Personal Data Notice (KVKK)

Last updated: 24 October 2026

This notice is provided under Article 10 of the Turkish Personal Data Protection Law No. 6698 ("KVKK") to inform users of the Hubi mobile app ("Hubi") about how their personal data is processed. The Turkish version prevails in case of any difference.

1. Data controller

Emir Biçeryen ("Hubi", "we")

Address: Güzeller Mahallesi 932. Sokak No: 21 Kat: 3 Daire: 10, Gebze / Kocaeli, Turkey

Email: [email protected]

2. Personal data we process

• Identity and contact: name, username, email address; when you sign in with Google or Apple, the identifier and email those services share.
• Account security: password (stored only as an irreversible hash), email verification and password reset codes (hashed, valid for 15 minutes), sign-in attempts.
• Age: date of birth, used to determine your age group (under 18 / 18 and over) and keep the groups apart.
• Profile: profile and gallery photos, hobbies and skill levels, profile texts, teams and your role in them.
• Location: the province and district you choose and an approximate location for it. If you share your device location, coordinates are rounded to about 1 km; your exact location is not stored and is never shown to other users.
• Your content and communications: posts, comments, events, team details, invites, connections, messages and team chats.
• Safety and moderation: people you block, reports you make or that are made about you, a copy of reported content, moderation decisions.
• Device and usage: push notification token, platform, language and notification preferences, last active time, IP address and server logs.
• Subscription: Premium status and expiry. Payment details are not processed by Hubi; payments go through the App Store or Google Play.

Hubi does not ask for special categories of personal data. Location and device details (EXIF) are removed from photos on upload.

3. Purposes and legal bases (KVKK Art. 5/2)

• Creating your account, signing in and keeping it secure (c: performance of a contract)
• Hobby, level and distance based suggestions, invites, messaging, community and team features (c: performance of a contract)
• Keeping under-18 and adult users apart, protecting minors (ç: legal obligation; f: legitimate interest)
• Reviewing reports, preventing rule violations, fraud and abuse (f: legitimate interest; ç: legal obligation)
• Sending notifications (you can change preferences in Settings) (c: performance of a contract)
• Legal obligations (records under Law No. 5651, requests from authorities) (ç: legal obligation)
• Operating, troubleshooting and securing the service (f: legitimate interest)
• Providing Premium (c: performance of a contract)

4. Transfers

We do not sell your data or share it for advertising. It is shared only as needed with these service providers:

• Servers and database: MongoDB Atlas and Render (Amazon Web Services infrastructure, Frankfurt – Germany)
• Photo storage: Cloudflare, Inc. (R2)
• Email delivery (verification and reset codes): Resend
• Push notifications: Expo, Apple (APNs), Google (FCM)
• Sign-in services (only if you use them): Google, Apple
• App stores (Premium): Apple, Google
• Authorised public authorities and courts, when legally required.

Some providers have servers outside Turkey. Transfers abroad comply with KVKK Article 9 through standard contracts with the providers.

5. How data is collected

From what you enter when you sign up and use the app, from Google or Apple if you sign in with them, and automatically while the app runs.

6. Retention

• Account data: while your account is open. Deleting your account deletes or anonymises your personal data immediately and removes your photos from storage.
• Messages: messages you sent are deleted with your account.
• Notifications: 90 days. Profiles you passed on in Discover: 30 days.
• Reports and moderation records: 2 years for safety and possible legal disputes.
• Server and traffic logs: for the period required by law, at most 2 years.

7. Your rights (KVKK Art. 11)

You may ask whether your data is processed and request information about it; learn the purpose and whether it is used accordingly; know the third parties it is transferred to; request correction, deletion or destruction; request that third parties be notified; object to a result against you arising solely from automated analysis; and claim compensation for damage caused by unlawful processing.

You can edit your profile, photos and preferences in the app and delete your account in Profile → Settings → Delete my account. For other requests, write to [email protected] or Güzeller Mahallesi 932. Sokak No: 21 Kat: 3 Daire: 10, Gebze / Kocaeli, Turkey with information that verifies your identity. We reply free of charge within 30 days.