Privacy policy

Data controller

The data controller of this app is Orçun Özdemir, a natural person. You can send your requests under the Turkish Personal Data Protection Law (KVKK) to destek@slooin.com; your request is answered within 30 days at the latest.

1. Which of your data we process

Your e-mail address - today the PRIMARY identifier of your account. It is used when you sign up and sign in, and the verification code is sent there. If you sign in with Apple or Google, the identity token sent by the provider is used only to verify the sign-in and is not stored; your account ID at the provider and your e-mail address are linked to your account (if you chose "Hide My Email" with Apple, Apple's relay address). Google also passes on your name and the link to your profile photo; these stay only in the sign-in record and are not automatically copied to your profile. No phone number is requested or stored.

The city you live in: country, and in Türkiye also province and district. Asked when you create your account. If you allow it, your province and district are preselected based on your current location when you create your account; your location is not stored for this, and you confirm or change the selection. It is not shown on your profile and is never shown or passed to other users; it is included in your "Download my data" file. Purpose: to suggest popular places in your province when your location can't be reached (location permission off or location unavailable), and to know in which regions to improve the service.

Sponsored suggestions: cards labelled "Sponsored" are paid promotions by businesses and are always shown with that label. Sponsored suggestions based on the province and district where you live are made ONLY with your explicit consent (Settings › Privacy › Sponsored suggestions for you; off by default, you can withdraw it at any time, and each grant and withdrawal is recorded with its date). Without your consent, a sponsored card is chosen by the province and district you are in right now, and your location is not stored for this. Which sponsored card you saw or tapped is not recorded against you; only a one-way hash derived from your identity is kept so that the same ad is counted only once for you per day, and it is deleted the next day. Businesses only see daily totals of views and taps and the total number of check‑ins at the place during the campaign. None of your personal data is passed to businesses. If you tap the link on a sponsored card, the business's page opens in the in-app browser; that page is governed by the business's own privacy policy and Slooin sends no personal data to it. Link taps are also counted only as totals.

If you advertise (as a business): the place details and photos in your application (shown publicly on the place page once the ad goes live) and the payment record (Apple/Google transaction number). Apple or Google takes the payment; your card details never reach us. A promo video and link you add to your ad are shown to users while the ad runs; the video is deleted no later than 90 days after the ad ends or the application closes. If you advertise an event or a brand, the event name, date and location, or the brand name and logo, are also shown publicly with the ad.

Your name, username, date of birth, bio and profile photos.

Your location - in three different ways: when you search for a place, add a place or check in, your device location is sent to the server but NOT STORED; the check-in record stores the place's own location, not your exact location, and when the check-in turns into a memory (as soon as you tap "I left" or check in at another place, otherwise automatically 4 hours later at the latest) that is deleted too, and only the place you were at remains (full details below, in section 3).

The content of the messages you send and receive: text, photos, videos (up to 60 seconds), voice messages (up to 5 minutes; microphone access is only requested when you press the microphone) and locations you share (only when you send one, the point you choose). Photos, videos and voice messages in a chat can only be seen/heard by the two people in the conversation. Deleting a conversation removes it only on your side; the other person can still see the conversation and its files. When you block someone, the conversation between you is deleted on both sides and its files are permanently deleted by an hourly cleanup; files that were uploaded but never sent are deleted by the same cleanup. If you delete your account, the messages and files you sent are also deleted; what the other person wrote themselves stays. Your messages in a conversation that is the subject of a report not yet reviewed are kept as evidence until the report is decided, and are then deleted (section 6).

Your friendship data: your friends and friend requests, whom you exchanged chat requests with, whom you blocked.

Your device's notification token, so that we can send you notifications, and your device's language, to decide which language notifications are written in.

Your notification preferences (which notifications you receive, quiet hours at night) and, for quiet hours, your device's time zone. Session records of the devices you signed in from: device type, IP address and last activity time; you can view and close them one by one under Settings → Account and security → Active sessions. Your appearance (theme) preference is stored only on your device and never sent to the server. Your recent searches in Explore (up to 8) are also kept only on your device, separately for your account, and never sent to the server; you can clear them any time. The same applies to the people you recently viewed in people search (up to 8). To spare you the wait when you reopen the app, the last state of your home feed, profile and Messages list (posts, counts, message previews) is also kept only on your device, separately for your account, for at most 24 hours; who is where right now is never written to it, and it is deleted when you sign out.

Verified profile application (optional): the category you apply in (person, business, brand), display name, the verification code given to you and the selfie you take with that code. Only a moderator sees the selfie and compares it by eye with your profile photo; no automated face recognition is used and no ID document is requested. The selfie is deleted after the decision; the application is kept for 1 year after the decision and deleted immediately if you delete your account. For your subscription we keep the transaction ID reported by the store, the platform and the period end date (your payment details stay with Apple or Google); these are deleted 1 year after the subscription ends. Slooin may also make a profile verified without an application; this designation, its reason and any removal are kept as moderation records and are deleted when you delete your account.

Reports you filed or reports filed about you. If you attach a photo, video or document (PDF) to a report, the file is stored with that report and seen only by the moderation team; it is never shown to other users.

The ratings you give to places (Bad / Good / Great). Everyone sees only the totals; which rating you gave is visible only to you. You can add up to 5 photos or videos to your check-in (videos up to 60 seconds; recorded with sound if you have allowed microphone access); videos are also subject to the visibility rule of the post. Your check-in photos and the first frame of your videos also appear in the photo area of that place, under the visibility rule you chose.

Your moments: the photo or video of up to 60 seconds you take on the spot and, if you have checked in, the place tag. A video also records sound if you have allowed microphone access; microphone access is only requested when you switch to video mode, never for photos. For each moment you choose who can see it: "Friends" (the default) or "Only me"; a moment set to "Only me" cannot be seen by anyone but you. People you have blocked can never see them. After 24 hours a moment leaves the strip and only you can see it: its photo or video and place stay in your moments archive until you delete it or your account. Who viewed your moment, when, and which emoji they left on it is recorded; only you see that list, and it is deleted after 24 hours. An emoji you leave on someone else’s moment is seen only by that moment’s owner; a reply you write goes to them as a chat message. You can delete a moment yourself at any time.

Share link: when you share a memory with the Share button, a link like slooin.com/paylasim/… is sent. Anyone who receives it can see, without the app, the username, profile photo, place (district, province), date, note and first photo (if the first item is a video, only its first frame; the video does not play). The page only opens for public memories of non-private profiles; a live check‑in (where you are right now), private profiles and friends-only posts are never shown. The page is closed to search engines; if you delete or hide the post, the link stops working. If you boost your post (sponsored), a public post of yours, a memory or a live check-in (your “Search visibility” setting must also be on), is shown with a “Sponsored” label in the feed of users in your chosen area (it isn’t shown to you or to people where there is a block between you); if a live check-in is boosted, the card doesn’t show “here right now” or the time of the post; the card is the same as a normal post card (username, profile photo, place, note, photos), but friends you tagged aren’t shown. If you delete or hide the post, make your profile private, or turn off “Search visibility”, it stops being shown right away. If you report a sponsored ad, your report (reason, any note, date) is kept with your account and deleted 1 year after it has been reviewed (a report that hasn’t been reviewed isn’t deleted); only the moderation team sees it, your identity isn’t shown to the advertiser, and that ad isn’t shown to you again.

iPhone Lock Screen card (Live Activity): when you check in on an iPhone, the place's name, how many people are there and the profile photos of up to 3 of your friends who are at that place are shown on the Lock Screen and in the Dynamic Island. This information is kept only on your device; when the check-in ends, when you tap "I left" or when you sign out, the card closes and the photos on the device are deleted. Anyone who can see your phone can see the Lock Screen; if you don't want this, you can turn the card off in your iPhone's Settings › Slooin › Live Activities.

2. For what purpose - and on which legal basis

KVKK article 10 requires the legal basis to be stated alongside the purpose of processing. The basis of each purpose is written separately.

Setting up your account and verifying your e-mail address. Legal basis: performance of a contract (KVKK art. 5/2-c) - without an account no function of the app works.

Letting you discover places and people nearby (location and check-in). Legal basis: performance of a contract (KVKK art. 5/2-c). The only thing Slooin does is let you check in to a place and see who is there; without processing location the app does not work, so location is not an "extra feature" but the service itself.

Letting you message. Legal basis: performance of a contract (KVKK art. 5/2-c).

Preventing and investigating abuse (harassment, fake accounts, inappropriate content) - report records, the moderation audit trail, account status records and request-cap counters. Legal basis: legitimate interest (KVKK art. 5/2-f): being able to protect users from harassment and abuse.

The consent you give by tapping "Continue" when creating your account is written to the database as a record of proof: that you read the privacy notice and accepted the processing of your location data, together with the text version and the time of consent (two records: aydinlatma and konum_rizasi). This record does not replace the legal bases above - it is kept on top of them so that we can show retrospectively what was disclosed to you.

Choosing sponsored suggestions based on the province and district where you live. Legal basis: explicit consent (KVKK art. 5/1). Consent is not a condition of the service; if you do not give it, no feature of the app is restricted. From 17 October 2026 this permission is called “Sponsored suggestions for you” and also covers your age group: if an advertiser picks age groups, your age group (18–24, 25–34, 35–44, 45–54, 55+), calculated from your date of birth, is used only for this matching; your date of birth and age group are never passed to advertisers. Age-targeted ads are not shown to people who haven't given permission. The earlier area permission did not cover this scope, so it was switched off and is asked once again.

Creating the sponsored ad, verifying payment, showing the ad and reviewing live ads. Legal basis: performance of a contract (KVKK art. 5/2-c).

3. Location in particular

Your device's location is used in THREE different ways; it is important not to mix them up.

When searching for places: to show places nearby, your device location is SENT to the server with every place search. This location is NOT STORED - it is used only to answer that query and is not written anywhere in the database.

When adding a new place: to verify that you are really near the place you want to add, your device location is sent (you must be within ~200 metres). This location is NOT STORED either - it is used only for this proximity check. The only thing stored is the location of the added place, not your location at that moment.

When you check in: your device location is sent only to verify that you are within about 1 km of the place, and it is NOT STORED. While the check-in is ACTIVE, the record stores the place's own location, not your exact location; it only carries the "here right now" information. The check-in turns into a memory as soon as you tap "I left" or check in at another place, otherwise automatically 4 HOURS later at the latest, and this location is DELETED too (set to null in the database) - only the place you were at remains. Because the clean-up job runs every 10 minutes, this information is kept for at most about 4 hours 10 minutes.

Who can see your live check-in ("here right now") is determined by your Settings › Location and check-in › Venue visibility setting; the choice in effect at the moment you check in applies to that check-in. Visible to everyone - NOT everyone in the app, only people with a live check-in at the same place at that moment and your friends. Visible to friends only - only your friends. You cannot check in without being visible at the place; both options also apply to a private profile (your name, username and photo are public on a private profile too).

After the check-in turns into a memory (after the location is deleted), the "live at the same place" condition no longer applies; unless you choose otherwise under Privacy in the post's ⋯ menu, the memory's visibility follows your venue visibility: with Visible to everyone, everyone in the app sees it (active accounts, excluding blocks); with Visible to friends only, only your friends do. If your profile is private, your memories are visible only to your friends. Under Privacy you can pick Everyone, Friends or Only me (only you see the memory, on your own profile); this choice only affects the memory, not the live check-in.

When you choose "Visible to friends only", other people at the place cannot see who you are - except your friends and moderation. There is one exception: you are counted in the place's public "how many people are here" counter (crowd level) REGARDLESS of this choice. So your identity stays hidden, but the counter goes up with your presence - at a quiet place, when the counter goes from 0 to 1, someone there could infer that "someone is here".

4. Moderation access

When a report is made about you or you are being reviewed on suspicion of abuse, our moderation team can read your profile, your check-ins and your message contents. This applies even if your presence level is hidden.

Every moderation access is recorded: who looked at which of your records, and when, is kept in an audit trail. This trail accepts ONLY ADDITIONS - the record is created server-side, and there is no way for a moderator to delete or alter their own access record. Access is used only in the context of a report or a review, not for casual browsing. Records are kept for 2 YEARS (see section 6).

5. Transfer abroad

The servers of Supabase (database and file storage) are in Germany (eu-central-1 region). All your personal data is kept outside Türkiye, within the borders of the European Union.

The servers of the Expo Push API (notification delivery) are in the United States of America. When a notification is sent, your device's notification token, whom it is sent to, and the name of the person who triggered the notification pass through here (for example 'Deniz sent you a message'). The text of the message is never added to the notification, but another person's name is also personal data and is part of this transfer.

Verification e-mails (sign-up, sign-in and account deletion codes) are sent by Resend Inc.; its servers are in Ireland (eu-west-1 region, European Union). Only your e-mail address and the code sent pass through here; the code expires within 10 minutes.

The map base is provided by Apple Maps on iOS and Google Maps on Android. While the map is drawn, the coordinates of the region visible on screen go to this provider; your identity, account or check-ins do not. The web version has no real map, so this transfer does not happen there. If you sign in with Apple or Google, the sign-in takes place on Apple's or Google's own screen and under their own terms (their servers include the United States); we receive only the identity token that verifies the sign-in and the account details listed in section 1, and we send them no personal data.

slooin.com and the moderation panel are hosted on Cloudflare, Inc. (servers worldwide, including the United States); when you visit the site, your IP address and browser details pass through this infrastructure. In the app, when you request a sign-in, sign-up, password reset or account deletion code, a one-way (irreversible) hash of your IP address and e-mail address is kept for 2 hours to prevent abuse, then deleted.

Legal basis of the transfer: all of these transfers are necessary to provide the service, so they rest on the same basis as in section 2 - performance of a contract; notification delivery and abuse protection additionally fall under legitimate interest (preventing abuse of the service).

Transfer safeguards: under KVKK article 9, transfers abroad are made on the basis of an adequacy decision of the Personal Data Protection Board or one of the appropriate safeguards listed in the Law. As the Board has not issued an adequacy decision for these countries, the transfers rest on the data processing agreements concluded with the service providers; under these agreements the providers undertake to process the data only to provide the service and on our instructions, to keep it confidential and to take the necessary security measures. The process of signing the standard contracts published by the Board with the providers and notifying them to the Personal Data Protection Authority is under way; this text will be updated once it is completed.

6. Retention periods

There is more than one automatic deletion/clean-up rule in force today (not a single rule).

Expired (older than 90 days) account suspension records are automatically deleted from the database every day (full deletion, not archived). There is no copy of these records kept elsewhere today.

In the records kept to compute the daily cap on friend/chat requests, rows older than 2 days are automatically deleted every day.

The location in the check-in record (the place's location; as described in section 3) is deleted automatically when the check-in turns into a memory.

Moderation access records (see section 4) are kept for 2 YEARS. A clean-up job running every day at 04:45 deletes rows older than that. This rule is IN FORCE today.

Your memories (the rest of your check-in history) are kept until you delete them or your account. There is no time-based automatic deletion for messages: on blocking they are deleted on both sides, and if you delete your account, the ones you sent are deleted (see below).

Reports: a decided report is deleted 1 year after the decision by a cleanup job that runs every day; any photo, video or document attached to the report goes with the record (the file is deleted from storage by the hourly cleanup). A report that has not yet been reviewed is not deleted. Sponsored ad reports are also deleted 1 year after they have been reviewed. This rule is IN FORCE today.

If you block a user: all one-to-one messages and the conversation between you, pending requests and the friendship are permanently deleted. Deletion applies on both sides and cannot be undone; unblocking does not bring the deleted messages back. If there is a report between you that has not yet been reviewed, the conversation appears deleted to both of you but is kept only for moderation until the report is decided, and is then deleted.

If you delete your account: your profile, memories, friends and conversation list are permanently deleted. The messages you sent (text, photos, videos, voice and location) are also deleted; what the other person wrote themselves stays with them. Exception: your messages in a conversation that is the subject of a report not yet reviewed are kept as evidence until the report is decided (your sender identity is detached); once it is decided, they are deleted by an hourly cleanup job. In reports you filed the identity link is cut; in reports filed about you the identity link is NOT cut, the target identity stays in the moderation record. Your profile, check-in and moment photos and videos are deleted from storage.

View records and emojis left on moments are deleted 24 hours after posting by an hourly cleanup job; the photo or video and place stay in the archive only you can see. This rule is IN FORCE today.

Since 17 October 2026 sponsored applications don’t ask for or store a phone number; numbers collected earlier were deleted that day.

Sponsored ad payment records (store transaction number, amount, date) are deleted 1 year after payment; if you delete your account, these records are detached from your identity and kept until the end of that period.

If you signed in with Apple, deleting your account also revokes Slooin's connection to your Apple ID; for this, Apple asks you to confirm once during deletion. This confirmation is used only for the revocation and is not stored.

7. Your rights

You can freeze your account. Your data is not deleted, you become invisible; when you sign in again your account becomes active by itself.

You can delete your account permanently. There is no way back; if you want to return you must create an account from scratch.

You can download a copy of your data: Settings > Download my data. The file is prepared in JSON format and delivered with a link valid for 15 minutes; the file itself is deleted after 24 hours. When the link expires, you can download again.

What is NOT in the file: reports filed about you (because they carry the reporter's identity), the moderation audit trail, who blocked you, and the text of messages sent to you. For messages sent to you, only who they are from, how many there are and when the last one was sent are included - the sentences on the other side of a conversation are that person's data.

YOU PROTECT THE FILE YOU DOWNLOAD. It contains everything in your account, including your location history; whoever you share it with sees all of it.

How to apply: you can send your requests to destek@slooin.com; your request is answered within 30 days at the latest.

Under KVKK article 11, you have the right to: learn whether your personal data is processed; request information about it if it has been processed; learn the purpose of processing and whether the data is used in line with that purpose; know the third parties in Türkiye or abroad to whom it is transferred; request its correction if it is incomplete or inaccurate; request its deletion or destruction under the conditions in KVKK article 7; request that corrections and deletions be notified to the third parties to whom the data was transferred; object to an outcome against you that arises from analysis exclusively by automated systems; and claim compensation if you suffer damage because of unlawful processing.

So that we can verify your identity, you need to send your request from the e-mail address registered to your Slooin account; for a request from another address we may ask for additional information to verify your identity. Applying is free of charge; if handling the request involves an additional cost, the fee set by the Board may apply.

8. Data security

Your data is encrypted in transit (TLS) and stored encrypted on the server. In the database, access to each record is limited by row-level authorisation rules: a user can only read the records they are authorised to see. Photos, videos, audio and documents are kept in non-public storage and opened only for a person authorised to see them, through a short-lived link. Your password is not stored in plain text. Moderation access is logged (section 4).

If a data breach occurs, it is notified to the Board and to the people affected as soon as possible under KVKK article 12/5. No system is completely secure; we take reasonable technical and organisational measures. Protecting your password, sign-in codes and device is your responsibility.

9. Competent authorities

Your personal data is not sold, rented out or given to third parties for marketing. Upon a lawful request from public institutions and bodies with legal authority, or from judicial authorities, it may be shared with those authorities, limited to the scope requested (KVKK art. 5/2-ç and art. 8). Where necessary to establish, exercise or protect a right (for example in a legal dispute), the relevant records may be used for that purpose (KVKK art. 5/2-e).

10. People under 18

Slooin is not intended for people under 18, and we do not knowingly process the data of people under 18. Someone whose date of birth shows they are under 18 cannot create an account. An account found to belong to someone under 18 is closed and its data deleted; if you notice such an account, you can report it to destek@slooin.com.

11. Automated decisions and changes

No decision that affects you is made about your account based solely on automated systems; decisions to remove content, suspend or close accounts are made by a moderator. The only exception concerns advertisers: a sponsored ad reported by 5 different users is paused automatically until its review is finished.

If this text changes, the current version is published in the app and at slooin.com/gizlilik; significant changes are announced in the app. Which version of the text you accepted when you created your account is recorded.

12. Cookies and the website

slooin.com uses no advertising, analytics or tracking cookies. Only if you change the site's language yourself using the language selector at the bottom is a cookie named dil_secimi set to remember that choice; it is kept for 1 year and carries no information other than the language you chose. The "Open in app" button uses the browser's session storage (sessionStorage) to try to open the app automatically at most once per page; this information never leaves your device and is deleted when you close the tab. Because these records are strictly necessary for the function you asked for, explicit consent is not required; you can delete them at any time in your browser settings.

Site traffic is measured with Cloudflare Web Analytics as aggregate counts only; this tool uses no cookies, writes nothing to your device and does not track you across sites. The mobile app has no cookies; what the app stores on your device (session, appearance preference, recent searches, last screen state) is described in section 1.