match profile is created for them and they are not shown to other users in the Box Office; they only see non-personalized, age-appropriate ads. Age is based on the declaration on the welcome screen; no date of birth is requested. A false age declaration breaches the Terms of Use.

In the EEA, the age of consent for digital services ranges from 13 to 16 depending on the country. If you are below that age in your country, you should use the App with the permission of your parent or guardian.

19Security

• All communication between the App and the servers takes place over encrypted connections (TLS).
• Database security rules only allow each user to change their own data and to read data they are authorized to see; counters and points are verified on the server side.
• Rate limits are applied against abuse and an app integrity verification (App Check) infrastructure is in place.
• Email addresses are not kept public; when you sign in with a username, the email is only matched if the password is correct.
• Our server services run with separate service accounts that have only the narrowest permissions their job requires, and they do not write personal data to their logs.

No system is completely secure. If we learn that your personal data has been obtained by others unlawfully, we will notify the Turkish Personal Data Protection Board as soon as possible and within 72 hours at the latest, as required by KVKK Article 12/5, and will also notify the affected users. We recommend that you never share your password and that you choose a strong password you do not use for other services.

20Third-party links and content

The App contains links to third-party services such as TMDB, JustWatch, Instagram and advertisers’ websites. When you tap these links, the privacy policy of that service applies; we are not responsible for those services’ data processing. Reviews, comments and messages shared by other users are their responsibility.

21W+ membership and payments

Your W+ membership status and end date are stored in your account and can only be changed by the server. The payment system is not yet available. When it opens, purchases will be made through the app store (Google Play or the App Store); your card details will never reach us, and only information about your subscription status (whether it is active, its end date and a transaction ID) will be processed. The service providers used for payments will be added to this Policy and the change will be announced before it takes effect.

22Changes

We may update this Policy to reflect changes in the App or in the law. The current version is always published in the App (Settings > Privacy and data protection) and on our web page, and the “Last updated” date at the top changes. We announce updates that significantly change how your data is processed in the App before they take effect; if a new activity requires your explicit consent, your consent will be requested separately.

23Contact and complaints

For any privacy question, request or complaint: wlogyapp@gmail.com

If you believe your request was rejected, our answer was insufficient or we did not answer in time, you can lodge a complaint with the Turkish Personal Data Protection Board (kvkk.gov.tr); a complaint to the Board requires that you first apply to us (KVKK Article 14). If you are in the EEA, you can lodge a complaint directly with the data protection authority of your country (for example, the Agencia Española de Protección de Datos in Spain).

01Data controller

Under the Turkish Personal Data Protection Law No. 6698 (the “Law”), the controller of the personal data processed within the WLogy mobile app is Talha Berat Turgut, operating under the GemitryLabs brand. Contact: wlogyapp@gmail.com. The controller details will be updated if a company is incorporated.

02Purpose of this notice

This Notice is provided under Article 10 of the Law and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform, to inform you about the purposes for which your personal data is processed, to whom and why it may be transferred, the method and legal grounds of collection and your rights under Article 11 of the Law. More detailed information is available in the Privacy Policy.

03Categories of personal data processed

• Identity: username, display name, user ID (UID).
• Contact: email address.
• Visual records: profile photo.
• Customer transactions: swipe reactions, logs, ratings, reviews, comments, likes, folders and watchlist, showcase, achievements and points, streaks, games, invites, W+ membership status, rewarded ad records.
• User content and correspondence: chat messages, reports, emails sent to us.
• Preferences and profile: language, region, theme, notification mode, privacy settings, age declaration (over/under 18), personality survey answers and genre interests, cinema soul, match profile.
• Marketing: advertising ID and ad preferences (processed by Google AdMob), consent to personalized ads.
• Transaction security: session and authentication information, app integrity verification results, rate limit timestamps, counter verification records, notification address.
• Search: search words sent to TMDB (not stored by us).

Processing special categories of personal data is not intended.

04Purposes of processing

Your personal data is processed to run membership processes; provide the App’s services (recommendations, social feed, chat, matching, games, achievements, notifications); personalize the services; run information security processes; prevent cheating and abuse; manage complaints and requests; carry out advertising activities and grant rewarded ad bonuses; carry out communication activities; fulfil legal obligations and provide information to authorized persons, institutions and organizations; and protect rights in legal disputes.

05Legal grounds

• Processing is directly related to entering into or performing a contract (Art. 5/2-c): account, App features, social features, Match, notifications, rewarded ad bonuses and showing non-personalized ads.
• Processing is necessary for the controller to fulfil its legal obligations (Art. 5/2-ç): requests from authorities, answering data subject applications and data breach notifications.
• The data has been made public by the data subject (Art. 5/2-d): public profile information and shared content.
• Processing is necessary to establish, exercise or protect a right (Art. 5/2-e): report and dispute records.
• The controller’s legitimate interests, provided your fundamental rights and freedoms are not harmed (Art. 5/2-f): security, rate limits, cheating prevention, app integrity, calculating recommendations and compatibility scores.
• Explicit consent (Art. 5/1): personalized ads and, for users in the EEA, ad consent given through Google’s consent message.

If a user voluntarily writes special category information in their content, it is processed on the legal ground of having been made public by the data subject under Article 6/3 of the Law, and only in line with the purpose for which it was made public.

06Method of collection

Personal data is collected electronically, by fully or partly automated means, through the mobile app, in-app forms and settings, device permissions (camera, photos, notifications), our server services and the software development kits of our service providers (Firebase, Google AdMob, Expo), and by email when you email us.

07Recipients and purposes of transfer

• Service providers: Google Ireland Limited / Google LLC (hosting, authentication, notifications, app integrity and ads), Cloudflare, Inc. (server services and web page hosting), 650 Industries, Inc. (Expo; notification delivery) and TMDB (film information; only IP address, language and region preference and search words), for providing the service, hosting, security and advertising, in compliance with Articles 8 and 9 of the Law.
• Other users: by the nature of the App, your public profile and content are shown to your friends, chat room members and Box Office users as described in the Privacy Policy.
• Competent public authorities and courts: to fulfil legal obligations, when requested and limited to the request.

Personal data is not sold or rented to third parties for marketing.

08Transfers abroad

Because our service providers’ servers are located abroad, mainly in the European Union and the United States, your personal data is transferred abroad. The App database is hosted in the European Union (Belgium and the Netherlands); for authentication, notification and advertising services, data may also be processed in the US.

These transfers are made under Article 9 of the Law by providing one of the appropriate safeguards for countries without an adequacy decision, primarily the standard contracts published by the Board. Standard contracts are notified to the Turkish Personal Data Protection Authority within five business days of signature.

09Retention and destruction

Personal data is kept for as long as the purpose of processing requires and, as a rule, for as long as the account is open. When the account is deleted, the data is deleted or anonymised immediately; detailed periods are set out in the “Retention periods” section of the Privacy Policy.

When the reasons requiring processing cease to exist, personal data is deleted, destroyed or anonymised ex officio or upon request, in accordance with Article 7 of the Law and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.

10Your rights under Article 11 of the Law

By applying to the controller, you have the right to:

• learn whether your personal data is processed,
• request information if your personal data has been processed,
• learn the purpose of processing and whether the data is used in line with that purpose,
• know the third parties in Türkiye or abroad to whom your personal data is transferred,
• request correction if your personal data is incomplete or inaccurately processed,
• request the deletion or destruction of your personal data under the conditions in Article 7 of the Law,
• request that corrections, deletions and destructions be notified to the third parties to whom your personal data was transferred,
• object to a result against you arising from the analysis of the processed data exclusively by automated systems,
• claim compensation if you suffer damage due to unlawful processing of your personal data.

11How to apply

In accordance with the Communiqué on the Procedures and Principles of Application to the Data Controller, you can submit requests about your rights:

• by email to wlogyapp@gmail.com from the email address registered to the App,
• to the same address, signed with a secure electronic signature or mobile signature, or
• in writing (you can request our postal address for written applications at wlogyapp@gmail.com).

Your application must include your name and surname; your signature if it is in writing; your Turkish ID number if you are a citizen of Türkiye, or your nationality and passport or ID number if you are not; your residential or business address for notifications or your email address for notifications; your phone number, if any; and the subject of your request. Relevant information and documents are attached to the application.

Your application will be concluded free of charge as soon as possible and within 30 days at the latest, depending on the nature of the request; if the action requires an additional cost, a fee according to the tariff set by the Board may be charged. If your application is rejected, you find the answer insufficient or no answer is given in time, you can lodge a complaint with the Turkish Personal Data Protection Board within 30 days of learning of the answer and in any case within 60 days of the application date.

12Explicit consent and withdrawal

Processing based on your explicit consent: personalized ads outside the EEA (Settings > Privacy > Personalized ads; off by default) and ad consent given through Google’s consent message in the EEA (Settings > Privacy > Ad consent).

Explicit consent is consent that relates to a specific matter, is based on information and is given freely. Not giving consent does not prevent you from using the App’s core features. You can withdraw your consent at any time from the same setting; withdrawal does not affect the lawfulness of processing carried out before that date.

13Updates

This Notice is updated when there are changes in processing activities or in the law. The current version is published in the App (Settings > Privacy and data protection) and on our web page.