Privacy Policy
If the Turkish and English texts differ, the Turkish text prevails.
1. Who we are
The data controller under Turkey's Personal Data Protection Law no. 6698 ("KVKK") is Tahsin Büyükşahin, the individual developer who builds and publishes Coffriend. Contact and all requests: info@perfexus.com. "We" means the developer and the authorised people who do moderation or support on the developer's instructions.
2. What we collect, and how
We collect data electronically: what you enter, what the app records while you use it, and what other users report (for example a report about you).
| Category | Data |
|---|---|
| Account | Phone number (only in the sign-in service; never shown to anyone), random user ID, support code |
| Profile | First name, date of birth (others see only your age), gender, who you want to meet and the age range, 1–6 photos; optionally occupation, education, height, interests, conversation style, café and drink preferences, free hours |
| Approximate location | District name and a roughly 5 × 5 km area code. Your phone works out the district or you pick it; it also uses its position, on the phone only, to work out the walking time to a café. Latitude/longitude never reach the server and location is never used in the background. Outside Istanbul, only your province code |
| Use | "I'm up for coffee" windows, the people-nearby list and its order, allowances, invites, meetups, answers, feedback, reminders you set, notification settings, waitlist |
| Messages | The text chat that opens once a meetup is accepted (up to 500 characters) |
| Safety | Blocks; reports with a copy of the last 50 chat messages and the related card; no-show records, suspensions, appeals; automatic check results; moderator notes; a one-way hash of a removed account's phone number |
| Confirmations | The 18+ and Terms/Guidelines confirmation at sign-up, text versions, time, language, app version, platform; the right-of-withdrawal confirmation before a purchase |
| Purchases | Subscription status, store transaction and refund records, a pseudonymous purchase account code, invite-pack balance. We never receive card details |
| Technical | Push token (FCM), platform, language, app version; server logs (user ID, operation, error code); the IP address in the cloud provider's request logs |
| Crash reports | Store builds only (Firebase Crashlytics): error type and text, app version, screen name, installation ID; not linked to you |
| Support | Your e-mail address and what you write if you contact us |
| Admin records | When an authorised person views your profile, opens your chat or edits your account: who, when and why (no message content) |
The camera and photo library are used only for the profile photo you choose; the microphone is never used. Saved guide articles and the photo cache stay on your phone. There are no ads, no cross-app tracking, no analytics tool and no sale of data.
3. Purposes and legal bases
| Purpose | Legal basis (KVKK Art. 5(2)) |
|---|---|
| Account and sign-in; showing your profile; finding and ordering people nearby by mutual preferences; invites, meetups, chat; notifications you asked for; waitlist | (c) entering into and performing the contract |
| The 18+ age limit | (c) performance of the contract; (f) legitimate interest |
| Safety: blocking, reports, automatic checks, temporary hiding, the no-show rule, suspensions and appeals, preventing fraud and re-registration of removed people | (f) legitimate interest; (e) establishing, exercising or defending a right |
| Purchases and refunds; tax records; support and data protection requests | (c) performance of the contract; (ç) legal obligation |
| Fixing errors; measuring the service with daily totals that identify nobody | (f) legitimate interest |
| Recording confirmations and authorised access, data security, breach notification | (ç) legal obligation (KVKK Art. 12); (e) defending a right |
| Requests from authorities; sharing the minimum needed when a life is in danger | (ç) legal obligation; (b) protecting life |
No processing relies on your explicit consent. We do not ask for special categories of data; if you write such data in a chat or report yourself, it is used only to run the service and review the report.
Automated processing: people nearby are ordered by shared free time, how close the districts are and shared preferences; looks are never scored. Texts are checked against a word list and photos with Google Cloud Vision (the likelihood of nudity and violence; the photo is not kept for this); a failing message is not delivered and a clearly explicit photo is removed. A profile that gets serious safety reports from two different people within 7 days is hidden until a moderator decides. The no-show rule can trigger an automatic warning and suspension (Community Guidelines, rule 4). A person reviews all of these and you can object.
4. Who receives your data
| Recipient | Purpose | Location |
|---|---|---|
| Google (Firebase, Google Cloud) | Database, photos, server functions and logs | EU (Belgium, the Netherlands, Germany) |
| Google Cloud Vision | Photo checks | EU |
| Google Firebase Authentication | Phone sign-in, SMS | USA |
| Google Firebase Cloud Messaging; on iPhone, Apple Push Notification service | Notifications | Global infrastructure |
| Google Firebase Crashlytics | Crash reports | Global infrastructure |
| RevenueCat, Inc. | Verifying purchases: a pseudonymous account code, store transaction records, device platform and app version (while purchases are enabled in the app; never your name or phone number) | USA |
| Apple and Google stores | Payment, subscriptions, refunds (as independent controllers) | Their own infrastructure |
| Other users | The profile details in section 5 | — |
| Authorities and courts; legal advisers | Legal obligations, defending rights | Turkey |
International transfers are made under KVKK Art. 9 on the basis of the standard contracts published by the Turkish Personal Data Protection Board, not on your consent. Our service providers process data only on our instructions and with protection equal to this policy. We do not sell your data.
5. What other users see
People who see you nearby, exchange an invite with you or meet you can, for a limited time (24 hours; 90 days after a meetup), see your first name, age, district, photos, optional profile details and, unless you hid it, your gender. Your phone number, date of birth and location are never shown, and notifications never contain message text. Fictional profiles made for testing and store review are visible only to test accounts and review teams.
6. Retention and deletion
Account and profile data is kept until you delete your account. Chats are deleted 30 days after closing, invites after 6 months, meetups after 12 months. Safety and moderation records are kept even after deletion for 6 months or (after a sanction) 2 years, and purchase records, de-linked from you, for 10 years. All periods: Retention and Deletion Policy.
Delete your account in the app with Profile → Delete my account; if you cannot use the app, use the route on coffriend.com/en/delete-account. Deleting your account does not cancel a store subscription.
7. Security
Data is encrypted in transit and at rest; everyone reaches only their own data and the profiles they may see. Admin accounts use two-step verification. We report a data breach to the Board within 72 hours and to the people affected as soon as possible.
8. Access to chats
Chats are not end-to-end encrypted but are not read routinely. An authorised person can open a chat only for a support request, safety or a legal request; the reason, the person and the time stay on record for 2 years. We tell you in the app when something on your profile was changed.
9. Your rights and how to apply
Under KVKK Art. 11 you can learn whether your data is processed, ask for information, its purpose and recipients, ask for correction or deletion and for these to be passed on to recipients, object to an adverse result produced solely by automated analysis, and claim compensation.
How to apply: e-mail info@perfexus.com with the subject "Data protection request", stating your full name, Turkish ID number (or nationality and ID number), registered phone number and request. You can also send it with a secure electronic or mobile signature. We may verify you with a one-time code sent to your registered number. We answer free of charge within 30 days. If you are not satisfied, you can complain to the Personal Data Protection Board within 30 days, and in any case within 60 days of your request.
10. Age limit and changes
Coffriend is only for people aged 18 or over; we close accounts we learn belong to a minor. If this policy changes we show the new version in the app and ask you to confirm with "I have read and understood"; this is not consent. The current version is under Profile → "Privacy and KVKK".