Data Protection Notice (KVKK)

Under Turkish Personal Data Protection Law No. 6698 · Last updated: July 23, 2026

1. Data Controller

The operator of the Jellyfish app is the "data controller" under KVKK. Contact: [email protected]

2. Personal Data We Process

• Identity/Contact: the unique user ID and (if shared) email address provided when signing in with Google or Apple.
• Profile: username, display name, profile photo.
• Activity/Content: comments, likes, ratings you share and the page address they relate to.
• Social: friend requests and relationships, block information.
• Technical: minimal records needed to run the service (timestamps, error logs).

Note: Your AI session keys and AI conversations stay only on your device; they are not transmitted to or processed by the data controller.

3. Purposes of Processing

• Creating and managing your account
• Providing social comment, friendship and discovery features
• Ensuring security and preventing abuse (spam, harassment)
• Meeting legal obligations

4. Legal Grounds (KVKK Art. 5)

• Necessity for the performance of a contract (providing the service)
• The controller's legitimate interest (security, abuse prevention)
• Your explicit consent (optional shares such as a profile photo)
• Where expressly required by law

5. Data Transfers

Your personal data may be transferred, as required to operate the service, to our infrastructure providers (server: Hetzner — Germany/Finland; security/storage: Cloudflare). Authentication runs via Google and Apple. Your data is never sold or shared with third parties for advertising or marketing. Cross-border transfers are carried out with the safeguards required by KVKK.

6. Retention Period

Your personal data is kept as long as your account is active. When you delete your account, your data is permanently erased within 30 days at most; if you sign in again within that window, your account is reactivated. Legal retention obligations are reserved.

7. Your Rights (KVKK Art. 11)

Under Article 11 of KVKK you have the right to: learn whether your data is processed, request information about it, learn the purpose of processing, request correction of incomplete/incorrect data, request deletion or destruction, object to processing, and claim compensation for damages.

To exercise these rights, contact [email protected]. Requests are resolved within 30 days at most.

8. Security

Your data is protected with technical and administrative measures such as end-to-end TLS encryption, access restrictions and regular backups.

9. User Comments and Third-Party Data

Jellyfish is a platform that hosts comments shared by users. If a user's comment contains a third party's personal data (name, image, contact details, etc.), the user who posted the comment is responsible for processing that data; for such content Jellyfish acts only as a hosting provider and does not review comments in advance.

If you believe your personal data appears unlawfully in another user's comment, notify us at [email protected]. We will review your request and remove content we deem necessary within a reasonable time.