Privacy Policy

Data We Collect

We process only the data needed to provide the service. The information we collect falls into three groups: information you provide to us, information collected automatically as you use the app, and information from the sign-in providers you use.

• Information you provide: your username, your birthday (used to derive your zodiac sign and determine your age; you must declare you are 18 or older), your gender (chosen during registration and not changeable once set), the profile photo required at registration, the posts and images you share, post captions, the text and image content you send in messaging, and your help/support requests.
• AI-derived data: tags, categories, and semantic-search vector representations derived from your posts by AI (Google Gemini).
• Phone number and verification code: when you sign in or register by phone, we process your phone number and send a one-time verification code (OTP) to it by SMS. The code is retained only briefly (a few minutes) and is invalidated after verification. We may also process your phone number in the "connect phone number" flow within account settings.
• Information collected automatically: device information (device model, OS version, brand, system name, app version), a stable per-install device identifier, information used for app-bootstrap checks at launch (maintenance, force-update, and blocked-device checks), and a Firebase Cloud Messaging (FCM) push token for notifications.
• Information from providers: when you sign in with Google or Apple, we read your provider identity (provider and provider_id), your name, and—where provided—your email address. Apple shares your name and email only on the first sign-in and, depending on your choice, may provide a private relay address instead of your real email.
• Other data tied to your account: your follow relationships (followers/following), block relationships, account status, language preference, and recent search terms stored locally on your device only for Discover.
• No face or biometric data: Suffle does not collect, detect, recognize, map, or store faces or any biometric identifiers. Your post and profile photos are processed only as ordinary images; the server-side AI (Google Gemini) tags images by scene, object, and topic only and performs no face recognition. The app does not use Face ID or device biometrics for authentication either.

How We Use Your Data

We process your personal data only for clear and limited purposes:

• Operate and secure the service: create your account, display your profile, publish your posts and content, and manage messaging and follow relationships.
• Authentication and session management: secure sign-in with Google or Apple, or with your phone number and a one-time SMS verification code (OTP), and session security (sessions may be ended when you sign in on another device).
• Discover and content organization: post images are auto-tagged and categorized server-side using AI (Google Gemini) so that semantic search and the Discover feed can work.
• Notifications: when you grant permission, send push notifications for events such as new messages, and let you manage your notification preferences.
• Moderation and safety: enforce our community guidelines, prevent abuse, handle block/unblock actions, and run app-bootstrap checks such as maintenance, force-update, and blocked-device checks.
• Support: respond to your help requests and contact you about matters related to your account.

Data Sharing

We do not sell your personal data. We share your data only in the following cases and with contractually bound service providers (data processors):

With trusted infrastructure providers (such as Firebase/Google) that process data solely on our instructions to deliver the service. We may also share data with competent authorities where necessary to comply with a legal obligation, protect our rights, or ensure the safety of our users.

Third-Party Services

Suffle relies on the following third-party services to provide the service:

• Firebase Authentication and Google Sign-In: authentication and session creation.
• Firebase Cloud Messaging and notifee: delivery and on-device display of push notifications.
• Firebase Storage: server-side storage of uploaded profile photos and post/chat media.
• Google Gemini: server-side AI tagging and categorization of post images.
• SMS provider: delivery of the one-time verification code (OTP) to your phone number by SMS during phone sign-in/registration.
• Sign in with Apple: authentication and session creation on iOS.
• Apple App Store and Google Play: distribution of the app.
• These providers' processing of your data is also subject to their own privacy policies.

Security

We apply reasonable technical and organizational measures to protect your data. Data is encrypted in transit, and sensitive information stored on your device is kept encrypted. Access is limited through authenticated sessions and authorization controls. While no method is completely secure, we continuously work to protect your data.

Retention and Account Deletion

We retain your personal data only as long as necessary for the purposes described in this policy. You can permanently delete your account from within the app via Account Settings. Account deletion is irreversible and your account is permanently deleted. Except where we must retain certain data to meet legal obligations, your related data is deleted or anonymized. You can also request deletion at any time by emailing contact@sufflesocial.com.

Your Rights (GDPR and KVKK)

Under the EU General Data Protection Regulation (GDPR) and Turkiye's Law No. 6698 on the Protection of Personal Data (KVKK), you have the following rights:

• The right to access your personal data and learn whether it is being processed.
• The right to request correction of incomplete or inaccurate data.
• The right to request erasure or destruction of your data.
• The right to object to the processing of your data and to withdraw consent you have given.
• The right to data portability where the relevant conditions apply.
• To exercise these rights, contact us at contact@sufflesocial.com. We will assess your request within the timeframes required by applicable law.

Children

Suffle is intended for users aged 18 and over and is not directed to children. We do not knowingly collect personal data from anyone under 18. If we learn that a child has provided us with data, we will delete the relevant account and data. If you have any concern about this, please contact us at contact@sufflesocial.com.

International Data Transfers

Suffle is operated by SUFFLE LLC, established in the United States. As a result, your personal data may be transferred to and processed on servers located outside your country of residence. We take reasonable measures to ensure that data transfers are carried out in compliance with applicable data protection law and under appropriate safeguards.

Cookies and Website

The sufflesocial.com website uses the minimum technical data necessary to provide the site's core functions. The mobile app does not use advertising cookies for tracking. We will update further detail on the site as needed.

Changes

We may update this Privacy Policy from time to time. When we make significant changes, we will update the "last updated" date above and, where appropriate, notify you in the app. We encourage you to review this policy periodically.

Contact

If you have any questions or requests regarding this Privacy Policy or your personal data, please contact us.